Understanding DHL Smishing Attacks
Smishing—SMS phishing—has become one of the most effective fraud channels because people trust text messages more than emails. Unlike emails that can be filtered by spam algorithms, text messages arrive directly to your phone, often appearing legitimate at first glance. DHL smishing scams have targeted millions of shoppers worldwide, with attackers impersonating the shipping company to steal payment information and personal data.
According to cybersecurity researchers, DHL smishing attacks have increased exponentially since 2020, coinciding with the rise in online shopping. The FBI and FTC report that delivery-related smishing attacks now account for a significant percentage of all phishing losses. DHL, being one of the world's largest shipping companies, is an ideal impersonation target because customers actively expect delivery notifications during their shopping periods.
How DHL Smishing Works
DHL smishing attacks follow a predictable but effective pattern. The scammer obtains a phone number, either through data breaches of retailers or by purchasing contact lists from data brokers. They then send text messages that appear to be from DHL, usually claiming there's an issue with a package delivery.
Typical message content includes: "DHL Notification: Your package could not be delivered. Click here to reschedule: [link]" or "DHL Alert: Customs fee required for package delivery. Pay now: [link]." These messages are intentionally vague because they don't need to reference a specific package—most people have multiple packages in transit at any given time during holiday seasons or after online shopping sprees.
The urgency is critical to the scam's success. People receive the message, panic about a delayed package, and click the link without thinking critically. The time between receiving the message and clicking is usually measured in seconds, not minutes or hours, which is why scammers use this channel.
Typical DHL Smishing Message Templates
Scammers rotate through several message templates to avoid detection by carriers and security systems:
- "DHL: Your package is in customs. Pay the handling fee here: [fake link]"
- "DHL: Unable to deliver your package. Reschedule your delivery: [fake link]"
- "DHL Delivery: Confirm your address and phone: [fake link]"
- "Important: Your DHL parcel needs clearance. Complete verification: [fake link]"
- "DHL Alert: Your package requires additional info to proceed: [fake link]"
- "Warning: Your DHL delivery has been held. Claim your package: [fake link]"
Notice that none of these messages mention a specific package, sender, or tracking number. They're intentionally generic because the scammers haven't done research on your actual packages—they're just sending bulk messages hoping a percentage of recipients have a package in transit (which is statistically very likely).
Fake Customs Fee and Redelivery Fee Payment Pages
When a victim clicks the link in the DHL smishing message, they're taken to a fake payment page designed to look identical to DHL's actual website or payment system. These pages are sophisticated clones that display:
- DHL branding, logos, and color schemes copied directly from the real website
- A "customs clearance fee" of $5-$50, which is fabricated (legitimate customs fees, when applicable, are paid before shipment reaches the recipient)
- Forms requesting credit card information, name, address, phone number, and email
- SSL certificates or security indicators copied from real sites, making them appear legitimate
- Tracking number fields that appear to accept input but don't validate anything
Some advanced phishing pages even display a fake tracking history showing the package's journey. This level of sophistication is designed to reduce cognitive dissonance—the victim's brain is being told everything is legitimate, so they proceed with entering payment information.
What Data Attackers Harvest
When a victim submits their information to a DHL smishing phishing page, attackers gain access to:
- Credit card numbers and security codes: Used for immediate fraudulent purchases or sold to other criminals
- Billing address and phone number: Used for identity verification when opening fraudulent accounts
- Email address: Added to phishing mailing lists and sold to other scammers. The fact that you clicked means you're "verified" as a victim.
- Confirmation that the phone number is active: Used to send more sophisticated phishing messages, account takeover attempts, and SIM swap attacks
- Associated personal information: Scammers combine this with data breach information to build complete identity profiles
A single phishing interaction can initiate a cascade of fraud attempts. The victim's information is packaged and sold on darknet markets where it's used by other criminals for weeks or months after the initial scam.
