Unknown perpetrators have been placing fake DHL delivery notices in mailboxes across several German regions during the 2025 holiday season, consumer protection officials said. The printed QR code leads to a counterfeit parcel page that requests credit card data and personal information. According to police, printed notes appear more credible to many recipients than emails or text messages.
Current Warning – December 2025
Google recorded more than 5,000 searches related to the scam within four hours, according to media reports. Consumer protection officials advise against scanning QR codes on unexpected mailbox notes.
Video: @finanzstarter explains the DHL scam
How the DHL scam works
- 1Note in mailbox
A professionally designed note with DHL logo informs about an allegedly undeliverable package.
- 2Scan QR code
The QR code supposedly leads to scheduling an appointment or paying a small fee.
- 3Fake DHL page
The website imitates the official DHL site and requests personal data step by step.
- 4Data theft
The site collects names, addresses, email addresses, credit card details and SMS one-time codes. Losses of up to €2,400 have been reported, according to consumer protection officials.
Why the scam is effective
Trust in printed mail
A printed note in a mailbox appears more trustworthy to many recipients than an email, consumer protection officials said. People tend to be less suspicious of physical mail than of digital messages.
Peak parcel season
Many people expect several parcels in the weeks before Christmas. A delivery notice draws little suspicion during that period, according to consumer protection officials.
Carefully crafted forgeries
The notes carry the DHL logo and mimic the layout and wording of genuine notifications. According to consumer protection officials, they are barely distinguishable from originals.
Data requested in stages
The phishing page first asks for a name and address, then an email address and credit card details. The requests escalate step by step.
Recommended precautions
Display the underlying web address before opening it. If the domain differs from dhl.de, do not open the page.
When in doubt, open the official DHL app or enter dhl.de manually in your browser. Do not use the QR code on the note.
Real DHL notifications contain a tracking number. Check it directly at dhl.de/sendungsverfolgung.
DHL says it does not request sensitive data via a QR code on a delivery note. Any fees are collected at the door.
What affected users should do
- 1.Block your credit card immediately (your bank's emergency line)
- 2.Inform your bank about the fraud
- 3.Change passwords of all affected accounts
- 4.File a police report
- 5.Report incident to DHL: phishing-dhl@dhl.com
QRTrust: Checking QR codes before opening
QRTrust checks the destination URL of a QR code against several phishing databases and shows the result before the page is opened. The service is free, GDPR-compliant and developed in Germany.
Check QR code now →Sources
- CHIP: "Danger in the mailbox: Anyone who sees this note must be especially careful now"
- t-online: "DHL scam: Fake pickup slips with QR code"
- Watson: "DHL package: Warning about QR code in mailbox"
- Consumer Protection Center NRW
- Police warnings December 2025
About QRTrust
QRTrust is Germany's first QR code security platform, developed in Dortmund. AI-powered real-time detection, a local threat database and multi-layered security checks protect citizens, authorities and businesses from quishing attacks. GDPR compliant, hosted in Germany.