What the scam looks like

The SMS arrives with a tracking-looking number, a brief "delivery issue" message, and a shortened or unusual URL. The URL leads to a fake DHL page that asks you to enter your address (already-known data, used to build trust) and then to pay a small customs/clearance fee with a credit card. The card capture is the actual goal. The "$2.99 customs fee" is just the cover story. Within hours of paying, the card is used for higher-value fraudulent purchases (gift cards, online retailer test charges, sometimes ride-hailing or food delivery to test if the card is alive before the bigger drain).

Real DHL does send shipment status texts if you opted in. Those texts always link to dhl.com or a country variant (dhl.de, dhl.co.uk, etc.), never to a shortened or unfamiliar domain, and DHL never asks for customs duties via SMS.

The 7 message variants in active rotation

1. Held at customs

"DHL: Your package #1Z9N84... is held at customs due to unpaid duty of $2.99. Pay to release: [shortened URL]"

2. Address verification

"DHL: We could not deliver your package. Please confirm your delivery address: [URL]. Last chance before return to sender."

3. Insufficient postage

"DHL: Your shipment requires additional postage ($1.99). Pay now to avoid return: [URL]"

4. The reschedule

"DHL attempted delivery today. Please reschedule: [URL]. A $4.99 redelivery fee applies."

5. The locker code

"DHL: Your package is at Locker #4127. Pickup code expires 48h. Confirm address to receive code: [URL]"

6. The export hold (B2B variant)

"DHL Business: Your export shipment is held pending document verification. Complete here: [URL]." Targets people who have actually shipped internationally for work.

7. The double-charged refund

"DHL: We owe you a $19.45 refund for a duplicate charge. Click to receive: [URL]" Inverts the usual "you owe us" angle.

How to spot the fake in 10 seconds

  • Were you expecting an international package? If no, ignore the text completely. If yes, do not click the link in the text.
  • Sender phone number. Real DHL SMS comes from short codes (5-6 digit numbers) or registered numeric senders. A 10-digit US/UK mobile or a + prefixed international number sending "DHL" texts is a scam.
  • URL. Real DHL URLs use dhl.com or country domains (dhl.de, dhl.co.uk, dhl.com.kw, etc.) as the actual base domain. A shortened URL (bit.ly/..., tinyurl/...) or odd domain (dhl-customs.xyz, dhltrack.support, dhl-redelivery.net) is a scam.
  • Asks for payment via SMS link. Real DHL handles customs duties at the country level through the importer's customs broker, often paid at delivery in cash or via a verified country-specific page. They do not collect duties from random SMS links.
  • Small fee. The "$2.99 customs duty" is suspiciously low — real customs duties on packages above duty-free threshold (varies by country, $200-$800 in most places) are calculated on the declared value, not a flat tiny number. A "$2.99 fee" exists to make payment feel inconsequential so you do not pause.

The right way to verify

  1. Do not click the SMS link.
  2. Find your real tracking number from your order confirmation email from the retailer (Amazon, AliExpress, ASOS, Etsy, etc.).
  3. Type dhl.com manually in your browser and paste the tracking number into the search box. Or use the retailer's own tracking page.
  4. If DHL's real page shows the package is genuinely held for customs, the page will tell you how customs in your country handles duty collection. Usually it is via the official customs portal of your country (CBP in the US, HMRC in the UK, local customs in EU/GCC/India), not DHL itself.
  5. Delete the SMS and report. In the US, forward suspicious SMS to 7726 (SPAM). DHL has phishing@dhl.com for global reports.

If you already entered card details

  1. Call your bank or open the bank app. Lock the card. Most modern bank apps have a one-tap freeze.
  2. Order a replacement card with a new number. Update legitimate subscriptions once it arrives.
  3. Check the card statement for small test charges ($0.99, $1.05, $4.99) over the next 24 hours. These are the attacker testing if the card is alive.
  4. Dispute any unauthorized charge with your bank under "fraud" or "unauthorized transaction." Most cards refund within 7 days.
  5. Report to your country's anti-fraud agency: in the US reportfraud.ftc.gov, in the UK Action Fraud, in the GCC the national CERT or e-crime portal.
  6. If you also entered an account password (some variants ask for "Amazon login to verify shipping"), change that password everywhere it was reused. Enable 2FA.

