Fake Delivery Texts in Spain
Smishing messages impersonating Correos, MRW and DHL steal card data from Spanish shoppers with fake parcel-release payment demands.
Part of: Fake Delivery Texts
Last reviewed: 1 June 2026
Fake delivery smishing is one of the most frequently reported cybercrimes in Spain, with the Instituto Nacional de Ciberseguridad (INCIBE) flagging Correos, MRW, Seur and DHL impersonation campaigns year-round. Spanish shoppers receive SMS messages claiming a parcel requires a customs payment of €1–€3 before delivery, linking to a phishing site designed to harvest card details.
The campaigns intensify during peak shopping periods — Navidades, Black Friday and the Rebajas — when victims are most likely to be expecting deliveries and less likely to scrutinise unexpected messages.
How this scam works on Spain
A message arrives: 'Su paquete de Correos no ha podido entregarse. Pague €1,50 de gestión en...' followed by a convincing but fake URL. The landing page replicates the Correos or DHL website and requests full card details for the nominal fee. The entered details are captured and used for large fraudulent transactions.
Android users may also be prompted to install a fake 'Correos app' that is actually a banking trojan, intercepting SMS authentication codes from Spanish banks including CaixaBank, BBVA and Santander. The malware spreads by sending the same smishing message to all contacts in the victim's phone.
In a variant targeting tourists and expatriates, the message is written in English claiming to be from the Spanish Post Office, with the same card-capture objective.
Common red flags
- SMS about a delivery from a number you do not recognise
- Link does not match the official domain of the stated courier
- Small fee required to release a parcel — legitimate couriers in Spain do not charge this way
- Prompt to install an app from a link in the message
- Poor Spanish grammar or formatting inconsistent with official courier communications
How to protect yourself
- Track parcels only by typing the courier's official URL directly into your browser
- Never install apps from SMS links — use official app stores only
- If you entered card details, call your bank immediately to block the card
- Forward suspicious SMS messages to 017 (INCIBE) or to the platform's spam-reporting number
- Enable SMS-blocking features on your phone for unknown-sender messages
How to report it
- INCIBE: incibe.es or call 017 — report smishing campaigns
- Policía Nacional: denuncias.policia.es — online cyber-fraud report
- Your bank fraud team: call the number on your card to dispute charges
Frequently asked questions
Does Correos Spain ever send SMS messages asking for payment?
Correos may send tracking notifications but does not request card payments via SMS links. If you receive such a message, treat it as fraud and verify through correos.es directly.