Criminals are using fake DHL pickup slips to carry out a new phishing scam that targets customers during periods of high online shopping activity, according to the company.
The scam involves counterfeit versions of DHL’s familiar yellow delivery notices, which are typically left when a parcel cannot be delivered. Unlike genuine slips, the fake notices contain a QR code that prompts recipients to scan it to arrange a redelivery.
Scanning the code redirects users to a fraudulent website designed to closely resemble DHL’s official site. Victims are then asked to enter personal information, including names, addresses and bank details, which can be used for financial fraud and identity theft.
The tactic is part of a broader trend known as “quishing,” a form of phishing that relies on QR codes rather than email links. These scams are increasingly being spread through physical notices, emails, text messages and fake social media accounts.
Jens-Uwe Hogardt, a spokesperson for DHL, said such fraud attempts are becoming more sophisticated and harder to detect. He noted that official DHL communications are sent only from verified email domains such as “@dhl.com” or “@dhl.de,” and that legitimate messages do not originate from generic email services.
DHL advises customers to track parcels only through its official website or mobile app and to avoid scanning QR codes from unsolicited delivery notices.
Users who believe they have been targeted are urged to contact local police and DHL customer service, change passwords immediately and refrain from sharing personal or financial details through unknown links.
"If you suspect having received fraudulent emails, SMS or found a website or social media account that tries to pass off as DHL, we encourage you to let us know at your earliest convenience, so that we can quickly take actions to stop the fraud," DHL posted.
Authorities and companies continue to warn that vigilance is especially important during peak shopping seasons, when delivery-related scams tend to increase.
