"Your GLS-FR parcel has been held at the sorting centre: €2.99 in customs clearance fees remain unpaid. Pay within 48 hours to avoid return to sender: gls-regularisation-fr[.]top"
Martine, 61, from Angers, was in fact waiting for two parcels: a pair of shoes ordered on a marketplace and a birthday present sent by her daughter. She paid the €2.99 without hesitating — the amount was so trivial that she never even stopped to wonder whether it was justified. Eleven days later, her statement showed three debits of €59.90 in favour of a "subscription service" registered in Cyprus. The €2.99 had never been the point.
That is the whole genius of this scam, and it is why it has survived for years even though everyone thinks they know it: it isn't trying to steal money from you, it's trying to get you to type your own sixteen digits on a keypad. The entry price is deliberately ridiculous, because a ridiculous amount switches off suspicion.
Why the parcel is the most profitable pretext in France
Statistically, you're nearly always waiting for something
That's the foundation of the whole system. The fake delivery text doesn't need to know what you've ordered: it plays the odds. With more than 1.5 billion parcels delivered each year in France, according to Arcep figures on the parcel market, a connected adult stands a good chance of having a shipment in transit at any point in the month — and almost certainly between October and January.
The scammer sends the message to hundreds of thousands of numbers. All he needs is for a few percent of recipients to be waiting for a parcel at the precise moment the text lands. For those people, the message doesn't look like a scam: it looks like an explanation.
The carrier is vague, and that's deliberate
You've probably noticed that these texts rarely name the right carrier. That's because, in the e-commerce ecosystem, nobody really knows who delivers what. You order on a marketplace, the seller ships via an intermediary, who subcontracts the last mile to a local operator whose name you've never heard. Getting a text from an unknown carrier has become perfectly ordinary.
The names being exploited rotate constantly: La Poste, Colissimo, Chronopost, Mondial Relay, DPD, GLS, UPS, DHL, Evri, and since 2025-2026 completely invented names that merely sound "logistics" ("EuroParcel", "FR-Logistics", "ColisExpress24"). An unfamiliar name no longer raises your guard. That is exactly the intended effect.
Customs is a grey area for almost everyone
Since the end of the VAT exemption on small imported parcels and the European debates over charges applicable to non-EU platforms, the idea that "you have to pay something to customs for a parcel from abroad" has lodged itself in people's minds. And for once, it isn't false: such fees really do exist.
France's customs authority, the Direction générale des douanes et droits indirects (DGDDI), points this out on its website: duties and taxes on shipments from third countries are collected by the carrier or by La Poste, as part of the delivery, never through a text message with a link sent by an unknown sender. But between "it's false" and "it's plausible", the scammer only needs plausible.
The real target: the bank card, not the €2.99
Why such a small amount
A large sum triggers thought. A sum with two decimal places triggers a reflex. Three mechanisms stack up:
- An amount below the pain threshold. Paying €2.99 "costs" nothing psychologically: even if it's a mistake, it's no big deal. The brain opts for peace of mind.
- Narrative consistency. Customs clearance fees of €300 on a pair of shoes would ring false. €2.99 is exactly the right size for a credible administrative charge.
- The payment as proof that the card is alive. A micro-transaction that goes through confirms three things for the fraudster: the card is active, there's headroom on the limit, and the holder approves payments without looking too closely.
What the fake page actually harvests
The payment form is the heart of the operation. It invariably asks for more than a genuine €2.99 charge would ever require:
| Data requested | Fraudster's real use |
|---|---|
| 16-digit number, expiry date, CVV | Online payments, resale of the "card kit" |
| Name, full address | Bypassing AVS checks, credibility for follow-up calls |
| Phone number | Call from the fake bank adviser within minutes |
| Bank and login credentials | Takeover of your online banking account |
| Code received by SMS (3-D Secure) | Authorising a transaction far bigger than €2.99 |
That last item is what separates a €3 scam from a €3,000 one. The page displays "Confirm payment of €2.99 — enter the code received by SMS". The code, though, was issued by your real bank for a transaction whose amount you can't see: a recurring subscription, adding the card to a mobile wallet, or topping up a payment account.
The three possible outcomes after the click
- The hidden subscription. The card is signed up to a "premium service" at €39, €49 or €59 a month, based abroad, with terms and conditions in microscopic type. The debit only shows up a few weeks later.
- Resale of the data set. Your information goes onto a market where it's bought in batches. The charge may hit months later, which makes connecting it to the original text almost impossible.
- Escalation by phone. An "adviser from your bank" calls you within 48 hours, mentions your real first name, your real bank and a "suspicious €2.99 debit", and gets you to approve "cancellation" transfers. This is the most expensive scenario of all.
Spotting the fake in twelve seconds
Look at the domain, not the displayed name
The one element that can't be cleanly faked is the website address. Real carriers use short, simple domains: laposte.fr, chronopost.fr, mondialrelay.fr, dpd.fr, gls-group.com. Fakes pile up keywords in front of an exotic extension:
laposte-colis-suivi-regularisation[.]icuchronopost-fr[.]supportmondialrelay-paiement-securise[.]topcolissimo[.]fr-tracking[.]cc— here the real name is only a subdomain; the actual site isfr-tracking.cc
The practical rule: read the domain name from right to left, starting at the extension. The word immediately before the final dot is the real owner. Everything to the left of it can say absolutely anything.
