PL
HU
EN
A message that looks completely harmless
The wording is always similar: "Your parcel #3847291 is waiting for pickup. A surcharge of $1.20 is required. Confirm: [link]." Sometimes it's a "customs fee", an "address update", or a "failed delivery attempt" instead of a parcel. There's always a link, always a small amount to pay, and it always sounds like something that could genuinely have happened | because everyone is waiting for something sometimes.
This is one of the most commonly reported scam types. Cybersecurity teams publish warnings every month about new domains impersonating courier companies. The mechanism is simple, cheap to run, and | most importantly for scammers | very effective.
Why the small amount is no accident
If the message demanded $100, most people would stop and think "wait, that's suspicious." But $1.20? That's less than a cup of coffee. The brain doesn't register such a low amount as a threat, so the natural instinct of caution never switches on.
But this transaction is never really about $1.20. The page the link leads to looks like a genuine payment panel | with a familiar courier logo, fields for your card number, expiry date, and CVV code. Once you type that information in, it goes straight to criminals. The parcel surcharge is never actually charged. Instead, in the following days much larger amounts can disappear from your card | or your details get resold on the black market.
Three signals always worth checking
Are you actually expecting anything? If you haven't ordered any parcel, the message itself is already suspicious, regardless of the other details.
Does the link lead to the courier company's official website? Real addresses look like ups.com, fedex.com, or usps.com. Fake sites often use extra words or typos, like "ups-surcharge.info" or "fedex-payment.com".
Does the message push for quick action? Real courier companies don't put countdown timers on surcharges. Time pressure is always a warning sign.
What to do when you get a message like this
Don't click the link. That one rule protects you in 100% of cases. If you're genuinely expecting something, go to the courier company's website yourself by typing the address, or use the app you already have installed.
It's also worth reporting the suspicious message to your mobile carrier or the relevant national cybersecurity reporting service. It takes less than a minute, and every report makes it harder for scammers to keep operating.
How we practise this in the ODYSSEY course
In the "Recognise the scam" module you go through exactly this scenario | you analyse a real-looking fake message, learn to spot the red flags step by step, and practise reporting a suspicious text so that reflex becomes second nature before you ever really need it.