/ Money

Scam DHL email says you have a parcel to collect

We’ve seen fake emails claiming to be from courier company DHL. Don’t be taken in – you don’t have a parcel to collect or track if the email looks like this.

Another brand has joined the list of well-known companies being impersonated in phishing emails by scammers.

As is usually the case, the fraudsters behind these emails are trying to get hold of your name, address and payment details so they can attempt to steal your money.

The tactics are the same as the Santander and Apple ID emails we’ve discussed on Which? Conversation recently.

Targeting a delivery company adds an extra level of intrigue; everyone is, generally, curious and excited about receiving a package through the post.

But if you follow the link you’ll be told there’s a small fee to pay for collection and you’ll be asked to enter your personal data.

DHL phishing email example

Here’s exactly what one of these scam emails looks like:

While the clearly incorrect email address should be a significant red flag, the realistic-looking emails are professionally designed and use high quality branded logos to make it seem like they’re genuinely from DHL. 

And that’s certainly the case for another example we’ve seen. While it turns out the below example is circulating in Canada, it could still find its way into your inbox and be enough to trick some into handing over their details:

We’ve made DHL aware of these phishing emails. It hasn’t responded yet, but we’ll update this page when it does.

Treat unexpected deliveries with suspicion

If you get an email, text message or phone call about a parcel you weren’t expecting, treat it with suspicion.

It’s highly unlikely a courier company would have your email address or phone number if you haven’t made an order using its service.

If you’re still not sure, visit the courier company’s website and contact them to ask whether there’s a parcel waiting for you, using their official contact details. 

And if you think you’ve handed your details over to a suspicious email like this one, contact your bank as soon as you can. It’ll be able to make sure your account is safe.

Guide: how to get your money back after a scam

Have you received this dodgy DHL email? Or other scam emails from courier or delivery companies?

Let us know in the comments if you have, and help us warn others.


Get them all the time. Just delete them, dont get many now. They are obviouly fed up with me. K

And I was waiting for a parcel through dhl road services and the Lichfield freight services depot of dhl has stolen my goods claiming it has been stoped by french customs however the tracking no is showing it has been received in Lichfield and it has never been to France at all

You say, Contact DHL to check if the email is genuine. Have you tried to contact DHL? It’s all automated and virtually impossible to get to talk to anyone. If you do manage to get through on the phone be prepared for it to be an expensive call. 7p per minute and the time flies by in the process. This is probably the reason the scammers have chosen DHL

From DHL’s website:

“For urgent enquiries, please contact Customer Services on 0844 248 0844.
Calls to DHL UK phone numbers beginning ‘084’ cost 7 pence per minute, plus your phone company’s access charge.” https://www.dhl.co.uk/en/contact_centre/contact_express/contact_express_tracking.html

My understanding is that all calls to customer services numbers must be charged at standard 01/02/03 rates or be free. Is DHL avoiding this requirement because the customer is the company that has paid DHL rather than the person who wants to contact DHL about a delivery problem?

Thanks to BillHall for encouraging me to look at this.

Thank you both for looking at that – my understanding is that 0845 numbers etc are still allowed for new business, however this one appears to be a customer service line so I’ll pass it on now.

Reminded me of this one from 2016: https://conversation.which.co.uk/money/costly-0845-087-numbers-customer-service/

Thanks George. Some businesses still provide 087 numbers for new business. A friend who had booked online with Premier Inns was caught out by calling the 0871 number given for the hotel rather than Premier’s customer services number about room that had been booked online. Premier seem to be phasing out 087 numbers, though their website still gives details of the cost, for example:

“Hotel Contact Information

Phone: 0333 777 3904 Calls to 0871 numbers cost 13p a minute plus any additional charges from your phone operator. Calls to 0333 numbers are charged at the national rate.”

Dear Sir. Thank you for your warning.
M. A. Naz

Norman White says:
21 February 2020

Unelicited calls from unrecognised numbers, “known” companies. Any request for information even if caller has correct name and address are blocked. Put the phone down and either use an alternative phone, mobile or landline and call direct to real company. We had a demand for a subscription owing for Amazon Prime by phone. My wife put the phone down. We contacted Amazon who confirmed that we had cancelled our subs a month ago. Never, ever give any information over the phone or in an email and never pay or transfer money even if it appears a legitimate debt without checking the true company.

I think the best thing companies can do is have a strict no links policy for e-mails. It doesn’t take much effort to bring up a web browser and log into DHL, Apple, Amazon, Paypal, etc. to check something, the same as getting a letter in the post that requires attention. For example, if a package has payment due (e.g. import duty), the e-mail could say “Enter the following tracking # on the DHL website and follow the instructions provided”.

Even at present, you can probably get away without ever clicking a link in any e-mail that requires attention. For example, if I’m waiting on a package and coincidentally get an e-mail link this, I first check the from address. If the @ ending has nothing to do with the company like the first example, I just delete it. Next, I head directly to the courier’s website and try the tracking # there. If it doesn’t accept it, I try one more time with courier’s website of where the parcel originates, e.g. DHL Germany if the package shipped from Germany. If that doesn’t work, I delete the e-mail. If I’m really stuck waiting on a package, I get in touch directly with the seller.

I agree, but it would require legislation to stop companies from using links in emails.

I wonder if there are any well known companies that never use email links.

