Australia Post customers targeted in dangerous new scam—did you get the text?

If you’ve ever felt a little thrill when the postie’s van pulls up, you’re not alone. Australians love their parcels—especially since online shopping has become a daily habit for many of us. 

But with that excitement comes a new risk: scammers are getting smarter, and their latest trick, the so-called ‘Darcula’ scam, is targeting Australia Post customers across the country. 

The ‘Darcula’ scam is a sophisticated phishing attack that preys on our eagerness to receive parcels. Here’s how it works: you receive a text message, supposedly from Australia Post, claiming your delivery has failed due to an invalid postcode. 

The message urges you to click a link to ‘fix’ the issue. That link takes you to a website that looks almost identical to the real Australia Post site, where you’re asked to enter personal details—sometimes even payment information.

But here’s the catch: it’s all fake. The moment you enter your details, they’re sent straight to cybercriminals, who can use them to drain your bank account, steal your identity, or sell your information on the dark web.

According to cybersecurity experts, the Darcula scam is particularly insidious because it leverages the trust we have in well-known brands like Australia Post. 

Jamieson O’Reilly, founder of Sydney-based cybersecurity firm Dvuln, explains that this scam is part of a new wave of ‘Phishing-as-a-Service’ platforms. In other words, even scammers with little technical skill can now launch convincing attacks by simply subscribing to a toolkit that does all the hard work for them.

‘Criminals don’t need to be technical. They just pick a brand, choose a scam message—like ‘you missed a parcel’—and Darcula sets everything up for them,’ says Mr O’Reilly. ‘As soon as the victim enters their details, the information appears in the criminal’s dashboard. They can watch it live and immediately use the information.’

Unfortunately, these types of scams are becoming more common. Australia Post’s own research shows that nine in 10 Australians have received a scam text or call, and nearly three-quarters have been targeted by scams mimicking parcel delivery services. 

With so many of us shopping online, it’s easy to see how these messages can catch us off guard—especially if we’re genuinely waiting for a delivery.

Australia Post has issued a clear warning: it will never call, text, or email customers to request access to personal or financial information, or to ask for payment via a link. If you receive a message like this, it’s almost certainly a scam.

Adam Cartwright, Australia Post’s Chief Information Security Officer, advises: ‘The safest way to track your deliveries is directly through the official AusPost app. If you’re expecting a parcel, don’t click on suspicious links or respond to unexpected messages—always check the app first.’

Scammers often target older Australians, knowing they may be less familiar with digital scams or more trusting of official-looking messages. Stay safe and stay smart—if something feels off, check the official app or website before clicking any links.

Have you received a suspicious message lately? What steps do you take to protect yourself online? Share your experiences and tips in the comments below—your story could help someone else avoid becoming a victim.

Also read: What is being done to crack down on text scammers?