/ Money

Scam DHL email says you have a parcel to collect

We’ve seen fake emails claiming to be from courier company DHL. Don’t be taken in – you don’t have a parcel to collect or track if the email looks like this.

Another brand has joined the list of well-known companies being impersonated in phishing emails by scammers.

As is usually the case, the fraudsters behind these emails are trying to get hold of your name, address and payment details so they can attempt to steal your money.

The tactics are the same as the Santander and Apple ID emails we’ve discussed on Which? Conversation recently.

Targeting a delivery company adds an extra level of intrigue; everyone is, generally, curious and excited about receiving a package through the post.

But if you follow the link you’ll be told there’s a small fee to pay for collection and you’ll be asked to enter your personal data.

DHL phishing email example

Here’s exactly what one of these scam emails looks like:

While the clearly incorrect email address should be a significant red flag, the realistic-looking emails are professionally designed and use high quality branded logos to make it seem like they’re genuinely from DHL. 

And that’s certainly the case for another example we’ve seen. While it turns out the below example is circulating in Canada, it could still find its way into your inbox and be enough to trick some into handing over their details:

We’ve made DHL aware of these phishing emails. It hasn’t responded yet, but we’ll update this page when it does.

Treat unexpected deliveries with suspicion

If you get an email, text message or phone call about a parcel you weren’t expecting, treat it with suspicion.

It’s highly unlikely a courier company would have your email address or phone number if you haven’t made an order using its service.

If you’re still not sure, visit the courier company’s website and contact them to ask whether there’s a parcel waiting for you, using their official contact details. 

And if you think you’ve handed your details over to a suspicious email like this one, contact your bank as soon as you can. It’ll be able to make sure your account is safe.

Guide: how to get your money back after a scam

Have you received this dodgy DHL email? Or other scam emails from courier or delivery companies?

Let us know in the comments if you have, and help us warn others.

Comments

Get them all the time. Just delete them, dont get many now. They are obviouly fed up with me. K

And I was waiting for a parcel through dhl road services and the Lichfield freight services depot of dhl has stolen my goods claiming it has been stoped by french customs however the tracking no is showing it has been received in Lichfield and it has never been to France at all

You say, Contact DHL to check if the email is genuine. Have you tried to contact DHL? It’s all automated and virtually impossible to get to talk to anyone. If you do manage to get through on the phone be prepared for it to be an expensive call. 7p per minute and the time flies by in the process. This is probably the reason the scammers have chosen DHL

From DHL’s website:

“For urgent enquiries, please contact Customer Services on 0844 248 0844.
Calls to DHL UK phone numbers beginning ‘084’ cost 7 pence per minute, plus your phone company’s access charge.” https://www.dhl.co.uk/en/contact_centre/contact_express/contact_express_tracking.html

My understanding is that all calls to customer services numbers must be charged at standard 01/02/03 rates or be free. Is DHL avoiding this requirement because the customer is the company that has paid DHL rather than the person who wants to contact DHL about a delivery problem?

Thanks to BillHall for encouraging me to look at this.

Thank you both for looking at that – my understanding is that 0845 numbers etc are still allowed for new business, however this one appears to be a customer service line so I’ll pass it on now.

Reminded me of this one from 2016: https://conversation.which.co.uk/money/costly-0845-087-numbers-customer-service/

Thanks George. Some businesses still provide 087 numbers for new business. A friend who had booked online with Premier Inns was caught out by calling the 0871 number given for the hotel rather than Premier’s customer services number about room that had been booked online. Premier seem to be phasing out 087 numbers, though their website still gives details of the cost, for example:

“Hotel Contact Information

Phone: 0333 777 3904 Calls to 0871 numbers cost 13p a minute plus any additional charges from your phone operator. Calls to 0333 numbers are charged at the national rate.”

Dear Sir. Thank you for your warning.
Regards
M. A. Naz

Norman White says:
21 February 2020

Unelicited calls from unrecognised numbers, “known” companies. Any request for information even if caller has correct name and address are blocked. Put the phone down and either use an alternative phone, mobile or landline and call direct to real company. We had a demand for a subscription owing for Amazon Prime by phone. My wife put the phone down. We contacted Amazon who confirmed that we had cancelled our subs a month ago. Never, ever give any information over the phone or in an email and never pay or transfer money even if it appears a legitimate debt without checking the true company.

I think the best thing companies can do is have a strict no links policy for e-mails. It doesn’t take much effort to bring up a web browser and log into DHL, Apple, Amazon, Paypal, etc. to check something, the same as getting a letter in the post that requires attention. For example, if a package has payment due (e.g. import duty), the e-mail could say “Enter the following tracking # on the DHL website and follow the instructions provided”.

Even at present, you can probably get away without ever clicking a link in any e-mail that requires attention. For example, if I’m waiting on a package and coincidentally get an e-mail link this, I first check the from address. If the @ ending has nothing to do with the company like the first example, I just delete it. Next, I head directly to the courier’s website and try the tracking # there. If it doesn’t accept it, I try one more time with courier’s website of where the parcel originates, e.g. DHL Germany if the package shipped from Germany. If that doesn’t work, I delete the e-mail. If I’m really stuck waiting on a package, I get in touch directly with the seller.

I agree, but it would require legislation to stop companies from using links in emails.

I wonder if there are any well known companies that never use email links.

Martin Liddle says:
21 February 2020

I think your comment “It’s highly unlikely a courier company would have your email address or phone number if you haven’t made an order using its service.” is not valid. I increasingly get emails and texts from courier companies delivering on behalf of an online seller and usually I have no idea which delivery company they have chosen to use when I place the order.

Frances Johnson says:
22 February 2020

Yesterday, I received an email supposedly from The App Store showing an invoice for two fighting games costing £58 that had been taken from my account. It included the direction “if this was not your purchase contact us “
I panicked and tried to contact them immediately, but then realised it was a scam. It looked so convincing. Please warn others.

Thanks for letting us know Frances. Do feel free to send a screenshot to conversation.comments@which.co.uk

We also covered a similar Apple scam here: https://conversation.which.co.uk/money/apple-id-locked-account-scam-email/

Last week when renewing my mother’s driving licence on line at gov.co.uk website it was infiltrated by a scammer who tried to charge 79.56£ (written just like that). Interesting as it is free of charge! However, being on such an official website I can understand how people get caught.

Furthermore, after having just received a lovely thank you message from a very satisfied eBay recipient re the parcel I had sent him via Hermes, I received two emails from Hermes saying that the parcel couldn’t be delivered until I send £10.86 as it exceeded size limitations ( invoice on 2nd email).

There seems no limit to them at present.