You get a text message: "Your package is waiting at the warehouse. Pay a 3.99 PLN customs fee. Check and pay: [link]." The sender shows up on your phone as "DPD", "InPost" or "Poczta Polska" (the national post office). It looks convincing. But this is one of the most common ways scammers try to steal your payment card details or your online banking login. This guide explains how to spot this kind of text before you click the link, and what to do if you already have.
How this scam works
Scammers send these text messages out in bulk, to random phone numbers. They do not need to know whether you are actually expecting a package — it is enough that some of the people who receive the message happen to have ordered something and believe the text is about their delivery. The message contains a link. Clicking it opens a page designed to look like a courier company's or post office's website. The page asks you to "pay a fee" — usually just a few units of your currency. To pay, you are asked to enter your card number, expiry date, and the CVV code from the back of your card, and sometimes to log in to your online banking through a fake form.
A real customs or storage fee, if one is ever needed, is never collected through a link in a text message. Courier companies and postal services handle fees differently — usually through the courier at delivery, or inside an app you open yourself — never through a link sent by text.
Warning signs to watch for
- Time pressure. The text warns that your package will be returned to the sender or destroyed if you do not pay within a few hours. Scammers want you to act fast, without thinking it through.
- A very small amount. An amount like 1–5 units of currency is low enough that it feels easier to just click "pay" than to stop and think. That is not an accident — a small amount is designed to lower your guard.
- You are not expecting any package. If you have not bought anything and no one should be sending you anything, the text is not about you, even if the courier company's name looks familiar.
- A suspicious link address. The address in a fake text often only resembles the real courier company's address — with extra letters, a hyphen in a different place, or a different domain ending. If you are not completely sure, do not click. Check the status of a real delivery by typing the company's address yourself, or through an app you installed yourself.
- The page asks you to log in to your online banking. This is the biggest warning sign of all. No courier company ever has a reason for you to log in on its website using your bank details.
What to do if you just received a text like this
Do not click the link. If you are not sure whether a delivery is real, do not use the link from the text at all. Open the courier company's app or website yourself, by typing the address from memory or searching for it online, and check the tracking number there. You can also simply delete the text. If you are unsure, ask a family member or friend before doing anything — you do not have to work this out on your own.
What to do if the scam has already happened
You clicked the link, but did not enter anything else
If you only opened the page but did not enter any information and did not pay anything, nothing has likely happened. Close your browser and do not go back to that page. It is still a good idea to keep an eye on your bank account for the next few days.
You entered your payment card details
Call your bank immediately. You will find your bank's phone number on the back of your card or on the bank's official website — never use a number from the text message or from the page you clicked on. Ask the bank to block your card. The bank can usually do this right away and issue you a new one. Also check your recent transactions and report any payment you do not recognize.
You logged in to your online banking through the fake link
This is the situation that needs the fastest action. Call your bank right away, using the number from your card or the bank's official website. Ask the bank to block access to your online banking and reset your login details. If the bank can do it, also ask it to block new standing orders and payments from being set up until the situation is sorted out.
Money has already been taken from your account
Report it to your bank as soon as possible — ideally the same day. The bank may be able to stop or reverse the transaction, but the chances of that are much higher within hours rather than days. Also report it to the police — you can do this at a local station or online. Keep the text message and a screenshot of the fake page — they can help as evidence.
What you should never do
Never tell anyone a one-time code sent by your bank to confirm a transaction — not over the phone, and not on any form. That code exists only to confirm your own action inside your bank's app. If anyone claiming to be from the bank, the police, or a courier company asks you to read such a code out loud, it is always a scam — hang up.