Scammers often pose as postal or courier services, sending package notifications with enticing or alarming messages (e.g., incorrect address, customs fees, missing house number).
These messages frequently include a link to a fake website that imitates official delivery company sites, asking users to enter personal or banking information.
You can spot them by suspicious URLs, grammatical errors, or requests for payment and card CVC numbers via SMS.
Delivery companies constantly warn the public to ignore such messages and avoid clicking any links.
Users are advised to always check the status of a shipment through official channels (e.g., tracking systems) before making any payment or updates, and to contact the police and their bank immediately if they suspect fraud.
Scammers use various delivery-related tricks to make money.
For example, fake SMS messages often claim that a delivery was halted due to incorrect or incomplete information (e.g., missing house number) and urge recipients to update their address via a link.
Other messages claim that a package requires payment of customs fees or additional charges, with a link to a fake site mimicking the Croatian Post.
In one case, a woman received an SMS asking her to pay €3 for delivery, but after entering her details on the fake site, she lost around €650 from her account.
Messages often include news of a package arrival, tracking number, and a request to “update” information—but the links lead to malicious sites.
Some scammers can even install malware on devices or use the entered card details to steal money.
In SMS messages, scammers use convincing language and familiar brands. Messages may appear to come from a legitimate company with logos.
Urgency is often emphasized—prompting immediate payment of “additional fees” or data updates under the threat of delayed delivery.
Messages may also mention free delivery or “refunds” as bait (e.g., “your package has arrived, cash on delivery 0 kn/€”), which is a common trick.
All legitimate services make it clear that payments are made only to the courier or at a branch, never through SMS links.
Delivery companies never request additional payment via SMS; official notifications always include a tracking number to verify the shipment status.
Pay attention to inconsistencies in the SMS—incorrect company names, odd grammatical errors, or missing official domains (e.g., “postas.hr,” “dpd.com.hr,” or “mbe.com.hr”).
Citizens can recognize and avoid SMS scams by following a few simple rules:
Check the sender and the link
Before opening an SMS or clicking a link, verify that it comes from an official number or instructions (numbers and names can be faked).
Delete suspicious messages from unknown numbers or foreign codes immediately.
Only click on links for shipments you are expecting, and always check that the domain is correct (e.g., posta.hr, dpd.com.hr, gls-group.com).
If a message appears to be from a delivery service, contact them separately through official channels (website or phone) to confirm its validity.
Never share financial information.
Never enter your card details (number, CVC/CVV) on links from SMS messages or share photos of your card. To pay for a shipment, only the recipient’s name and IBAN are needed—CVC/CVV and expiry date are not required (these are requested only by scammers).
Official courier services will never ask for payment or additional “delivery fees” via SMS or email.
Fake messages often contain spelling mistakes, unusual wording, or urgent threats (“pay immediately,” “your package will be returned”).
If you notice these signs, ignore the message.
Check for a secure certificate (“https”) or a clear logo on websites, but don’t rely solely on visual cues—scammers can use stolen logos on fake sites.
You can check the status of a package through the courier’s app or official website using the official tracking number.
Do not open tracking links you weren’t expecting. Consider installing apps that filter SMS and calls (e.g., Truecaller) and enabling two-factor authentication for banking apps.
This adds an extra layer of protection against misuse of your information.
If you entered your details on a fake site or sent money, contact your bank immediately to prevent further theft and report the incident to the police.
Even if you are just suspicious, you can forward the fake message to the courier’s support or national authorities (e.g., the national CERT) to help trace the source.
Citizens are also encouraged to report suspicious SMS messages to mobile operators (Hakom) and national institutions, helping to disrupt scam networks.
Mail Boxes Etc./MBE centers operate through independent franchisees under the MBE brand. Through its franchise network, Mail Boxes Etc. provides support services for businesses and individuals. Logistics and shipping services are MBE’s core offerings—facilitated through agreements MBE makes for the benefit of its franchisees with major domestic and international express couriers—along with other graphic and printing services, provided either directly or through agreements with large printing centers. Promotion of services to business and private customers is carried out as part of the business activities of each MBE franchise partner, both inside and outside MBE centers ("farming"). Each franchise partner is contractually obligated to perform such activities. Mail Boxes Etc. and MBE are registered trademarks used with permission from Fortidia – a registered trademark of MBE Worldwide S.p.A – (All rights reserved). Services offered by individual MBE centers may vary by location. The materials available on this website, the information contained herein, and any other relevant data may not be copied, distributed, modified, republished, reproduced, downloaded, or forwarded to third parties in any way without the express prior written consent of Sistema Italia 93 S.r.l. We accept no responsibility for unauthorized use of the materials, information, and/or data available on this website.
MBE Adriatic d.o.o. • Puževa ulica 11, Zagreb • OIB:64386903048 • MB:0479781
