TL;DR: A fake DHL text usually pushes a small "customs" or "redelivery" payment through a link. DHL says it only requests payment by email or SMS for customs duties and taxes, and only from its own domains. Check the domain, then track the parcel yourself.
A text arrives saying a DHL parcel is held, a delivery failed or customs duty is due, with a link to fix it. Because DHL really does move a huge volume of international parcels, the message is believable, and that is why it works. This guide uses DHL's own published fraud guidance so you can tell the genuine from the fake.
What DHL itself says about payments
DHL's fraud awareness page is unusually specific on one point: the only payments it requests through email or SMS are for customs duties and taxes, and its messages use an OTP security measure. That means a customs charge on its own is not proof of a scam. What matters is where the link goes and what it asks for.
DHL also lists the domains it uses for official communication: dhl.com, dpdhl.com, group.dhl.com, del.dhl.com and dhl-news.com. It says it does not use free email addresses such as Gmail or Yahoo for official communications. A link on any other domain, including a shortened link, is not from DHL.
How the scam usually plays out
- The text comes from a generic sender name or a personal-looking number, not from DHL.
- It carries a shortened URL (DHL's page names bit.ly-style links as a common trick) so you cannot see the destination.
- The page mimics DHL's look and asks for card details for a "small fee", or asks you to log in or enter personal information.
- A follow-up call or message then claims the payment failed and asks you to try again, sometimes with a different card.
Other DHL-branded scams
DHL's page describes more than one fraud type, and it helps to know the others because the same criminals run them:
- Fake social media accounts without a verification badge, offering giveaways or claiming to double investments.
- Recruitment fraud. DHL states it does not ask recruits to pay any money to apply, and does not ask for personal details such as a Social Security number upfront.
- Phishing emails that look official but are built to steal passwords and financial data.
How to check a DHL message in under a minute
1. Ignore the link. Open the DHL app or type dhl.com yourself.
2. Enter the tracking number from your actual order confirmation, not one from the text.
3. If a customs charge is genuine, it will appear against that shipment.
4. If you were not expecting anything, treat the message as fake.
How to report it
DHL asks you to forward suspicious email as an attachment to phishing@dhl.com. For an SMS, it asks for a screenshot that includes the sender's phone number, sent to the same address. For fake social media accounts or WhatsApp numbers, send the account URL or number to that address and report it to the platform as well.
If you already entered card details, call your card issuer straight away to block the card and dispute the charge. If you typed a password, change it and any account that shares it. For other carriers targeted with the same script, see the FedEx delivery text scam and the UPS delivery text scam guides.
Why the customs angle makes a fake DHL text convincing
Most delivery scams have to invent a reason to charge you. DHL's genuine process already includes customs duties and taxes on international parcels, and DHL says those are the one kind of payment it will ask for by email or SMS. Scammers borrow that real detail. If you recently ordered from overseas, a "customs fee" message fits what you expect, so the trick is to separate the timing from the source.
A quick worked example
Say you ordered headphones from another country last week and get a text: "DHL: your parcel is held, pay 1.99 to release." Do three things. First, look at the sender. DHL's page says fake texts often use a generic sender name or number. Second, hover or long-press the link: if it is not on a DHL domain from the list above, stop. Third, open the DHL site yourself and enter the tracking number from your order confirmation. A genuine customs charge will be visible against that shipment, and a fake one will not.
What happens to the details you type
A fake page usually captures whatever you enter: the card number, expiry and security code, plus your name and address. Those details can be used within minutes, and the address and phone number can feed later scams. That is why acting quickly with your card issuer matters more than trying to work out how convincing the page was.
Scammers who get a phone number or email from a fake parcel page often reuse it. It is worth checking what a criminal could already find about you with a free digital footprint check.
Frequently Asked Questions
Does DHL ever ask for payment by text?
DHL says the only payments it requests through email or SMS are for customs duties and taxes, and it uses an OTP security measure. Even then, do not trust the link in the message. Open dhl.com yourself and check the shipment there.
Which domains does DHL use for official messages?
DHL's fraud page lists dhl.com, dpdhl.com, group.dhl.com, del.dhl.com and dhl-news.com. It also says it does not use free email addresses like Gmail or Yahoo for official communications.
Where do I report a fake DHL text?
Send a screenshot of the text, including the sender's phone number, to phishing@dhl.com. For fake accounts, send the profile URL or phone number to the same address and report it to the platform.
Does DHL charge job applicants?
No. DHL states it does not ask potential recruits to pay any money to apply, and it does not ask for a Social Security number or personal details upfront in recruitment.
What if I already paid on a fake DHL page?
Contact your card issuer immediately to block the card and dispute the charge, change any password you entered, and report the message to DHL at phishing@dhl.com.