- Delivery Scams
- Christmas Safety
- Australia Post Security
Australia Post warns of surge in fake delivery scams targeting shoppers until Christmas. Learn how scammers exploit Facebook Marketplace users and steal personal details through fake courier websites.
Christmas Scam Warning from Australia Post
Australia Post has issued an urgent warning to customers about a significant increase in fake delivery messages and emails expected from now until Christmas. The postal service is urging Australians to remain on "high alert" as scammers exploit the busy shopping season to steal personal and financial information from unsuspecting victims.
With the pre-Christmas sales period in full swing and millions of Australians expecting deliveries, fraudsters are taking advantage of the heightened anticipation and urgency to trick people into clicking malicious links or surrendering sensitive data. The timing is deliberate—scammers know that during peak shopping periods, people are more likely to expect parcels and less likely to scrutinise delivery notifications.
How the Australia Post Delivery Scam Works
The sophisticated scam primarily targets users of online marketplaces, particularly Facebook Marketplace sellers. Fraudsters pose as legitimate buyers and initiate contact through messaging platforms like Facebook Messenger. Once they've established communication, they send links or QR codes that direct victims to fake Australia Post courier service websites.
These fraudulent websites are meticulously designed to look authentic, claiming that once payment is processed online, a courier will collect the item after the money has been transferred. However, the entire operation is a facade created solely to harvest personal and financial information from victims. Once users enter their details—including credit card numbers, passwords, or banking information—the scammers capture this data for identity theft and financial fraud.
Australia Post Chief Information Security Officer Adam Cartwright emphasised the urgency of the situation: "As the pre-Christmas sales ramp up and more Aussies are expecting deliveries, scammers are exploiting that anticipation and urgency to trick people into clicking fake links or handing over personal information."
The Alarming Scale of Delivery Scams in Australia
Recent research conducted by Australia Post has revealed the staggering prevalence of scam communications targeting Australians. The findings show that more than 90 per cent of Australians have received a scam call or text message, with nearly three-quarters of these fraudulent messages originating from fake shipping and parcel delivery companies.
The problem extends beyond simple phishing attempts. Australia Post has identified increasingly sophisticated operations, including a global scam network called "Darcula". This criminal enterprise operates by renting scam toolkits to other fraudsters, enabling them to create convincing replicas of well-known delivery brands. What makes Darcula particularly dangerous is its use of encrypted channels that bypass traditional security filters, making these scams significantly harder to detect and block.
Who Is Most Vulnerable to These Scams
While scammers cast a wide net, certain demographics face higher risks. Australians aged 65 and over continue to report the highest financial losses from scams of any age group, losing nearly $100 million in 2024 alone, according to the National Anti-Scam Centre.
The vulnerability of older Australians has led scammers to specifically target this demographic with tailored approaches. Fake news stories and sophisticated phishing attempts are increasingly designed to appeal to over-60s, with Dr Kaz Ross explaining that these fabricated stories often contain links that install cookies or malicious code on victims' devices, setting them up for future scams.
Critical Red Flags to Identify Fake Delivery Messages
Recognising fraudulent communications is essential for protecting yourself during the Christmas shopping period. Key warning signs include:
- Unexpected delivery notifications when you haven't ordered anything
- Messages requesting personal information, passwords, or payment details
- Links or QR codes sent via social media messaging apps
- Urgent language pressuring immediate action or payment
- Poorly written messages with spelling or grammatical errors
- Requests to click links instead of checking official apps
- Payment demands before parcel collection or delivery
Adam Cartwright stressed that customers can be "confident" that any message requesting personal or payment details is not from Australia Post. The legitimate postal service will never ask for such information via phone, text, or email.
How to Protect Yourself from Australia Post Scams
Australia Post has provided clear guidelines for customers to stay safe during the Christmas period. The most important step is to download the official Australia Post app and enable push notifications for parcel tracking. This provides the most secure and reliable method for receiving genuine delivery updates.
Never respond to text messages or emails asking for personal or payment details. If you receive a suspicious message claiming to be from Australia Post, do not click any links. Instead, open the official app independently or visit the Australia Post website directly by typing the URL into your browser.
Leading cybersecurity experts, including Arca CEO Elsa Markula, emphasise the importance of pausing before taking action. "It is important not to react immediately. Pause," Markula advises. This simple step can prevent knee-jerk reactions that scammers rely upon to succeed.
What to Do If You Suspect a Scam
If you're uncertain about the legitimacy of a delivery notification, verify it through official channels. Log into the Australia Post app or website directly to check your parcel tracking status. If you still have doubts, ask a trusted friend or family member to help you assess the situation.
Should you accidentally click a suspicious link or provide information to a scammer, act immediately. Contact your bank to secure your accounts, change your passwords, and report the incident to Scamwatch and Australia Post. Quick action can minimise potential damage and help authorities track these criminal operations.
Remember that legitimate businesses understand if you want to verify their communications through official channels. Taking extra time to confirm authenticity is always preferable to falling victim to fraud, especially during the busy Christmas period when scammers are most active.