Australia Post Delivery Scams: How to Stay Safe
9 in 10 Australians have received scam messages impersonating delivery services. Here's how to protect yourself.
New research from Australia Post shows that 9 in 10 Australians have received a scam text or call, and nearly three-quarters report being targeted by scams mimicking parcel delivery services. Most alarmingly, 27% of Australians have suffered financial loss from these scams. That's more than one in four people losing money to criminals impersonating a trusted service.
Australia Post will never ask you to provide personal information, credit card details, or other payment information via SMS. Starting March 12, 2025, Australia Post is removing links from tracking SMS notifications to help protect customers. If you receive an SMS with a link claiming to be from Australia Post after that date, it's definitely a scam.
How Australia Post SMS Scams Work
SMS messages lure recipients into clicking on links to resolve delivery issues or pay delivery fees. These links lead to fake Australia Post websites designed to steal personal and financial details. Australia Post has been made aware of multiple fraudulent SMS texts requesting customers to pay a fee to complete the delivery process. The sophistication of these fake websites has increased dramatically. They replicate the official Australia Post design, color scheme, and branding so well that many people can't tell the difference.
Common scam messages follow predictable patterns:
You might receive "Your parcel is awaiting delivery. Pay the $2.50 fee to complete delivery" followed by a link. The small amount makes it seem reasonable. Others claim "Australia Post: We missed you today. Reschedule your delivery here" with a malicious URL that leads to a credential harvesting site.
Some mention customs fees with messages like "Your package has been held at customs. Pay $3.99 to release." Address updates are another tactic: "Delivery attempt failed. Update your address to receive your parcel."
Final notice threats create urgency: "Final notice: Your Australia Post parcel will be returned to sender unless you act now." The urgency is deliberate. They want you clicking before you think critically.
Warning Signs of Delivery Scams
Unexpected delivery fee requests should trigger immediate suspicion.
Australia Post doesn't charge small delivery fees via SMS for domestic parcels. Any text asking you to pay $2, $3, or similar small amounts to receive a package is fraudulent. The fees are kept deliberately low because people are more likely to pay without questioning. Think about it: would you risk losing a $200 purchase over a $3 fee? That's what scammers count on.
Links in SMS messages represent the biggest red flag.
Here's what makes these scams particularly deceptive: criminals can set the "Sender Name" to make it appear as though messages are from Australia Post, and these messages can appear in the same thread as legitimate Australia Post messages on your device. This SMS spoofing makes the fraudulent messages look authentic because they're grouped with real communications. Your phone shows them coming from "AusPost" or "Australia Post" in a conversation thread where you've previously received legitimate tracking updates.
Urgent language creates false pressure designed to bypass your critical thinking. Phrases like "Final notice," "act now," or "within 24 hours" are manufactured deadlines meant to make you panic and click without verification. Legitimate delivery issues don't require immediate resolution within arbitrary timeframes. If Australia Post actually couldn't deliver your parcel, they leave a physical card in your mailbox. They don't threaten to return items within 24 hours via text message.
Suspicious URLs
URLs that don't go to auspost.com.au should never be clicked. Scammers use variations like auspost-au.com, australia-post.com, auspost.info, or other similar domains that look legitimate at first glance. They're counting on you not checking carefully before clicking.
Requests for excessive information
A simple delivery shouldn't require your credit card details, passport information, or driver's license. If you're not expecting a delivery and haven't ordered anything recently, be immediately suspicious of any delivery notification you receive. Scammers send these messages in bulk hoping to catch people who happen to be waiting for packages.
What Australia Post Is Doing to Fight Scams
To help protect customers from fraudulent messages and fake links, Australia Post announced significant changes in March 2025:
They're removing links from tracking SMS notifications and using instructions instead of links in many SMS messages. This eliminates the primary attack vector scammers have exploited. Without legitimate links in SMS messages, customers can be certain that any link they receive is fraudulent.
Updated tracking email notifications starting March 12, 2025 will be clearer, consistent, and more secure. Email remains a safer channel than SMS because email systems have better authentication and verification mechanisms.
Australia Post strongly recommends downloading the official AusPost app, which provides secure in-app notifications for legitimate delivery updates. The app ensures you're getting real information directly from Australia Post without the risk of SMS spoofing or fake sender names. In-app notifications can't be intercepted or spoofed by criminals.
How to Protect Yourself
Before clicking any link in a delivery message, verify it with SafeAus.
Our smart detection identifies delivery scams in under 5ms. Simply paste the message or URL into SafeAus for instant verification. This takes seconds and can prevent significant financial loss and identity theft.
Download the official AusPost app
Australia Post strongly recommends this as the primary method for receiving legitimate delivery updates. The app provides secure notifications that can't be spoofed by scammers. Search for "Australia Post" in the Apple App Store or Google Play Store, verify the publisher is Australia Post, and download only from official app stores. Never download apps from links in text messages or emails.
