Online Threat Alerts (OTA) - Alerting you to scams and frauds.

Australia Post Scam - How to Protect Yourself
Australia Post Scam - How to Protect Yourself

Australia Post will never email, text, or call you to request personal information, passwords, or credit card payments. If you receive an unexpected message containing a link or a QR code claiming a package cannot be delivered, it is a phishing scam designed to steal your bank details.

Current Australia Post Scams

  • The Facebook Marketplace QR Code Scam: Scammers pose as buyers on Facebook Marketplace. They send sellers a fake link or QR code via Messenger, claiming they have already paid and organized a courier. The link opens a fake Australia Post website that steals the seller's bank details.
  • The "Invalid Postcode" Text ("Darcula" Scam): A high-volume phishing campaign text claims your delivery failed due to an "invalid postcode" or "incorrect address". It pressures you to click a link and pay a small "processing fee" (usually under $5), which extracts your credit card information and SMS verification codes.
  • Failed Delivery Emails: Phishing emails state that a courier could not deliver a package. They prompt you to download an attachment (like a "shipping label") which secretly installs ransomware or malware onto your device.

Red Flags: How to Spot the Fake

  • Presence of a Link: Australia Post has removed hyperlinks from tracking SMS notifications to protect consumers. Any text message with a link is a scam.
  • Requests for Money: Real tracking notifications will never ask you for money, custom clearance fees, or penalties via message.
  • Urgency and Threats: Messages claiming your parcel will be "destroyed" or "returned to sender" within 24–48 hours if you don't act immediately are fraudulent.
  • Suspicious URLs: Fake domains often look close to the real thing (e.g., auspost-customerservice.com or short links like bit.ly) rather than ending strictly in official domains like auspost.com.au.

What to Do Instead

  • Track Privately: Safely verify any real deliveries by downloading and using the official Australia Post App or typing auspost.com.au directly into your browser.
  • Report the Scam: Forward suspicious SMS messages to Australia Post at 0429 999 888. You can also email fake messages and fraudulent invoices directly to scams@auspost.com.au.
  • Immediate Mitigation: If you entered your credit card details or bank credentials on a suspicious link, contact your financial institution immediately to freeze your cards. You can also contact IDCARE on 1800 595 160 for official, free cyber support.
waiting