Fake Parcel Delivery SMS Scams Targeting German Recipients
German consumers receive fraudulent SMS messages impersonating DHL, DPD, Hermes, and Deutsche Post, directing them to phishing pages that harvest payment card details or install malware under the guise of rescheduling a delivery.
Part of: Fake Delivery Texts
Last reviewed: 1 June 2026
Germany's massive e-commerce volume makes delivery notification SMS a high-trust communication channel that criminals actively clone. Scammers send smishing messages mimicking DHL's standard shipping alert format, including realistic tracking number formats, to direct recipients to pages that harvest credit card credentials or prompt installation of a malicious app.
The Bundesnetzagentur (Federal Network Agency) and BSI (Federal Office for Information Security) have issued repeated warnings about Paketbetrug (parcel fraud) campaigns that spike during peak shopping periods like Black Friday, Christmas, and major Amazon sale events.
How this scam works on Germany
A recipient receives an SMS claiming their DHL or DPD parcel cannot be delivered due to a missing address component or outstanding customs duty. A link leads to a site closely mimicking the carrier's branding, asking for a small payment — typically under two euros — to release the package. This payment captures full card details that are then used for larger fraudulent transactions.
A separate variant asks the recipient to download a 'delivery tracking app' linked from the SMS. The app is malware that intercepts SMS banking OTPs, enabling criminals to drain bank accounts.
Deutsche Post (Postbank) customers are specifically targeted by variants that combine a delivery pretext with a phishing page designed to capture online banking credentials.
Common red flags
- SMS from DHL, DPD, or Hermes containing a link for customs payment or address confirmation
- Delivery tracking link that leads to a domain not matching the carrier's official .de address
- Request to download a new delivery app from a link in an SMS rather than from the official app store
- Request for full card details to pay a small customs or redelivery fee
- SMS arriving from an unusual mobile number rather than the carrier's official short code
How to protect yourself
- Track parcels only through the carrier's official app or website by entering the tracking number manually
- Never click links in delivery SMS messages — go directly to the carrier's official site
- Never download apps from links in SMS messages
- Report suspicious delivery SMS to the BSI at bsi.bund.de and forward to the carrier's official fraud email
- Contact your bank immediately if you entered card details on a site reached via an SMS link
How to report it
- Forward the fraudulent SMS to DHL's official abuse team or the relevant carrier
- Report to the BSI at bsi.bund.de/meldungen
- Report to the Bundesnetzagentur for SMS spoofing at bundesnetzagentur.de
Frequently asked questions
Does DHL ever ask for payment via an SMS link in Germany?
DHL Germany does not request payment via links in SMS messages for standard domestic parcels. Legitimate customs duty notifications for international parcels are handled through official DHL customs channels, not via click-to-pay SMS links. When in doubt, contact DHL Germany directly at dhl.de.