Fake Customs Duty Scam — How to Recognise a Fraudulent Customs Payment Request

Three Red Flags — How to Spot a Fake Customs Payment Request

Criminals send millions of fake customs payment SMS messages every month, particularly targeting people who order from UK retailers. The messages are designed to look like notifications from DHL, InPost, Royal Mail, or HMRC. Here is how to tell the real from the fake.

Red flag 1 — A payment link in an SMS message

Real customs duty is never collected via a payment link in an SMS. Legitimate customs charges work like this: (1) the courier (DHL, UPS, FedEx, DPD, InPost) contacts you by email or via their official tracking portal; (2) the courier's website shows you the breakdown of duty, VAT, and any handling fee; (3) you pay through the courier's own secure website, which has a domain you recognise (dhl.com, dpd.com, ups.com, etc.). A link in an SMS that leads to a domain you have never seen — such as a misspelling of the courier name or a random string of characters — is almost certainly fraudulent. Do not click it. Do not enter your card details.

If you are unsure whether an SMS is genuine, go directly to the courier's official website (type the address manually, do not click the link) and track your parcel there. If there is a genuine customs hold, it will appear in the official tracking system.

Red flag 2 — Payment by BLIK or unfamiliar payment provider

Fraudsters favour BLIK and payment pages that process your card without 3D Secure verification, because these transfers are difficult to reverse. Legitimate couriers accept payment by credit or debit card through their own PCI-DSS compliant payment pages, or via direct bank transfer with a clear account number and reference. If a message is directing you to pay by BLIK, by a prepaid voucher (like a Google Play card), or via a payment page that asks for more than just your card number and expiry date (e.g. also your full PIN or online banking password) — it is a scam.

Red flag 3 — No real tracking number / unexpected parcel

If you have not ordered anything from the UK recently, or if the message does not include a real tracking number that matches an actual courier's format, treat the message as suspicious. Genuine courier notifications always include: your name or a reference to your order, a tracking number that works on the courier's official website, and a clear sender identity (e.g. DHL Express, not a generic mobile number). Cross-reference: does the tracking number produce any result on DHL.com, UPS.com, or the Royal Mail website? If not, the message is fraudulent.

What to Do if You Have Received a Suspicious Message

Even if you are not certain whether the message is a scam, these steps protect you before you take any further action.

Step 1 — Do not click, do not pay, screenshot the message

Take a screenshot of the suspicious message (including the sender's number and the full link text) before doing anything else. This is evidence you may need when reporting the fraud. Then: block the sender number on your phone. If you received the message by email: mark it as phishing (Spam / Phishing) in your email client.

Check whether you are actually expecting a parcel from the UK: log into the retailer's website directly and check your order status. If a real parcel is on the way and a real customs hold applies, it will appear in the courier's official tracking system when you enter the tracking number.

Step 2 — Report to CERT Polska and Action Fraud

Report the fraudulent message to:

• CERT Polska (Poland's Computer Emergency Response Team): cert.pl — use the online report form. CERT Polska tracks phishing campaigns and can alert others.
• Action Fraud UK (UK National Fraud & Cybercrime Reporting Centre): actionfraud.police.uk | 0300 123 2040. Report here if the message impersonates a UK courier or HMRC.
• UODO (Polish Data Protection Authority — if your personal data may have been compromised): uodo.gov.pl.

Your report helps protect others. These agencies use reports to take down fraudulent domains and warn the public.

Step 3 — If you have already paid or entered card details

Act immediately: (1) Call your bank on the number on the back of your card — tell them you have been a victim of fraud and ask them to freeze the card and reverse the transaction. Card scheme rules (Visa/Mastercard) allow chargebacks for fraudulent transactions. (2) Change your online banking password and enable two-factor authentication if it is not already on. (3) If you paid by BLIK: call your bank immediately — BLIK transfers can sometimes be cancelled within seconds if you act fast enough. (4) Report to CERT Polska (cert.pl) and Action Fraud (actionfraud.police.uk | 0300 123 2040). Do not be embarrassed — these scams are extremely sophisticated and target millions of people.

