Quick Take: DHL scam texts come in two active 2026 patterns. The tracking-notification variant says your package needs an address confirmation or redelivery; the import-duty variant says customs is holding your parcel until you pay a small 2 to 15 dollar or euro fee. Real DHL never asks for customs payment via SMS link. Both variants land you on a card-capture page styled to look like dhl.com. Verify any tracking by typing dhl.com manually and searching the number there. SafeBrowz blocks the landing pages with no per-user browsing history stored.

What the scam looks like

The SMS arrives with a tracking-looking number, a brief "delivery issue" message, and a shortened or unusual URL. The URL leads to a fake DHL page that asks you to enter your address (already-known data, used to build trust) and then to pay a small customs/clearance fee with a credit card. The card capture is the actual goal. The "$2.99 customs fee" is just the cover story. Within hours of paying, the card is used for higher-value fraudulent purchases (gift cards, online retailer test charges, sometimes ride-hailing or food delivery to test if the card is alive before the bigger drain).

Real DHL does send shipment status texts if you opted in. Those texts always link to dhl.com or a country variant (dhl.de, dhl.co.uk, etc.), never to a shortened or unfamiliar domain, and DHL never asks for customs duties via SMS.

The 7 message variants in active rotation

1. Held at customs

"DHL: Your package #1Z9N84... is held at customs due to unpaid duty of $2.99. Pay to release: [shortened URL]"

2. Address verification

"DHL: We could not deliver your package. Please confirm your delivery address: [URL]. Last chance before return to sender."

3. Insufficient postage

"DHL: Your shipment requires additional postage ($1.99). Pay now to avoid return: [URL]"

4. The reschedule

"DHL attempted delivery today. Please reschedule: [URL]. A $4.99 redelivery fee applies."

5. The locker code

"DHL: Your package is at Locker #4127. Pickup code expires 48h. Confirm address to receive code: [URL]"

6. The export hold (B2B variant)

"DHL Business: Your export shipment is held pending document verification. Complete here: [URL]." Targets people who have actually shipped internationally for work.

7. The double-charged refund

"DHL: We owe you a $19.45 refund for a duplicate charge. Click to receive: [URL]" Inverts the usual "you owe us" angle.

How to spot the fake in 10 seconds

  • Were you expecting an international package? If no, ignore the text completely. If yes, do not click the link in the text.
  • Sender phone number. Real DHL SMS comes from short codes (5-6 digit numbers) or registered numeric senders. A 10-digit US/UK mobile or a + prefixed international number sending "DHL" texts is a scam.
  • URL. Real DHL URLs use dhl.com or country domains (dhl.de, dhl.co.uk, dhl.com.kw, etc.) as the actual base domain. A shortened URL (bit.ly/..., tinyurl/...) or odd domain (dhl-customs.xyz, dhltrack.support, dhl-redelivery.net) is a scam.
  • Asks for payment via SMS link. Real DHL handles customs duties at the country level through the importer's customs broker, often paid at delivery in cash or via a verified country-specific page. They do not collect duties from random SMS links.
  • Small fee. The "$2.99 customs duty" is suspiciously low - real customs duties on packages above duty-free threshold (varies by country, $200-$800 in most places) are calculated on the declared value, not a flat tiny number. A "$2.99 fee" exists to make payment feel inconsequential so you do not pause.

The right way to verify

  1. Do not click the SMS link.
  2. Find your real tracking number from your order confirmation email from the retailer (Amazon, AliExpress, ASOS, Etsy, etc.).
  3. Type dhl.com manually in your browser and paste the tracking number into the search box. Or use the retailer's own tracking page.
  4. If DHL's real page shows the package is genuinely held for customs, the page will tell you how customs in your country handles duty collection. Usually it is via the official customs portal of your country (CBP in the US, HMRC in the UK, local customs in EU/GCC/India), not DHL itself.
  5. Delete the SMS and report. In the US, forward suspicious SMS to 7726 (SPAM). DHL has phishing@dhl.com for global reports.

