The 'pay a small fee' parcel smishing, explained

“Your parcel is waiting for delivery. A surcharge of 0.70 is required.” Almost everyone in Poland knows this SMS by now. It’s one of the most mass-produced smishing scenarios out there — and although it looks trivial, every detail of its design is deliberate.

Why the amount is so small

A fee of well under a euro is no accident. The point is to switch off your caution. Nobody scrutinises a 70-cent charge the way they would a 500 PLN one. The victim thinks “not worth the hassle, I’ll just pay it”, clicks, and enters their card details on a fake payment gateway. And the real goal was never that tiny amount — it’s capturing the card details or, in newer variants, adding the card to the criminal’s digital wallet.

The small amount serves another purpose too: it lowers the chance that the bank will flag the transaction as suspicious.

The elements that keep repeating

Courier campaigns vary by brand (InPost, DHL, the national post, “courier”), but the mechanics are shared:

• A logistics pretext — something many people are genuinely expecting (a parcel on its way).
• Pressure — “the parcel will be returned to sender”, “final delivery attempt”.
• A link to a domain impersonating the carrier, often with a small typo or an extra element (inpost-surcharge.info instead of the official domain).
• A fake payment gateway mimicking a real processor.

How to tell a genuine notification apart

Courier companies communicate surcharges and customs fees in their app or by email from your account, not through a random SMS with a link to pay by card. You can always check a tracking number yourself — by going to the carrier’s official site typed in manually, not from the link.

A practical test: before you click, read the full domain in the address. Everything before the first single / after https:// must end with the company’s real name. inpost.pl.track-id.co is the domain track-id.co, not InPost.

More precisely, the registrable domain matters, not an arbitrary string in the address. In inpost.pl.track-id.co, the owner controls track-id.co; the InPost name is merely a subdomain. Shorteners, misspellings and visually similar characters make manual judgement harder. The safer approach is not to analyse the SMS link at all: open the carrier’s app yourself and enter the tracking number.

Defence in practice

The rule is simple and effective: don’t pay from a link in an SMS. If you’re expecting a parcel, open the carrier’s app. Turn on push notifications and limits in your bank, use virtual cards for online payments (they’re easy to cancel), and forward suspicious messages to CERT Polska — that gets the domains onto the warning list faster.

Parcel smishing is a textbook example that social engineering beats technology. There’s no flaw in your phone here — just a well-chosen pretext and our own hurry.

What can happen after the click

The page may first request a tiny fee and then capture card number, CVV, personal data and an authorisation code. Another variant impersonates online banking or prompts the installation of an app outside the official store. The amount shown on the web page need not match the operation presented by the bank, so always read the in-app approval message: amount, recipient and operation type.

Waiting for a parcel does not authenticate the text. Campaigns are sent at scale, and some recipients will coincidentally expect a delivery. In its 2025 report, CERT Polska observed that parcel stories declined while texts designed to start a conversation became more prominent. Parcel smishing remains a useful pattern to understand, but should not be described as permanently dominant.

Responding after data disclosure

If you entered card data or approved an operation, contact the bank immediately through an official number, block the card and report the transaction. If you disclosed a password, reset it from a trusted device, terminate active sessions and secure email. Treat an app installed from the link as potentially malicious: disconnect the phone, use another device to contact the bank and have the handset examined or restored under your organisation’s procedure.

In Poland, forward a suspicious text to 8080. CERT Polska uses submissions to create patterns that operators subsequently block, so reporting speed matters. Preserve the page address and submit it through incydent.cert.pl as well.

Controls for organisations

On managed phones, combine DNS and web filtering with MDM, application-install controls and one simple rule: parcel issues are checked in the official app, never through an SMS link. The helpdesk should be able to restrict an account, invalidate sessions and receive a report without blaming the user. Simulations should measure reporting time, not only clicks.

Similar campaigns regularly reach work phones too. If you want to check how your team responds to smishing, see our social engineering tests and training or drop us a line.

Sources: CERT Polska — fake SMS messages, CERT Polska — 2025 annual report, CERT Polska — warning list.