How It Works
Scammers impersonate well-known courier companies such as NZ Post or DHL, sending text messages or emails claiming that your parcel could not be delivered. They ask you to click a link to reschedule delivery or choose a pick-up time.
Once you click the link, you are taken to a convincing-looking fake website and asked to enter your bank card or credit card details. Common pretexts include paying a "customs fee", a "small handling charge", or claiming you have won a prize or survey reward. As soon as you submit your details, the scammer can access and drain your account.
Some fake links also trick you into downloading what appears to be a "parcel tracking app" — in reality, this is malicious software that monitors your phone, intercepts verification codes, and steals account credentials.
Important note about NZ Customs: New Zealand Customs does not contact individuals or businesses by text message or email to demand payment of customs duties. Any message claiming to be from Customs and asking for immediate payment should be treated as a scam.
How to Protect Yourself
- Do not reply to or click on links in unexpected delivery messages, even if they appear to come from a known courier.
- If you are unsure, go directly to the courier's official website by typing the address yourself, or call their publicly listed customer service number to verify.
- Forward scam text messages to DIA's reporting short code 7726 (free), then block the sender.
- If you have already entered your bank card or credit card details on a fake site, contact your bank immediately, explain that you have been targeted by a scam, and ask them to freeze your account or cancel your card.
- If you have downloaded a suspicious app, restore your phone to factory settings as soon as possible. Do not back up your phone first, as the malware may be included in the backup. After restoring, change the passwords for all important accounts (email, online banking, social media).
IDCARE — Free Identity Theft Support
If you believe your personal information — such as your passport, driver licence, bank details, home address, email address or phone number — may have been obtained by a scammer, contact IDCARE as soon as possible.
IDCARE is a free service for New Zealand residents that provides specialist support for identity theft and cybercrime. Their team will assess the specific information that was exposed and help you develop a personalised recovery plan to minimise the risk of further misuse.
Visit https://www.idcare.org/ to submit a help request. If you have also suffered a financial loss, contact your bank first.
- Contact your bank immediately, explain the situation, and ask them to freeze or protect your account.
- Keep all evidence — text messages, emails, transfer receipts, screenshots, phone numbers, and payment details.
- If you wish to report it to police, visit a police station or call the non-emergency number 105.
- If you believe your identity information has been compromised, contact IDCARE for specialist support: https://www.idcare.org/
Waiting for a parcel does not prove that a text is genuine. Close the message and type the courier's website yourself. Stop if a page asks for a code, payment details, or an app download.