FedEx / DHL "customs fee" and "shipment on hold" messages
An email or text in a carrier's colours: a shipment is on hold until a customs or handling fee is paid, or a "delivery notice" with an attachment. The fee page collects card details; attachments carry malware.
- Impersonates
- FedEx (and other carriers)
- Arrives by
- email, SMS
- First seen
- not dated
- Specimens
- 0
- Updated
- 2026-09-02
Right now what this family looks like
How to recognise it
- A fee to release a shipment you were not expecting
- A link or attachment instead of a tracking number that works on the carrier's site
- Sender is not the carrier's domain
What to do
- Do not pay, do not open attachments
- Track any real shipment on the carrier's own site
- Report it to the carrier and delete it
Already called, clicked or paid? what to do in the next hour
- Entered a password? Change it now, and everywhere else you used the same one
- Entered card details? Call your bank, ask them to block the card and reissue
- Entered a one-time code? Sign in to the real service now and check for changes to email, phone and payment settings
How it changed
nothing to compare yet · no specimen on recordGot a version? A new subject line, sender, number or domain becomes the next point on this line. Redacted before publication. Send it →
02 Sept2026
Registry
Family created
Opened at launch; no dated specimen on record yet — send yours.
Same trick, other brands
- USPS "package on hold" text (smishing)active · 2026-09
- DigitsPro "shipping costs have not been paid" emailsarchived · 2026-09
Indicators
- None on record yet. Indicators change weekly; an empty list never means an email is safe.
In other streams
- Nothing yet.
Registry data
- Machine-readable
/scams/fedex-customs-fee.json- Timeline feed
/scams/fedex-customs-fee/feed.xml- Sources
- 1 · 1 change logged
- Licence
- CC BY 4.0 · attribution required
- Created / updated
- 2026-09-02 / 2026-09-02