Fake Parcel Delivery SMS Scams Targeting German Recipients
German consumers receive fraudulent SMS messages impersonating DHL, DPD, Hermes, and Deutsche Post, directing them to phishing pages that harvest payment card details or install malware under the guise of rescheduling a delivery.
Part of: Fake Delivery Texts
Last reviewed: 1 June 2026
Germany's massive e-commerce volume makes delivery notification SMS a high-trust communication channel that criminals actively clone. Scammers send smishing messages mimicking DHL's standard shipping alert format, including realistic tracking number formats, to direct recipients to pages that harvest credit card credentials or prompt installation of a malicious app.
The Bundesnetzagentur (Federal Network Agency) and BSI (Federal Office for Information Security) have issued repeated warnings about Paketbetrug (parcel fraud) campaigns that spike during peak shopping periods like Black Friday, Christmas, and major Amazon sale events.
How this scam works on Germany
A recipient receives an SMS claiming their DHL or DPD parcel cannot be delivered due to a missing address component or outstanding customs duty. A link leads to a site closely mimicking the carrier's branding, asking for a small payment — typically under two euros — to release the package. This payment captures full card details that are then used for larger fraudulent transactions.
A separate variant asks the recipient to download a 'delivery tracking app' linked from the SMS. The app is malware that intercepts SMS banking OTPs, enabling criminals to drain bank accounts.
Deutsche Post (Postbank) customers are specifically targeted by variants that combine a delivery pretext with a phishing page designed to capture online banking credentials.
Common red flags
- SMS from DHL, DPD, or Hermes containing a link for customs payment or address confirmation
- Delivery tracking link that leads to a domain not matching the carrier's official .de address
- Request to download a new delivery app from a link in an SMS rather than from the official app store
- Request for full card details to pay a small customs or redelivery fee
- SMS arriving from an unusual mobile number rather than the carrier's official short code
How to protect yourself
- Track parcels only through the carrier's official app or website by entering the tracking number manually
- Never click links in delivery SMS messages — go directly to the carrier's official site
- Never download apps from links in SMS messages
- Report suspicious delivery SMS to the BSI at bsi.bund.de and forward to the carrier's official fraud email
- Contact your bank immediately if you entered card details on a site reached via an SMS link
How to report it
- Forward the fraudulent SMS to DHL's official abuse team or the relevant carrier
- Report to the BSI at bsi.bund.de/meldungen
- Report to the Bundesnetzagentur for SMS spoofing at bundesnetzagentur.de
Frequently asked questions
How can I tell a real DHL/DPD/Hermes text from a phishing message?
Genuine courier delivery notifications generally don't ask you to pay a redelivery fee via a link in a text message, and legitimate tracking updates should match a package you're actually expecting. Check the link's actual URL for subtle misspellings of the real courier's domain before clicking. If you're unsure, go directly to the courier's official app or website and enter your tracking number manually instead.
I clicked a fake delivery link and entered my card details — what should I do?
Contact your bank immediately to freeze or cancel the card, since this is the fastest way to stop further charges. If you downloaded anything from the link, run a security scan on your device or have it checked by a trusted professional. Report the incident to your bank's fraud team and change any passwords you may have entered.
Where do I report SMS phishing (Smishing) in Germany?
Report the message to the Federal Office for Information Security (BSI), which tracks phishing and smishing campaigns nationally, and to your mobile carrier. If money was lost or card details were entered, also report it to your bank and to the police (Polizei). Reporting helps limit the spread even when it doesn't guarantee recovery of losses.
Does DHL ever ask for payment via an SMS link in Germany?
DHL Germany does not request payment via links in SMS messages for standard domestic parcels. Legitimate customs duty notifications for international parcels are handled through official DHL customs channels, not via click-to-pay SMS links. When in doubt, contact DHL Germany directly at dhl.de.