Australia Post SMS scam: how to check a parcel text
VerdictAn Australia Post text asking for payment, card details or personal information is a scam pattern. Do not reply or use its link.
Why this message works
Australia Post warns about fake messages requesting a redelivery fee, a postcode check or an address correction. Some messages claim a driver could not find a safe place to leave a parcel and ask you to reply to arrange collection. Criminals can spoof sender names, and a fake message can appear in the same thread as genuine updates. Neither a familiar sender name nor an existing parcel proves a message is safe.
Warning signs
- A request to pay a small redelivery fee or submit card details via a message.
- A demand to update your address or verify a postcode under time pressure.
- An instruction to reply with 'Y' or another response before opening a link.
How to check safely
Open the AusPost app or type auspost.com.au yourself. Check the tracking number from the original order. Australia Post recommends app notifications as a safer way to receive delivery updates.
What to do now
- Do not reply, tap unexpected links or provide payment or personal information.
- Check the delivery directly in the AusPost app or on the official website.
- Save evidence, report the message through official channels, then use your phone's spam-reporting option and delete it.
Report it
Australia Post asks you to report suspicious messages to scams@auspost.com.au. Its official scam-alert guidance explains how to send evidence and use the spam-reporting options for iMessage and RCS.
If you already responded
Contact your bank immediately if you shared payment details. If identity information was exposed, Australia Post points to IDCARE, the identity-support service, on 1800 595 160. Change any password you disclosed through the genuine service. Get advice before trusting a follow-up message claiming it can recover your money.
How did they get your number?
A scam text cannot tell you exactly where the sender got your number. It may have been guessed, exposed in a breach, shared through a sign-up, or found in a public listing. Evri describes mass messaging rather than targeting a known parcel. Public personal information can also make messages more convincing. Receiving a text is not proof that a particular company or data broker supplied your details.
Review what you share publicly and read how data brokers collect contact details. Removing public listings can reduce one source of exposure, but it cannot erase breach records, stop randomly generated texts or guarantee that scam messages will end.
How data brokers collect contact details →Run the free exposure check →