Book a Demo
Platform Phishing Simulation Pricing Blog About CyberWatch AI Scan Sign in
Blog/Phishing

Courier Brand Phishing Emails

Emails pretending to be from courier and postal companies about missed deliveries, customs fees and address problems. How courier phishing works and how to track parcels safely.

CyberWatch AI1 October 2026 · 2 min read
A white delivery van parked on a city street

Delivery companies send millions of genuine emails, which makes them easy to imitate. Courier phishing emails use real logos and familiar wording to say a delivery failed, customs fees are due, or your address needs confirming.

Common courier email lures

  • "We missed you. Reschedule your delivery."
  • "Customs duty of 2.99 is due before release."
  • "Address incomplete. Confirm your details."
  • "Shipping label attached. Print and bring to your nearest office." See dangerous attachments.
  • "Your parcel will be returned to sender."
Illustrative example · Email
Subject: Delivery attempt failed, shipment 4471 0932 8816. Your parcel is being held at our depot because import charges of 2.99 are unpaid. Pay within 48 hours or it will be returned: hxxps://parcel-release-desk[.]com/pay
Red flags: you were not expecting a parcel from abroad, a tiny fee, a deadline, and a payment link on a domain that is not the courier's. The fee is bait; the goal is your full card details.

What they want

  • Card details through a small fee.
  • Personal details for identity fraud.
  • Malware through an attachment.

How to check

  1. Use tracking from your order confirmation or the retailer's app.
  2. Enter the tracking number on the courier's official website or app, typed yourself.
  3. Check the sender's domain against the courier's real domain.

Never pay fees or open "label" attachments from unexpected courier emails.

Got a delivery email? Paste it into CyberWatch AI Scan for a free check.

Related: parcel delivery text scams. For more, see how to spot phishing in our complete guide.

Frequently asked questions

Do couriers email about customs fees?

Some genuinely do. Verify by entering your tracking number on the courier's official website or app, not by clicking the email.

The email has a tracking number. Is it real?

Fake emails often include made-up tracking numbers. Check it on the official site; if nothing matches, it is fake.

Are attachments in courier emails safe?

Be very cautious. 'Shipping label' or 'invoice' attachments in unexpected courier emails are a common malware trick.

Sources

  1. How To Recognize and Avoid Phishing Scams, US Federal Trade Commission
  2. Online Shopping, US Federal Trade Commission
  3. Suspicious email actions, UK National Cyber Security Centre
Share this article
LinkedIn WhatsApp X
For organizations

Your people get these messages at work too.

CyberWatch AI sends your staff realistic practice attacks, trains the gaps it finds, and shows management exactly where the organization stands.

Book a demo Check a message free

Keep reading

All articles →
A stone wall built from many layers of rock
Phishing

Building a Phishing Defence in Layers

No single tool stops all phishing. How to combine email security, strong sign-in, payment checks and a reporting culture so one miss does not become a breach.

2 October 2026 · 2 min read
A brown envelope and a blank card
Phishing

Checking Your Email for Hidden Forwarding Rules

After a phishing attack, criminals often add rules that forward, hide or delete your email. How to find malicious forwarding and filter rules and remove them.

2 October 2026 · 2 min read
A worried person with their head in their hands at a laptop
Phishing

Entered Your Password on a Phishing Page: Next Steps

Typed your password into a fake login page? Act in the next few minutes: change the password, sign out other sessions, check recovery details and forwarding rules. A step-by-step guide.

2 October 2026 · 2 min read