Fake Delivery Texts in the Netherlands
Smishing campaigns impersonating PostNL and DHL steal banking credentials from Dutch online shoppers with fake parcel tracking links.
Part of: Fake Delivery Texts
Last reviewed: 1 June 2026
The Netherlands has among the highest e-commerce penetration in Europe, making fake delivery smishing one of the most frequently encountered consumer frauds. The Fraudehelpdesk and the Dutch National Police (Politie) register thousands of PostNL, DHL and DPD impersonation reports annually, particularly during Sinterklaas (early December), Kerstmis and the summer months.
Dutch smishing campaigns often go beyond card-data theft — they frequently deploy banking trojans targeting popular Dutch banking apps including ING, ABN AMRO and Rabobank, intercepting login credentials and authorisation codes.
How this scam works on Netherlands
An SMS arrives — typically reading 'Uw pakket van PostNL kon niet worden afgeleverd. Betaal €1,95 invoerkosten via...' — with a shortened URL. The landing page replicates PostNL.nl or DHL.nl exactly and requests credit-card details for the nominal 'invoerkosten' (import fee).
Android victims who click a secondary 'installeer onze app' button receive a malicious APK that installs a banking trojan capable of intercepting iDEAL confirmation codes and SMS OTPs from Dutch banks. The malware then sends the same smishing messages to all contacts.
In a variant targeting Dutch business owners, fake DHL invoices for 'douaneklaring' (customs clearance) are sent by email, with payment links that harvest card details.
Common red flags
- SMS about a PostNL or DHL parcel from an unknown number
- Link does not exactly match postnl.nl or dhl.nl
- Small fee required to release a parcel via an SMS link
- Prompt to install an app update from outside the official app store
- Message arrives when you are not expecting a specific delivery
How to protect yourself
- Use the official PostNL or DHL app for tracking — available at postnl.nl
- PostNL never requests payment via SMS link for import fees
- Never install apps via links sent by SMS
- Report suspicious SMS to the Fraudehelpdesk at fraudehelpdesk.nl
- If card details were entered, contact your bank immediately
How to report it
- Fraudehelpdesk: fraudehelpdesk.nl — Dutch specialist fraud reporting
- Politie: politie.nl/aangifte — online police report
- PostNL fraud team: postnl.nl — report misuse of PostNL branding
Frequently asked questions
The SMS came right after I placed a real online order — does the timing make it more believable, or is it still likely fake?
It's still very likely fake — these campaigns are sent in bulk and rely on many recipients coincidentally having a parcel in transit. Verify delivery status only through the official PostNL app or postnl.nl.
Does PostNL ever charge "invoerkosten" through an SMS link?
No — legitimate import or customs fees are handled at delivery or through the official PostNL app, not via a link in an unsolicited text.
Is it dangerous just to open the link, or only if I enter payment details?
Opening the link alone carries lower risk on iPhone, but on Android it can lead to a prompt to install a malicious tracking app that acts as a banking trojan. Never install anything the page suggests.
What should I do if I installed a fake PostNL app on my Android in the Netherlands?
Factory-reset your device or use an antivirus app to remove the trojan. Immediately change passwords for all banking apps, and contact your bank to alert them of potential credential compromise.