The fake Post "customs fee" text works in Austria because the real one exists.

If you have already tapped the link and entered your card, skip to if you already paid — the first phone call to your bank is the one that matters.

Why this one is harder to dismiss than most

Smishing usually relies on a story that falls apart the moment you think about it — a bank you don't use, a parcel you never sent, a fine for a road you've never driven. The fake Post customs text is different, and more dangerous, because every part of its premise is genuinely real in Austria.

Austria is in the EU, so a parcel from another EU country arrives with nothing to pay. But order something from the UK, the US, China or anywhere outside the Union, and it can genuinely attract import VAT and customs duty — and Österreichische Post genuinely charges a handling fee when it clears that parcel through customs on your behalf. If you have ever received a real one of these, you know the feeling: a slightly confusing, slightly annoying small charge you half-expected. That memory is the scam's best friend. The criminal isn't asking you to believe a lie. They're asking you to assume this is the same dull errand you've done before.

What a real Österreichische Post charge actually looks like

The cleanest way to see the fake is to know the real process, because they diverge at exactly one point — the moment money changes hands.

When the Post clears a genuine parcel through customs, it tells you. But it tells you through its own channels: a notification in the official Meine Post app, or a physical card in your letterbox. Any charge is shown to you there, with the parcel it belongs to, and you settle it the ordinary way — in the app, or in cash or card at a post office counter. There is a real reference number tied to a real shipment. What there never is, is a text message with a link that takes you straight to a card form. The Post does not outsource the most sensitive step — your payment — to a tap on an SMS.

So the test isn't whether a customs charge can be real. It's whether the Post would ever collect it like this. And on that, the Post could not be clearer.

"Ignorieren Sie diese E-Mail und geben Sie auf keinen Fall persönliche Informationen oder Kreditkartendaten ein."

Real versus fake, side by side

Put the two messages next to each other and the difference isn't subtle — once you know where to look.

The three tells that survive every version

The wording changes — "Zustellgebühr", "Einfuhrzoll", "Zollgebühr", "Lagergebühr", a "Sortierzentrum", a different cent amount — but the structure underneath is fixed. Three tells are present in almost every one, and spotting a single one is enough.

If you already paid — the first hour

Tapping the link and entering your card is not the end of it, but speed decides how it ends. Work in this order:

Will you get the money back?

It turns on one distinction, the same one across the EU. If the charge was unauthorised — the criminals took your captured card details and spent more without your say — your bank must refund it under the Zahlungsdienstegesetz (ZaDiG), the Austrian implementation of the EU Payment Services Directive, with your own liability generally limited. If you were deceived into authorising the payment yourself, Austria, like most of the EU, has no UK-style rule forcing the bank to reimburse it — which is why the chargeback call and the speed of it matter so much.

How to protect yourself

One rule, end to end

If you take one habit from this piece, take this: the Post tells you about parcels by SMS, but it never takes your money or your data there. A real customs charge lives in the Meine Post app or at a post-office counter on post.at — never behind a link in a text. Check the domain, ignore the fee, and the most believable smishing text in Austria has nothing left to stand on.