Lookalike Domains and URL Tricks
The links in DHL smishing messages often use domain names that look like DHL but are actually controlled by criminals. Common tricks include:
- Character substitution: "dhl-delivery-alert.com" or "dh1-delivery.com" (using number 1 instead of letter l)
- Subdomain tricks: "dhl.delivery-alert.com" appears to be under DHL's domain but is actually a subdomain of attacker-controlled "delivery-alert.com"
- Misspelled domains: "dhhl-tracking.com" or "d-h-l-tracking.com"
- Regional variations: "dhl.co.uk.delivery-confirmation.com" to target UK users
- URL shorteners: Links shortened with bit.ly or tinyurl.com hide the actual destination until clicked
On mobile devices, where domain names are often truncated in the browser, these lookalike domains are especially effective. The victim sees what appears to be "dhl.com" in the address bar because the full URL is hidden.
How Real DHL Notifications Look vs. Fake
Understanding the differences between legitimate and fraudulent DHL communications is critical:
Real DHL text messages: Use your actual tracking number, include a properly formatted link starting with "track.dhl.com" or "dhl.com," don't request payment information via text, and include a clear phone number (not a generic message). Real DHL alerts only mention delivery issues if you have a specific package at customs or with a known delivery problem. They never ask you to confirm payment information via text.
Fake DHL text messages: Use generic language without your tracking number, include suspicious links or URL shorteners, request payment or personal information, claim urgent action is needed, and use poor grammar or spelling variations of "DHL." Scammers often don't research whether you have a real package in transit—they're just fishing for responses.
DHL's Official Tracking Methods
Rather than clicking links from unsolicited texts, use these legitimate DHL tracking methods:
- Direct website: Visit dhl.com directly (type it in your browser, don't click links) and use their tracking tool. You'll need your tracking number, which should be in your order confirmation email from the retailer.
- DHL mobile app: Download the official DHL Express app from your device's app store and track packages there. This app isn't linked in texts—you install it from the official app store.
- Email from retailer: Your original order confirmation typically includes tracking information and links to legitimate tracking pages.
- Call DHL customer service: Use the phone number from dhl.com or your receipt—not a number provided in a suspicious text message.
- Check your spam folder: Legitimate DHL emails sometimes end up in spam. Look there rather than clicking links in new texts.
How to Report DHL Smishing to DHL
If you receive a DHL smishing message, report it to DHL directly:
- Forward to DHL's fraud team: DHL has a dedicated channel for phishing reports. You can often forward suspicious messages to a dedicated email or use their website to report the scam.
- Contact DHL customer service: Call the number on your receipt or visit dhl.com to report the fraudulent message. Provide the message content and the link/domain used.
- Report the domain: If the phishing page used a specific domain, you can report it to domain registrars or organizations like the Internet Crime Complaint Center.
- Block the sender: Add the phone number to your blocked list. Most carriers allow blocking numbers through your phone's settings.
Reporting to NCSC and FTC
Broader reporting helps law enforcement track patterns and take action:
- FTC (reportfraud.ftc.gov): Report all smishing and phishing attempts. The FTC aggregates reports to identify emerging threats.
- FBI IC3 (ic3.gov): Report if you've been scammed or fallen victim to phishing. This helps the FBI track criminal operations.
- NCSC (UK NCSC phishing reporting): In the UK, report to the National Cyber Security Centre. Other countries have similar agencies.
- Your mobile carrier: Report to AT&T, Verizon, T-Mobile, or your carrier to help them block similar numbers.
- Website abuse reporting: If the phishing domain is still active, report it to the domain registrar through their abuse contact.
Similar Delivery Scams: USPS and UPS
USPS and UPS smishing attacks work identically to DHL scams. Scammers impersonate all major delivery companies using the same message templates and fake payment pages. The countermeasures are identical:
- Never click links from unsolicited text messages about package delivery
- Access official tracking sites directly through your browser
- Verify the domain carefully before entering payment information
- Report suspicious messages to the carrier and relevant authorities
- Check your email receipt from the retailer for legitimate tracking information
If you're vulnerable to USPS or UPS smishing attacks, learn more about other delivery-related fraud schemes and how scammers exploit shipping-related trust.
