A message lands on your phone: a parcel in your name is being held and cannot be delivered until you pay a small fee. A link, a few cents, and the matter is settled. Except that Correos did not send that text. It is sent by criminals impersonating Correos to get hold of your card details.
It is one of the most widespread scams around at the moment, and it works precisely because almost all of us are expecting a delivery of some kind. The Ministry of the Interior recorded 464,801 cybercrimes in Spain in 2024, and almost nine in ten were online fraud (scams); 148,292 people were harmed by credit or debit card and traveller’s cheque scams (Ministry of the Interior, Report on Cybercrime in Spain 2024). Behind many of them is a text as unremarkable as the one you have just received.
How to recognise the fake text
The message impersonates Correos with a plausible pretext. It is almost always one of two: your parcel is “held in customs” and a fee must be paid, or it “could not be delivered” because of an incomplete address and your details need confirming. In both cases you are invited to tap a link.
That link does not lead to correos.es. It leads to a cloned website, using the look and colours of Correos, hosted on a domain that resembles the official one but is not it. That is where the trap lies. It usually comes with spelling mistakes, punctuation errors or an odd sender, signs that give away that the message does not come from where it claims.
The hook: a few cents and the urgency of the parcel
The amount they ask for is absurdly small on purpose. INCIBE has documented messages demanding €2.64, €1.79 or even €0.27. Nobody is suspicious of such a tiny sum, and that is the whole point: that you drop your guard and pay without thinking.
On top of the tiny figure comes the pressure. “Final notice”, “your parcel will be returned today”, “you have 24 hours”. The urgency is calculated to make you act before checking anything. Correos does not communicate like this.
What they are really after: your card details
The cents are the bait. What they want lies a step beyond. The fake website first asks for your personal details and then for your card ones: number, expiry date, CVV and, in the more aggressive versions, even the PIN.
The moment you enter them, this is no longer about a €2.64 charge. The criminals have your full card and can make charges of their own or sell it on. The token payment was never the aim; it was the key to getting you to type in what they really wanted.
What Correos never does
It is worth being clear about this, because it settles the doubt at the root. Correos expressly states that it never asks for personal or banking details or confidential information by text, email or telephone. Nor does it ask for money by text: it does not demand customs fees or redelivery payments through a link, and it will not ask you for your card number or PIN on a page opened from a message.
So the rule is simple: any text or email asking you to pay a fee or “confirm your details” by tapping a link is not from Correos. It is an impersonation scam. The pattern, incidentally, is identical to bank impersonation by text, except that here the brand being hijacked is the postal service.
What to do now
If one of these messages has just arrived, the right response is to do none of what it asks:
- Do not tap the link or enter any personal details, card details or codes.
- Check it yourself. If you really are expecting a delivery, go directly to correos.es or the official app and look up the tracking number in the shipment tracker. Never through the link in the text.
- Check the address. If the website is not exactly on the correos.es domain, it is fake.
- Keep the evidence. Take screenshots of the text and, if you did open it, of the website. They will help when you report it.
- Report it to the Policía Nacional or the Guardia Civil, and flag the message to INCIBE through its Cybersecurity Helpline, 017, which is free and confidential.
If you did enter your card details, call your bank immediately —on the number printed on the card itself or from its official app— so they can block it and stop any further charges. That comes first, and it is urgent.
If you have already handed over your card details
Do not panic, but do not give it up for lost either. Time has been against you from the very first minute, and every day that passes narrows your room for manoeuvre. The sensible thing is to put yourself, as soon as possible, in the hands of a lawyer who knows this kind of fraud, with the screenshots and the details of the charge to hand.
And as for the question that is probably nagging at you — whether those charges can be recovered — the payment services rules also cover unauthorised card transactions: we explain it in does the bank have to give my money back after a phishing scam?.
At Perseus & RC Abogados we handle cybercrime of this kind regularly. If you have fallen for one of these texts, talk to us rather than waiting to see what happens.
Frequently asked questions
How do I know whether the text is from Correos or an impersonation?
Correos does not ask for payments or card details by text with a link. If the message demands that you pay a fee or “confirm details” by tapping a link, it is fraud. When in doubt, do not touch the link: go directly to correos.es or the official app and check the tracking number yourself.
Is it normal for Correos to charge a customs fee by text?
No. Correos does not demand fee payments or redelivery charges through a text with a link. Any message that does is an impersonation, however small the amount. The tiny sum is precisely the hook.
I paid the “cents” and entered my card details, what do I do?
Do not give it up for lost. Block the card as soon as possible with your bank on its official number, keep the screenshots and put yourself without delay in the hands of a specialist lawyer. Time has been running from the very first moment, so the sensible thing is to get advice now.
Is there any point in reporting it?
Yes. The report puts the facts on record and helps the investigation, and screenshots of the text and the fake website are useful evidence. Before treating anything as closed, it is worth having a lawyer review your case.