Never click links in SMS messages
If you receive a delivery notification, go directly to auspost.com.au/track by typing the URL into your browser or using a bookmarked link. Then enter your tracking number manually. This ensures you're on the legitimate website. The few seconds this takes could save you hundreds or thousands of dollars.
Verify tracking numbers by entering them directly on the official Australia Post website rather than clicking any links. If you have a tracking number from a legitimate order confirmation, you can independently verify its status without clicking potentially malicious links. Check your recent online purchases to confirm whether you're actually expecting a delivery. Review your email for order confirmations from retailers. If you haven't ordered anything, that delivery notification is almost certainly a scam.
Don't pay unexpected fees
Australia Post doesn't charge surprise delivery fees via SMS for domestic parcels. If there are genuine fees owing, they'll be clearly stated in your order confirmation or you'll receive official documentation through proper channels.
Be skeptical of urgency
Legitimate delivery issues aren't resolved in "24 hours or your parcel is returned." That's artificial pressure designed to make you act without thinking. Real delivery problems can be resolved at your convenience.
Educate family members
Teach family members about these scams, especially elderly relatives who may be more vulnerable to sophisticated spoofing techniques. Set up Family Protection to help protect loved ones by sharing scam alerts and verifying suspicious messages together.
What to Do If You've Clicked a Scam Link
If you've clicked a link in a fake delivery message or provided information, take immediate action to minimise damage.
Don't provide any information if you realise you're on a fake website. Close the browser tab or app immediately without entering any details. Every piece of information you provide makes the fraud worse. If you've only clicked the link but haven't entered anything, you're probably safe, though you should still run antivirus software as a precaution.
Contact your bank immediately
If you've entered credit card or banking details, call the number on the back of your card, not any number from the suspicious website. They may be able to block fraudulent transactions if you report quickly enough. Most banks have 24/7 fraud lines specifically for these situations. The faster you report, the better your chances of preventing charges or reversing completed transactions.
Change passwords immediately
If you've entered any login credentials on the fake site, update them on the legitimate service immediately and on any other accounts where you use the same password. Use unique passwords for each service. If scammers have one password that works on multiple accounts, they'll try it everywhere. This is why password reuse is so dangerous.
Monitor your accounts for unauthorised transactions or signs of identity theft. Check your bank statements daily for several weeks after the incident. Look for small test charges that scammers often make before attempting larger theft.
Report the scam to multiple channels to help authorities track and potentially shut down the operation:
Email scams@auspost.com.au to alert Australia Post directly. They track these scams and work with law enforcement to shut down fake websites and identify criminals.
Report to Scamwatch and ReportCyber so authorities can track patterns and warn other Australians.
Contact IDCARE at 1800 595 160 if personal identification information was compromised. They provide free, expert support for identity theft victims and create personalised recovery plans.
Legitimate Australia Post Communication
Official AusPost app (recommended)
The official AusPost app provides in-app notifications, which is now the recommended method for receiving delivery updates. These notifications appear within the app interface and can't be spoofed by external parties.
Email notifications
Email notifications go to the email address you provided when ordering. From March 12, 2025, these will be clearer and more secure with improved authentication to prevent spoofing.
Physical delivery cards
Physical delivery cards are left in your mailbox if Australia Post couldn't deliver your parcel. These are the traditional "Sorry we missed you" cards with instructions for collection or redelivery scheduling. These physical cards include tracking numbers you can independently verify on the official website.
SMS messages (no links from March 2025)
Starting in March 2025, SMS messages from Australia Post won't contain links. If you receive an SMS with tracking information, it will include instructions like "Track your parcel at auspost.com.au using tracking number ABC123" but no clickable URLs. This is Australia Post's response to the epidemic of SMS spoofing and link-based scams.
Australia Post will NEVER:
Ask for payment information via SMS under any circumstances. They won't request your password or credit card security code through any channel. Legitimate businesses never ask for passwords.
Threaten to return your parcel within 24 hours. Real delivery services work around your schedule, not artificial deadlines.
Charge unexpected "customs fees" for domestic deliveries. Customs charges only apply to international shipments, and they're handled through official channels with proper documentation, never through SMS links.
With three-quarters of Australians targeted by delivery scams and 27% suffering financial loss, these scams represent one of the most widespread threats in 2025.
The sophistication of fake websites and the ability for scammers to make their messages appear in legitimate SMS threads makes these frauds particularly dangerous. Your best protection is awareness, skepticism, and verification.
Download the official AusPost app, never click links in SMS messages, and always verify suspicious messages with SafeAus before engaging. For more information, visit Australia Post's official scam alerts page .