Fake DHL Parcel-Locker Phishing Scam
Criminals send texts claiming a DHL parcel is waiting in a locker and a PIN code or small fee is needed to release it, linking to a phishing site that steals card details. Real DHL Packstations and parcel lockers send access codes through the official DHL app or email — not through payment links.
Part of: Parcel Locker Phishing Scams
Last reviewed: 7 June 2026
DHL Packstation is a widely used automated parcel locker service popular in Germany and other European markets, and similar locker products exist in multiple countries. As contactless delivery has grown globally, scammers have adapted by crafting fake locker-access texts that exploit the increasing familiarity consumers have with parcel lockers.
The message typically says that a DHL parcel cannot be kept in the locker past a certain date and that a small storage fee or reactivation charge is required. This adds a time-pressure element that pushes victims to act quickly without verifying.
The actual DHL parcel-locker system sends access codes by push notification through the DHL app or by email/SMS directly tied to the shipment you are tracking. It does not request payment through a link to release a parcel from a locker.
How this scam works on the DHL brand
A text reads: 'DHL: Your parcel [#XXXXX] is in locker #XX. Storage fee of £1.50 required to release. Access here: [link].' The fake page asks for card details. Alternatively, it asks the victim to log in to their DHL account, harvesting those credentials instead.
Real DHL Packstation or parcel-locker access works through a registered Packstation account: you receive a Transaction Number (TAN) and a unique locker PIN by push notification in the DHL app or via email to the address registered with DHL. No payment is required to retrieve a parcel from a locker; any delivery to a locker is pre-arranged and pre-paid.
Variants in the UK misuse the DHL ServicePoint or Click and Collect branding, and similar scams target Amazon Locker, InPost, and other services. The mechanics are identical: an unsolicited message demands a small fee to release a held parcel.
Common red flags
- Text about a parcel in a locker requesting a fee via a link — real locker access is free once delivered
- No corresponding tracking update in your DHL app or at dhl.com
- Link is not dhl.com or a verified DHL country subdomain
- Message did not come through the DHL app notification system
- Access code not generated through your existing DHL account
- Urgency: 'parcel will be returned in 24 hours if fee unpaid'
- Page requests card details rather than a locker PIN or app login
How to protect yourself
- Open the DHL app directly and check your active shipments for locker delivery instructions
- Never pay a fee via a link to retrieve a parcel from a locker
- Contact DHL customer service via dhl.com to verify any locker-delivery claim
- Forward suspicious texts to 7726
- If you entered card details on the fake page, contact your bank immediately
How to report it
- Report phishing to DHL at [email protected]
- Forward smishing texts to 7726
- Report to Action Fraud (UK) at actionfraud.police.uk or to your national consumer protection body
- Submit phishing sites to your country's national cybersecurity centre
- If payment was made, contact your bank's fraud line
Frequently asked questions
Is there ever a fee to retrieve a parcel from a DHL Packstation?
No. Once a parcel is deposited in a DHL Packstation, you retrieve it free of charge using the TANand PIN sent through your registered account. There are no release fees.
How do I receive my real Packstation access code?
DHL sends your TAN (Transaction Number) and a locker PIN via the DHL app push notification or by email/SMS to the contact details registered on your DHL account for that shipment.