Text/SMS phishing · 3 min read · names changed
The parcel text that took everything
A 'missed delivery' text, a link, a $2.95 redelivery fee — and 20 minutes later, her bank account was drained.
The parcel text that took everything
Priya was expecting a package, so when the text arrived — "AusPost: your parcel is waiting, pay $2.95 to reschedule delivery" — it didn't seem odd at all.
The link opened a page that looked exactly like Australia Post's. She entered her card details to pay the fee. Then a "verification" step asked for her online banking login "to confirm the refund of $2.95".
Twenty minutes later, her bank called: $11,000 had been transferred out in three transactions, and her credit card was maxed out at a Sydney electronics store.
The lesson
- Never tap the link in a delivery text. Go to the courier's app or website directly — your tracking number works there.
- No legitimate delivery company asks for your bank login. Ever. That single step is the scam.
- The $2.95 fee is the trap. Small, plausible, boring amounts get past your guard. The damage is what comes after.
Been through something similar? Report it at Scamwatch (scamwatch.gov.au/report-a-scam) or ReportCyber (cyber.gov.au/report) — and if money or identity documents are involved, call your bank and IDCARE (1800 595 160).