If you already entered card details

  1. Call your bank or open the bank app. Lock the card. Most modern bank apps have a one-tap freeze.
  2. Order a replacement card with a new number. Update legitimate subscriptions once it arrives.
  3. Check the card statement for small test charges ($0.99, $1.05, $4.99) over the next 24 hours. These are the attacker testing if the card is alive.
  4. Dispute any unauthorized charge with your bank under "fraud" or "unauthorized transaction." Most cards refund within 7 days.
  5. Report to your country's anti-fraud agency: in the US reportfraud.ftc.gov, in the UK Action Fraud, in the GCC the national CERT or e-crime portal.
  6. If you also entered an account password (some variants ask for "Amazon login to verify shipping"), change that password everywhere it was reused. Enable 2FA.

Why DHL is the global target

DHL has the largest international parcel volume of any single carrier. In countries where Amazon, AliExpress, Temu, Shein, ASOS, eBay, and other cross-border shopping is common, "I am waiting on a DHL delivery" is true for a meaningful share of mobile users at any given moment. Scammers blast millions of texts to numbers from public breach lists and just wait for the 0.1% to 1% who happen to be expecting a DHL package right now.

The scam works particularly well in markets where:

  • Customs duties on imports are actually real (Gulf, India, Brazil)
  • Local-language DHL communication is mixed with English so users do not recognize legitimate template phrasing
  • SMS is still the primary delivery-notification channel (older demographics, rural areas)

The same scam runs with FedEx, UPS, USPS, Royal Mail, Australia Post, India Post, Aramex, Emirates Post, and basically every other major carrier. The template is interchangeable. Only the logo changes.

DHL import duty scam text examples (2026 variants)

The DHL "import duty" scam text is a distinct variant from the tracking notification scam. It claims your incoming package is held at customs and asks you to pay a small fee (usually 2 to 15 euros or dollars) via card or crypto to "release" it. Real DHL handles customs charges only at delivery in person or through your dhl.com account, never via SMS link. The card payment form on the landing page captures your full card number plus CVV plus billing address. The same template is reused by fake FedEx, USPS, and Royal Mail customs scams in active rotation, and shares DNA with the unpaid toll text scam on the small-fake-fee mechanic.

Five active import-duty SMS templates as of May 2026:

  1. "DHL: Your package is held at customs. Pay 2.40 euro duty to release. Click here: [shortened URL]"
  2. "DHL Notification: Customs fee unpaid. Your parcel will be returned in 24h unless you pay 1.99 GBP: [link]"
  3. "DHL: Import VAT required for parcel #XXXXX. Pay 3.50 USD to confirm delivery: [link]"
  4. "URGENT - DHL: Your shipment from overseas has incurred a customs duty of 4.95 euro. Pay now: [link]"
  5. "DHL Express: A small import tax of 2 USD is due. Click to pay and confirm delivery address: [link]"

Why it works. The amount is calibrated low (2 to 15 of whatever currency) to feel "not worth disputing" while the urgency framing creates pressure to act before thinking. Once the card is entered, the scammer either makes immediate fraudulent purchases or sells the card data on dark-web markets. The SafeBrowz extension blocks the landing pages these texts link to using its 550+ brand database and 60+ URL patterns at the moment of click. See also our overview of anti-scam browser extensions for 2026 and our QR-code scam (quishing) guide for the printed-poster variant of the same import-duty bait.

How browser-layer defense catches this earlier

Mobile carriers block some smishing URLs at the SMS level, but the catch rate is well below 30% because the URLs rotate constantly. The defense that works is at the click destination. When you tap the SMS link and land on a fake DHL page, a browser-layer scanner can recognize the page is impersonating DHL and block it before you type your card number.

