Protect yourself against scams, phishing & smishing attacks

We urge customers to stay alert this holiday season. Online criminals are using the rise in package deliveries at this time of the year to target people with clever 'parcel delivery scams.'

These types of scams, called ‘smishing’ for text messages and ‘phishing’ for emails, involve fake messages. They appear to come from real sources, like DHL, or other delivery companies. The goal is to get personal details or financial information from the recipients. Scammers could then use the sensitive information gained in these smishing and phishing scams for identity theft.

If you think you’ve received a fake SMS pretending to be from DHL, do not reply. Instead, report it by following the instructions below. As soon as someone reports it, DHL will take action to help stop potential fraud from happening. 

The security of our customers and online platforms is our top priority. We are continuously enhancing our systems and processes to combat these threats. Phishing and smishing activities are becoming more common and sophisticated. This is especially true during the busy holiday season when shipping volumes rise. 

How to identify a fraudulent text message:

• Unusual sender numbers: DHL typically uses short codes (four or five digits) for text messages. Messages from full mobile numbers, especially with international codes, are suspicious.
• Shortened URLs: Scams often include shortened URLs (e.g. starting with https://bit.ly/) to hide the final destination.
• Generic sender names: Instead of a visible number, the sender might be a generic name like “Delivery.”
• Unexpected country codes: The phone number may start with a country prefix outside of expected territories (e.g. +235)..

Below is an example of a legitimate DHL NZ Customs text message notifying a customer that their shipment is being held.

What to do if you receive a suspicious text message:

• Do not reply to the message
• Verify the message by calling our customer service team on 0800 800 020
• If you suspect a message is fraudulent, send a screenshot of the SMS, including the suspicious phone number, to phishing-dpdhl@dhl.com. After reporting, please delete the fraudulent SMS. 

Customs duties and taxes:  

The only payments DHL will ever request via email or SMS are for customs duties and taxes. This process includes a safety step. An OTP is sent to the consignee’s registered contact before we process the payment.

This security notice does not change the consignee's duty to pay shipping, customs, GST, or similar charges. These charges must be paid when the delivery is made. 

Tips to protect yourself from DHL phishing scams:

1. Only download the official My DHL App:  

Fraudulent text messages may ask you to download a tracking app that steals sensitive data. Keep yourself safe by downloading the official My DHL app. Get it only from the App Store (iOS) or Google Play Store (Android). Always install the latest updates.

2. How to identify a fraudulent email:

• Inauthentic email address: DHL emails will always come from addresses ending in @dhl.com, @dpdhl.com, @dhl-news.com or another country domain after @dhl. If you receive an email that ends differently, it may not be authentic.  
• Hover over links: Hover over links (do not click) to check if the sender's address changes. If it does, it is likely not authentic.  
• Check your package number: Genuine payment requests from DHL will include your package number. Verify the number on our track and trace page without clicking on any links.

3. What to do if you receive a suspicious email:

• Do not open attachments or download files from suspicious emails.
• Do not click on hyperlinks in suspicious messages.
• Never reply to suspicious messages.
• Never enter access data for DHL eCommerce services unless you are sure you are on a legitimate website.

Stay vigilant and protect your personal information. If in doubt, contact our customer service team on 0800 800 020 for assistance.