What a Real Customs Charge Looks Like — Reference Guide

Knowing what legitimate customs communications look like is the best protection against fraud.

Genuine customs duty notification — what it contains

A genuine customs charge notification from a courier contains: (1) your full name or the name of the addressee; (2) the shipment tracking number (in a format like JD000000000000000000 for DHL, 1Z for UPS, or 1234 5678 9012 3456 for Royal Mail/Parcelforce); (3) the name and logo of the courier (DHL, UPS, FedEx, DPD, GLS, InPost — whatever courier is actually carrying your parcel); (4) an itemised breakdown of the charge: duty amount, VAT amount, handling fee — separately; (5) a link to the courier's own website to pay — the URL will be at dhl.com, dpd.com, ups.com etc. — not a random or misspelled domain. If any of these elements are missing or look wrong, do not pay.

HMRC never contacts you by SMS about customs duty

HMRC (Her Majesty's Revenue & Customs) does not send SMS payment requests. HMRC communicates with taxpayers by post (physical letter), through the Government Gateway online account, or via PAYE/VAT account portals. An SMS or email claiming to be from "HMRC Customs" demanding a payment via a link is always fraudulent. The same applies to messages purporting to be from "UK Border Force", "Border Agency", or "Customs & Excise" — these are impersonation scams. Report to Action Fraud: actionfraud.police.uk | 0300 123 2040.

What the current rules say

Fake customs duty scams arrive by SMS or email and typically have three red flags: a payment link (real couriers use their own websites), BLIK or unusual payment methods, and no verifiable tracking number. If you receive a suspicious message: do not click, do not pay, screenshot it, and report to CERT Polska (cert.pl) and Action Fraud UK (actionfraud.police.uk | 0300 123 2040). If you have already paid: call your bank immediately and request a chargeback. HMRC never sends customs payment demands by SMS. This article reflects the legal position as of 2026-04-18.

FAQ — frequently asked questions

How do I know if a customs duty SMS is real or a scam?

Three red flags for a scam: (1) there is a payment link in the SMS; (2) the message asks for BLIK or card payment via an unfamiliar website; (3) there is no real tracking number that works on the official courier's website. Real customs charges appear in the courier's official tracking system and are paid through the courier's own website.

Does HMRC send SMS messages about customs duty?

No. HMRC never sends SMS payment demands. Any SMS or email purporting to be from 'HMRC Customs', 'UK Border Force', or 'Border Agency' and asking for a payment via a link is a fraud. Report it to Action Fraud: actionfraud.police.uk | 0300 123 2040.

I already paid the fake customs charge — what do I do?

Call your bank immediately on the number on the back of your card and report fraud. Request a chargeback or card block. If you paid by BLIK: call your bank instantly — BLIK reversals are sometimes possible within seconds. Report to CERT Polska (cert.pl) and Action Fraud (0300 123 2040).

Where do I report a fake customs SMS in Poland?

Report to CERT Polska (cert.pl) using their online reporting form. You can also report the sending phone number to your mobile operator. If financial fraud occurred, also report to the Polish Police (Policja) and to Action Fraud UK if the message impersonates a UK entity.

Can I get my money back after paying a customs scam?

Possibly yes, through a card chargeback (Visa/Mastercard allow chargebacks for fraudulent transactions, usually within 120 days). Contact your bank immediately. BLIK reversals are only possible within seconds — act immediately. If the bank cannot help, the Polish Financial Ombudsman (Rzecznik Finansowy) can assist with a formal complaint.

Official sources

• Action Fraud — report fraud and cybercrime — Action Fraud
• CERT Polska — phishing reporting — CERT Polska / NASK
• GOV.UK — phishing and scam reporting — GOV.UK
• HMRC — phishing and scam emails (HMRC does not send SMS payment demands) — HMRC