If you've had a text land in your phone this week asking you to "verify your postcode within 48 hours" to get your parcel delivered, don't touch it. Australia Post confirmed on 18 March that a fresh wave of SMS phishing messages is doing the rounds, and the goal is simple, your personal details and card numbers.
This one has been circulating for a while but the scammers keep refining it. More Australians are getting caught out each month.
You get a text that looks like it's from Australia Post. It tells you there's a delivery issue and you need to either verify your postcode or pay a small fee, usually a couple of dollars, to get your parcel released. The link takes you to a fake website that looks almost identical to the real Australia Post site.
From there it gets worse. The fake site walks you through a few steps like picking a delivery day, confirming your address before eventually asking for your card details. By the time you get to the payment page you've already put in personal information and spent a few minutes on the process, which makes most people just want to finish it.
Some versions also pull a "payment failed" trick. The site tells you the transaction didn't go through and asks you to try another card. That's how they grab details from multiple cards in one go.
Australia Post is one of the most trusted brands in the country and scammers know exactly how to exploit that. They copy the logo, colours and page layout well enough to fool most people on a quick glance, especially on a phone screen.
The newer versions of this scam are also built to get past standard spam filters, spreading through iMessage and RCS so your phone won't automatically flag it as suspicious.
Australia Post will never ask you for personal information or card details via SMS. Since March 2025 they've also been removing links from their tracking texts entirely. So if you get a text with a clickable link claiming to be from Australia Post, that alone tells you something is off.
Other signs to watch for: the message creates urgency with a deadline, the URL doesn't end in auspost.com.au, and there's no tracking number or your name anywhere in the message.
If you're waiting on a parcel, go directly to the AusPost app or type auspost.com.au into your browser yourself. Never follow a link from an unexpected text.
If you've already clicked and entered your details, call your bank straight away and report it to Scamwatch at scamwatch.gov.au. You can also forward the message to scams@auspost.com.au so Australia Post can track the fake sites and get them taken down.
Before you follow any link in an unexpected delivery message, run the URL through ScamShield AI at scamshieldai.com.au. It checks against multiple threat databases and gives you an instant verdict on whether a site is safe. It's free and takes about ten seconds.
Think you've spotted a scam?
Check it instantly with ScamShield AI — free, no sign-up needed.
Open ScamShield AI on Telegram