The tracking number that tracks nothing
A genuine tracking number can be checked on the carrier's official site, typed in by hand. Fraudulent texts display references in a convincing format, but invented. Two minutes is enough: open the carrier's app or website yourself, paste in the number, and see that it doesn't exist. It's the most reliable test there is, and it requires no technical skill whatsoever.
The secondary signals
- A 48-hour or 24-hour deadline before "return to sender". Carriers hold parcels for several days and chase you through several channels.
- The absence of your name. Genuine delivery notices nearly always include it.
- A sender using a +33 6 or +33 7 mobile number. Carriers use short codes or alphanumeric sender IDs, not a private mobile.
- A request for card details by text, when real customs charges are collected by the postman, at a pickup point, or through your online account.
If in doubt, never click from the message itself. Close it, open the carrier's official app and check the status of your shipments. If nothing is on hold, there's nothing to pay.
Shrinking the attack surface before the first text even arrives
A virtual card for everything that isn't essential
Most French banks now offer a single-use or capped card number for online purchases. Systematically using that number for orders on unfamiliar sites changes everything: even if your details are captured on a fake page, they'll be worthless a fortnight later.
For those who order constantly and lose track, a hand-kept order tracking notebook is often enough to tell you at a glance whether you're genuinely expecting a parcel. It's basic, but it's precisely what the scammer is betting you don't have.
A pickup point rather than your letterbox
Having deliveries sent to a pickup point or a locker limits the number of legitimate texts you receive — and therefore the noise in which the fake message hides. If you receive a lot of parcels at home and are never there, a secure parcel box also cuts down the stray "delivery attempt" notices that fraudsters use as templates.
Don't read sensitive texts any old way
Part of the trap lies in how you read: on a five-inch screen, while walking, the website address is truncated and the eye sees only "laposte". Getting into the habit of checking financial messages while standing still — and, if needed, with a pair of reading glasses within reach — eliminates a good share of reflex clicks. For older users with a large-button phone, enlarging the font in the accessibility settings is the single most useful step — a link at 20 point can be read; a link at 11 point has to be guessed at.
Lock down the payment, not just the phone
Three settings to switch on once and for all, in your banking app:
- Instant notifications for every transaction, even one euro;
- Online payment limit lowered to what you actually need;
- Blocking payments outside the euro area if you never order from abroad.
A scam that hits a €150 ceiling costs you nothing, even if you clicked.
You've paid the €2.99: what to do now
Within the hour
- Block the card from your banking app or via the interbank hotline on 0 892 705 705. Blocking it won't reverse debits that have already gone through, but it stops everything else.
- Don't answer any call claiming to be from your bank in the days that follow. Hang up and call back yourself, using the number on the back of your card.
- Change the password for your online banking and your email account if you entered them.
- Take screenshots of the text, the website address and your statement: that will be your case file.
In the days that follow
- Report the text to 33700 by forwarding it (free of charge, the shared service run by French operators against fraudulent messages), then send the sender's number when prompted.
- Report the website address to the Phishing Initiative platform and the incident itself to cybermalveillance.gouv.fr, which offers an assistance pathway designed for private individuals.
- File a complaint online or at a police station. Article L.133-18 of the French Monetary and Financial Code provides for reimbursement of unauthorised payment transactions; the bank may nonetheless claim gross negligence, and a filed complaint carries weight in that discussion.
- Monitor your statements for six months. Hidden subscriptions and deferred debits are the real bill for this scam. If your bank refuses, take it to the banking ombudsman and then, if necessary, to the Banque de France.
And if all you did was click, without entering anything?
The risk is low but not zero. Simply clicking a smishing link mainly confirms that your number is live: expect a surge of messages in the following weeks. On Android, if an app was installed outside the Play Store on that occasion, uninstall it immediately and check SMS access permissions in your settings. The usual advice applies too: backing up your data regularly to an encrypted USB drive lets you factory-reset a suspect phone without losing anything.
What this scam says about all the others
The fake customs text has become a classic because it rests on a principle that goes well beyond parcels: ask for little to get a lot. You find it again in fake €35 fine notices, fake €1 health card renewals, fake €1.79 redelivery charges. Every time, the tiny amount acts as the anaesthetic.
The countermeasure is therefore behavioural, not technical: treat a small sum requested by text as more suspicious than a large one. A crook demanding €2,000 puts you on alert. The one asking for €2.99 is counting precisely on the fact that you won't go on alert. Reversing that reflex is most of the work — and in households where several people share a card or an account, a modest digital security guide left next to the family computer often does more good than ten forgotten recommendations.
The rest comes down to a single sentence: no parcel is ever lost over three euros. If a shipment really is on hold, it will wait until you've checked.
