Fake parcel texts: "Your package is being held at the depot"

The scam that reaches everyone

Most of us are expecting a parcel now and then, especially with online shopping. Scammers know this, so they don't need to know whether you're expecting anything: it's enough that a small share of thousands of recipients happens to be waiting for a package at that moment.

In April 2026, the Cybercrime Investigation Directorate of the Albanian State Police warned about fake text messages impersonating Posta Shqiptare (Albanian Post). We see the same pattern in the name of international courier companies.

In English: "Albanian Post: Your package is being held at the depot because of an incomplete address. Pay a 1.50 EUR redelivery fee within 24 hours."

Why it works

• The amount is too small to worry about. 1.50 euros doesn't feel risky. But the page isn't after 1.50 euros: it wants your full card number, the CVV and the confirmation code from your bank.
• The short deadline. "Within 24 hours" pushes you to act before you think.
• The page looks real. Logo, colours, even a "tracking number". Copying a website takes minutes.

How to spot it

1. Look at the address, not the logo. Albanian Post's official site is postashqiptare.al. Any other address, such as posta-al-dergesa.info or postashqiptare-al.com, isn't theirs.
2. Ask yourself: am I really expecting a parcel? From whom? If you are, check its status on the website of the shop you bought from, not through the link in the text.
3. Be wary of a card payment for a "fee". If something really is owed, check by going to the official website yourself or calling the official number.
4. The sender's number. Foreign numbers or ordinary mobile numbers are a warning sign. But don't rely on that alone: sender numbers can be faked.

If you paid

1. Call your bank right away on the number on the back of your card and ask them to block it. Scammers rarely stop at 1.50 euros; they use the card within hours.
2. Check your recent transactions in your banking app and report anything you don't recognise.
3. Keep the message (a screenshot showing the sender's number) and report it to the police.

For more, see I clicked a link and our phishing field guide.