Fake Delivery Texts in Poland
Smishing campaigns impersonating InPost, DHL and Poczta Polska steal BLIK codes and banking credentials from Polish online shoppers.
Part of: Fake Delivery Texts
Last reviewed: 1 June 2026
Poland's booming e-commerce market and high InPost parcel locker usage make fake delivery smishing a highly effective fraud vector. CERT Polska ranks parcel-themed smishing among its top reported cybercrime categories, with campaigns impersonating InPost, DHL, DPD and Poczta Polska running year-round and intensifying around Boże Narodzenie (Christmas) and Mega promocje sales periods.
Uniquely to Poland, fraudsters specifically request BLIK codes — Poland's real-time mobile payment system — as well as card details, exploiting the high rate of BLIK adoption among Polish online shoppers. BLIK payments are near-instant and irreversible, making recovery virtually impossible.
How this scam works on Poland
An SMS arrives claiming a small 'opłata celna' (customs fee) of a few zloty is required before an InPost or DHL parcel can be delivered. A link leads to a convincing clone of the official courier site that requests either a card payment or — in BLIK-specific variants — asks the victim to generate a BLIK code and enter it on the site.
The BLIK code is used immediately to make purchases or withdraw cash at ATMs before the victim can cancel. A separate variant deploys a banking trojan APK disguised as an InPost app update, harvesting PKO BP, mBank or ING bank login credentials.
Polish victims have also reported Facebook Marketplace fraud where sellers request BLIK payment via a fake 'InPost link' for courier service, intercepting the payment before delivery.
Common red flags
- SMS about an InPost or DHL parcel requiring a small payment via a link
- Link does not match inpost.pl, dhl.pl or poczta-polska.pl
- Request for a BLIK code to process a customs fee
- Prompt to install an 'InPost app update' from outside the official store
- Facebook Marketplace seller insists on BLIK via a link rather than in-app payment
How to protect yourself
- Track parcels only through official InPost or DHL apps — never via SMS links
- Never share BLIK codes with anyone other than at a verified point-of-sale
- Report suspicious SMS messages to CERT Polska at cert.pl
- If a BLIK code was shared fraudulently, call your bank immediately to attempt reversal
- Use only official stores for any courier app installations
How to report it
- CERT Polska: cert.pl — report smishing and phishing campaigns
- Policja: policja.pl — file an online 'zawiadomienie'
- UOKIK consumer protection: uokik.gov.pl — report deceptive websites
Frequently asked questions
Can BLIK payments be reversed if I was scammed in Poland?
BLIK payments are near-instant and technically irreversible once processed. Contact your bank immediately — there is a very short window in which an alert may help. File a report with the Policja regardless.