SafeBrowz is a free Chrome, Firefox, and Edge extension (with Edge for Android also supported) that scans every URL before the page renders. Its 550+ brand database includes DHL, FedEx, UPS, USPS, and major regional carriers. Install SafeBrowz free on the device you receive packages texts on.

Frequently asked questions

Does DHL ever charge customs fees via a text link?

No. DHL collects duties through your country's customs system, usually at delivery or via the official national customs portal. DHL does not send pay-now links via SMS for customs. They may send a status update saying "your package needs customs clearance," but the payment step is handled by you contacting the carrier or paying at delivery, not by tapping a text-message link.

The tracking number in the text looks real. Doesn't that prove the text is from DHL?

No. The tracking-number format is public, and scammers generate fake numbers that look right. Some scammers also use real tracking numbers harvested from data leaks. A real-looking tracking number is not proof of legitimacy. Verify by typing dhl.com manually and entering the number there.

I'm in [Kuwait/UAE/India/UK]. Does DHL communicate in my local language for real?

Yes. Real DHL messaging is localized in the country's primary languages. The scams often use awkward English or a mix of English and broken local language. Real DHL communication, even in English-language markets, has consistent corporate phrasing that scammers often miss.

I paid the $2.99 with my card but never got a package. Was that a real DHL fee?

No. There is no $2.99 real DHL fee. If you paid, the $2.99 is now lost (small amount, usually below the bank's chargeback threshold). The real damage is that the scammer now has your card details and will use them for higher-value fraud. Call your bank to lock the card immediately.

What if I have a real DHL delivery coming and I'm worried I might miss the legitimate notification?

Use the retailer's order tracking, not the SMS. Retailers (Amazon, AliExpress, ASOS, Shein, etc.) link directly to the real carrier's tracking page in your account. That link is verified. Or open the DHL app and add the tracking number manually.

How do I forward a DHL phishing text so it gets blocked?

In the US, forward to 7726 (SPAM). In the UK, forward to 7726 (free on most carriers). DHL also accepts global reports at phishing@dhl.com - forward the SMS as a screenshot with the sender number visible.

Does DHL really charge import duty by text?

No. DHL does not collect customs duties or import VAT through SMS pay-now links. Customs charges are handled either at the door at delivery (cash, card, or app) or through your country's official customs portal linked from your dhl.com tracking page. Any text claiming a 2 to 15 dollar or euro "import duty" with a clickable link is a phishing scam. The amount is intentionally low to feel inconsequential while the card-capture form behind the link is the real harvest.

How can I tell if a DHL customs text is real?

Three quick checks. First, real DHL communications always route you to dhl.com or a country-specific DHL domain (dhl.de, dhl.co.uk, dhl.com.kw), never to a shortened or unfamiliar URL. Second, real DHL never asks for payment of customs fees via SMS link; the payment step happens at delivery or through your country's customs portal. Third, real DHL knows your specific waybill number and uses consistent corporate phrasing; scams tend to use urgent, broken-template language with generic placeholders. When in doubt, type dhl.com manually in your browser and search the tracking number there.

What should I do if I paid a fake DHL customs fee?

Act in the next 30 minutes. Lock the card immediately through your bank app's freeze feature. Order a replacement card with a new number. Check the statement for small test charges (under 5 dollars) over the next 24 hours; those are the scammer testing if the card is alive before larger fraud. Dispute the original fake "customs" charge with your bank under fraud or unauthorized transaction; most banks refund within 7 days. Report to your country's anti-fraud agency (FTC in the US, Action Fraud in the UK, the national CERT in the GCC). If you also entered an account password on the fake site, change it everywhere it was reused and turn on 2FA.

Related reading

Bottom line: The DHL customs duty scam is the international cousin of the USPS and FedEx scams: same playbook, different logo. The defense is identical. Never tap SMS links. Verify by typing dhl.com manually. Real customs duties are paid through your country's customs system, not random text-message links. Add a browser-layer scanner like SafeBrowz for the moments when you forget.