Scam Radar

How can you recognize PostNL phishing — required customs clearance fees of 1.99 EUR?

Published

TLDR

SMS or email from 'PostNL' states that a parcel is stuck in customs and that customs clearance fees of 1.79 3.49 EUR must be paid. The link leads to postnl betaling.com (real: postnl.nl). Asks for full credit card details and SMS code....

How it works

SMS or email from 'PostNL' states that a parcel is stuck in customs and that customs clearance fees of 1.79 3.49 EUR must be paid. The link leads to postnl betaling.com (real: postnl.nl). Asks for full credit card details and SMS code....

Red flags

  • Urgent pressure to click, pay, or share codes immediately.
  • A link or sender that does not match the official organization.
  • Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.

What to do

  1. 1Indicators: 1) PostNL never asks for payment via a link in SMS; 2) domain not postnl.nl; 3) micro payment for credibility; 4) CVV and 3DS code are requested.
  2. 2IF VICTIM: Block card at bank, file report with Police, report to Fraudehelpdesk (088 786 73 72), forward SMS to 7726.

Source

NCSC-NL

Source reviewed by Mythos Forensic Team

https://www.ncsc.nl/onderwerpen/phishing

FAQ

Is PostNL phishing — required customs clearance fees of 1.99 EUR a real scam pattern?

Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.

What are the first warning signs?

Urgent pressure to click, pay, or share codes immediately.; A link or sender that does not match the official organization.; Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.

What should I do first?

Indicators: 1) PostNL never asks for payment via a link in SMS; 2) domain not postnl.nl; 3) micro payment for credibility; 4) CVV and 3DS code are requested.; IF VICTIM: Block card at bank, file report with Police, report to Fraudehelpdesk (088 786 73 72), forward SMS to 7726.

Can LegalAudit check my case?

Yes. Start a free chat and paste the message, link, sender, or payment details for triage.