Fake Parcel Delivery SMS Scams in South Africa
South African mobile users receive fraudulent delivery notifications impersonating Postnet, Aramex, DHL South Africa, and The Courier Guy, directing them to phishing pages that harvest banking credentials and card details.
Part of: Fake Delivery Texts
Last reviewed: 1 June 2026
South Africa's fast-growing online retail sector — led by Takealot, Superbalist, and cross-border platforms — generates high delivery notification volumes that scammers mimic. SMS phishing campaigns targeting South African consumers exploit familiar courier brand names and the urgency of package delivery notifications to drive clicks on malicious links.
The South African Banking Risk Information Centre (SABRIC) and banks including Standard Bank and FNB have issued warnings about delivery-themed smishing campaigns that specifically target online banking credentials by intercepting the banking login journey.
How this scam works on South Africa
A victim receives an SMS purportedly from DHL, Aramex, or The Courier Guy claiming their parcel is held at a depot or that a delivery was missed and they must pay a nominal fee — often R20 to R50 — via a link to reschedule. The link leads to a convincing courier portal clone requesting card details.
Alternatively, the link redirects through several pages before landing on a cloned banking login. Entering banking credentials and OTP on this page hands full account access to the scammer, who immediately initiates fund transfers.
Takealot-themed variants claim an order has a delivery problem requiring account verification — the phishing page captures both Takealot account credentials and the linked payment card details.
Common red flags
- SMS from a courier claiming a delivery fee is owed, containing a link to a payment page
- Delivery notification link that redirects to a banking login page
- SMS from an unusually long number claiming to be from a standard courier service
- Takealot or Superbalist notification via SMS asking for account verification through a link
- Delivery portal that requests full card number, expiry, and CVV to pay a nominal redelivery fee
How to protect yourself
- Track deliveries only through the official courier or retailer app — never via SMS links
- Contact the courier directly using the number from their official website if you are unsure about a notification
- Never enter banking credentials on a page reached via an SMS link
- Report suspicious delivery SMS to your bank's fraud line and to SABRIC at sabric.co.za
- Contact your bank immediately if you entered card or banking details on a site reached via SMS
How to report it
- Report to SABRIC at sabric.co.za
- Contact your bank's fraud line immediately to freeze cards and accounts
- Report to the South African Police Service (SAPS) cybercrime unit
Frequently asked questions
Do South African couriers charge fees via SMS for delivery?
Legitimate courier services do not request payment via links in SMS messages for standard domestic deliveries. Customs or import duties for international parcels are handled through formal customs processes, not quick-pay SMS links. If an SMS from a courier asks for payment, contact the courier directly using the number from their official website.