LEGALAUDIT

Scam Radar

How can you recognize InPost smishing — parcel waiting, PLN 1.99 surcharge?

Published

TLDR

An SMS from 'InPost' or 'Poczta Polska' states that a parcel is waiting and requires a surcharge of PLN 1.99–5.99 for the shipment. The link leads to inpost doplata.com (the real one is inpost.pl). It steals payment card details and the...

How it works

An SMS from 'InPost' or 'Poczta Polska' states that a parcel is waiting and requires a surcharge of PLN 1.99–5.99 for the shipment. The link leads to inpost doplata.com (the real one is inpost.pl). It steals payment card details and the...

Red flags

  • Urgent pressure to click, pay, or share codes immediately.
  • A link or sender that does not match the official organization.
  • Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.

What to do

  1. 1Indicators: 1) InPost never asks for a surcharge via a link in an SMS; 2) the domain does not end with inpost.pl; 3) a micropayment is used to build credibility; 4) it asks for the CVV and SMS code.
  2. 2IF YOU ARE A VICTIM: block your card (number on the back), report the case to the Police (kgp.gov.pl), report it to CERT Polska at incydent.cert.pl, and forward the SMS to number 8080.

Source

CERT-Polska

Source reviewed by Mythos Forensic Team

https://cert.pl/lista-ostrzezen/

FAQ

Is InPost smishing — parcel waiting, PLN 1.99 surcharge a real scam pattern?

Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.

What are the first warning signs?

Urgent pressure to click, pay, or share codes immediately.; A link or sender that does not match the official organization.; Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.

What should I do first?

Indicators: 1) InPost never asks for a surcharge via a link in an SMS; 2) the domain does not end with inpost.pl; 3) a micropayment is used to build credibility; 4) it asks for the CVV and SMS code.; IF YOU ARE A VICTIM: block your card (number on the back), report the case to the Police (kgp.gov.pl), report it to CERT Polska at incydent.cert.pl, and forward the SMS to number 8080.

Can LegalAudit check my case?

Yes. Start a free chat and paste the message, link, sender, or payment details for triage.