Protecting Yourself from Delivery Scams
Beyond immediate technical measures, build habits that prevent smishing success:
- Never respond to unsolicited delivery messages: If you're expecting a package, track it proactively. Don't react to messages you receive.
- Save official contacts: Save DHL, UPS, and USPS phone numbers from their official websites to your phone. If you need to contact them, use these saved numbers.
- Use email for verification: If you doubt a message, email the retailer or carrier using contact info from your receipt or their official website. Don't reply to the suspicious message.
- Enable two-factor authentication: On your email and bank accounts, use 2FA. This prevents account takeover even if credentials are compromised through phishing.
- Use a credit card with fraud protection: Credit cards offer better fraud protection than debit cards. If charged fraudulently, report it immediately.
Related Scam Education
DHL smishing is just one variant of delivery fraud. Learn more about how phishing pages work and how to protect your accounts, and understand other payment-based fraud schemes that use similar manipulation tactics.
Other Scams to Watch For
People researching this scam also check these related pages.
UPS Scam Checker
Detect fake UPS delivery texts and phishing emails.
Check NowFedEx Scam Checker
Identify fraudulent FedEx delivery notifications and scams.
Check NowDHL Scam Checker
Spot fake DHL delivery alerts and smishing messages.
Check NowPurolator Scam Checker
Check suspicious Purolator delivery messages for fraud.
Check NowUSPS Text Scam
Spot fake USPS delivery text messages and postal scams.
Check NowCanada Post Text Scam
Identify fraudulent Canada Post delivery text messages.
Check NowUPS Text Scam
Recognize fake UPS delivery text messages and smishing.
Check NowFedEx Text Scam
Identify fraudulent FedEx text alerts and delivery scams.
Check NowWhat should I do if I already clicked a DHL phishing link?
If you clicked the link but didn't enter information, you're likely safe. If you entered payment information, act immediately: contact your bank and credit card company to monitor for fraud, consider canceling and reissuing your card, and enable fraud alerts on your credit file. If you used the same password elsewhere, change it immediately. Monitor your credit reports for unauthorized accounts.
Can I get my money back if I fell for a DHL phishing scam?
If you paid by credit card, contact your card company immediately to dispute the charge. Most credit cards offer fraud protection with limited liability. If you paid by debit card or wire transfer, recovery is much harder—contact your bank, but acknowledge that the money may be gone. Report to the FTC and FBI IC3. Recovery depends on how quickly you act and how the payment was made.
Is my phone number at higher risk after receiving a smishing text?
Yes, to some extent. The fact that your number received the message and potentially clicked the link tells attackers your number is active and belongs to someone who's online and responsive. You may receive more phishing messages. However, blocking the sender and being cautious with future messages minimizes risk. Consider registering your number with the FTC's Do Not Call registry at donotcall.gov to reduce telemarketing calls.
How do scammers get so many phone numbers to send DHL texts to?
Phone numbers are obtained through data breaches of retailers, shipping companies, or third-party data brokers who compile contact lists. Data brokers legally purchase and sell contact information compiled from public records, online behavior, and other sources. Scammers purchase these lists in bulk and send messages to millions of numbers at once, knowing a percentage will have packages in transit. This is why bulk phishing works—the volume makes up for the low success rate.
What if the text message is actually from DHL but looks suspicious?
If you're uncertain whether a message is legitimate, don't click the link. Instead, visit dhl.com directly, find their customer service number, and call them. Tell them the exact text you received and ask if it's legitimate. DHL's customer service is available via phone and chat and can verify whether a message came from their system. Legitimate DHL will never be offended by you verifying a message—they'd prefer it over you clicking a phishing link.