Why DHL is the global target

DHL has the largest international parcel volume of any single carrier. In countries where Amazon, AliExpress, Temu, Shein, ASOS, eBay, and other cross-border shopping is common, "I am waiting on a DHL delivery" is true for a meaningful share of mobile users at any given moment. Scammers blast millions of texts to numbers from public breach lists and just wait for the 0.1% to 1% who happen to be expecting a DHL package right now.

The scam works particularly well in markets where:

  • Customs duties on imports are actually real (Gulf, India, Brazil)
  • Local-language DHL communication is mixed with English so users do not recognize legitimate template phrasing
  • SMS is still the primary delivery-notification channel (older demographics, rural areas)

The same scam runs with FedEx, UPS, USPS, Royal Mail, Australia Post, India Post, Aramex, Emirates Post, and basically every other major carrier. The template is interchangeable. Only the logo changes.

How browser-layer defense catches this earlier

Mobile carriers block some smishing URLs at the SMS level, but the catch rate is well below 30% because the URLs rotate constantly. The defense that works is at the click destination. When you tap the SMS link and land on a fake DHL page, a browser-layer scanner can recognize the page is impersonating DHL and block it before you type your card number.

SafeBrowz is a free Chrome, Firefox, and Edge extension (with Edge for Android also supported) that scans every URL before the page renders. Its 550+ brand database includes DHL, FedEx, UPS, USPS, and major regional carriers. Install SafeBrowz free on the device you receive packages texts on.

Frequently asked questions

Does DHL ever charge customs fees via a text link?

No. DHL collects duties through your country's customs system, usually at delivery or via the official national customs portal. DHL does not send pay-now links via SMS for customs. They may send a status update saying "your package needs customs clearance," but the payment step is handled by you contacting the carrier or paying at delivery, not by tapping a text-message link.

The tracking number in the text looks real. Doesn't that prove the text is from DHL?

No. The tracking-number format is public, and scammers generate fake numbers that look right. Some scammers also use real tracking numbers harvested from data leaks. A real-looking tracking number is not proof of legitimacy. Verify by typing dhl.com manually and entering the number there.

I'm in [Kuwait/UAE/India/UK]. Does DHL communicate in my local language for real?

Yes. Real DHL messaging is localized in the country's primary languages. The scams often use awkward English or a mix of English and broken local language. Real DHL communication, even in English-language markets, has consistent corporate phrasing that scammers often miss.

I paid the $2.99 with my card but never got a package. Was that a real DHL fee?

No. There is no $2.99 real DHL fee. If you paid, the $2.99 is now lost (small amount, usually below the bank's chargeback threshold). The real damage is that the scammer now has your card details and will use them for higher-value fraud. Call your bank to lock the card immediately.

What if I have a real DHL delivery coming and I'm worried I might miss the legitimate notification?

Use the retailer's order tracking, not the SMS. Retailers (Amazon, AliExpress, ASOS, Shein, etc.) link directly to the real carrier's tracking page in your account. That link is verified. Or open the DHL app and add the tracking number manually.

How do I forward a DHL phishing text so it gets blocked?

In the US, forward to 7726 (SPAM). In the UK, forward to 7726 (free on most carriers). DHL also accepts global reports at phishing@dhl.com — forward the SMS as a screenshot with the sender number visible.

Related reading

Bottom line: The DHL customs duty scam is the international cousin of the USPS and FedEx scams: same playbook, different logo. The defense is identical. Never tap SMS links. Verify by typing dhl.com manually. Real customs duties are paid through your country's customs system, not random text-message links. Add a browser-layer scanner like SafeBrowz for the moments when you forget.