Kevin says:
1 February 2021

Sounds like good advice.
Also, why do genuine companies supply links that appear outside their normal internet domain name? So even genuine links look questionable.
Where is the logic???

Martin Liddle says:
21 February 2020

I think your comment “It’s highly unlikely a courier company would have your email address or phone number if you haven’t made an order using its service.” is not valid. I increasingly get emails and texts from courier companies delivering on behalf of an online seller and usually I have no idea which delivery company they have chosen to use when I place the order.

Frances Johnson says:
22 February 2020

Yesterday, I received an email supposedly from The App Store showing an invoice for two fighting games costing £58 that had been taken from my account. It included the direction “if this was not your purchase contact us “
I panicked and tried to contact them immediately, but then realised it was a scam. It looked so convincing. Please warn others.

Thanks for letting us know Frances. Do feel free to send a screenshot to conversation.comments@which.co.uk

We also covered a similar Apple scam here: https://conversation.which.co.uk/money/apple-id-locked-account-scam-email/

Last week when renewing my mother’s driving licence on line at gov.co.uk website it was infiltrated by a scammer who tried to charge 79.56£ (written just like that). Interesting as it is free of charge! However, being on such an official website I can understand how people get caught.

Furthermore, after having just received a lovely thank you message from a very satisfied eBay recipient re the parcel I had sent him via Hermes, I received two emails from Hermes saying that the parcel couldn’t be delivered until I send £10.86 as it exceeded size limitations ( invoice on 2nd email).

There seems no limit to them at present.

Kevin says:
1 February 2021

My elderly father had a similar experiencing when checking his tax or MOT. The Google search produced a list and he clicked on the first believing it to be the right one. Sure enough it made him register and subscribe. He believed it to be genuine. I explained to him that you do not pay on the genuine .gov website.
Google must accept some responsibility for placing these site first. Money talks.
Though not illegal, immoral.

John Young says:
10 December 2020

They are quite convincing emails if you are waiting for a parcel at this time of year. My partner got caught by the one saying they had tried twice to deliver and there was a fee of £1 to redeliver. She fell for it and credit carded the amount. She was suspicious as soon as she had done it and went to their site to check the tracking there No parcel so she contacted the bank and they closed the credit card before it could be used. They said it was a common scam. She is now much more savvy. She alsoknows to look for the padlock in the payment header. Can scammers fake this I wonder?

I had one last week supposedly from DPD. It seemed quite genuine and I was waiting for a parcel. Luckily my bank details didn’t go through, I was very lucky. DPD are aware of this, there is a recorded message on their helpline.

Madeline says:
12 December 2020

Last Saturday I received an email purporting to be from DPD delivery company. It was very professional looking and said they had tried to deliver a parcel twice and if I would log on and pay a small sum (I think about £1.50) They would redeliver. I didn’t check the senders address and as I was expecting a parcel from eBay and I didn’t know which carier was going to deliver it, I followed the link and stupidly gave my bank details. I then found that the parcel number they gave me was not recognised by the genuine site. Later I phoned DPD direct and was told it was a scam. So I then had to phone my bank and Get a new bankcard which was extremely inconvenient and stressful. I can’t believe I fell for it. Half the country must be waiting for parcels to be delivered at this time of the year. The bank told me they have thousands of these reports. Take care.

Carissa M. says:
5 February 2021

I received the following text message the last 2 days from phone # +1 (501) 764-6981
Dear First name Last Name, our delivery truck was at your house this morning: address city. You weren’t at home! We still have your package available! When do you like us to try again? Tell us here: link dhl-delivery.club/fhYe
I have had the same phone # for about 7 years now but because of these constant scam/ fraud messages that I keep receiving, I may have to change my phone #. I never click on the link and I always block the phone number it came from but then they send another message like the first from a different number. It’s so frustrating and scary at the same time.

I received an email last night stating I had to pay £1.99 delivery fee, when I tried to pay I received a santander alert asking me to authorise 1,995 euros.. It was a scam and luckily my bank blocked the payment… A lesson learnt

17 April 2021

Just received this email from DHL,
‘Your package 54246452-AV is waiting for delivery.
Important message!
Your parcel has arrived at our local post-office. let you know that the sender entered an incorrect address. Please use the link below to correct address and pay (1.65 $) the fees for new delvery attempt it will arrived to you on Monday
Confirm Address >>
Please feel free to contact me in case of any further assistance We thank you for choosing DHL Express
Kind regards,
DHL Tracking services.’

i have an e mail from the post office saying i have won a mobile phone but the postage is short and wants x amount postage as they cant deliver unless its paid before delivery

Patricia – It’s a scam. Ignore it. The Post Office [or more correctly Royal Mail] don’t communicate postage due by e-mail. Did the message state your address as verification? No, I thought not . . . And in any case, how would they know what was inside any packet and that it was a prize?

These scammers must think we’re all daft; the problem is they strike lucky sufficiently often to make the scam worthwhile.

Carol Lawrence says:
24 April 2021

I have received two phishing texts. One from royal mail asking for two pounds worth of postage to deliver a parcel and one today claiming to be from DHL. Beware the scammers.

Mr David Jones says:
26 April 2021

I have received 2 bogus messages supposed too be DHL Be warned.
+44 7375 039638 claiming Regan will deliver to you
+44 7585 507545 claiming to be from dryproflood bogus