Fake InPost SMS Scams: How to Spot Phishing Paczkomat Notifications in Poland

If you live in Poland, you use InPost. With over 20,000 Paczkomat parcel lockers across the country and millions of packages delivered daily, InPost is deeply woven into Polish daily life. And that is exactly why fake InPost SMS messages have become the single most common phishing attack in Poland.

CERT Polska consistently ranks InPost impersonation as the number one reported phishing campaign in the country. Here is how to protect yourself.

How the Fake InPost SMS Scam Works

The Basic Pattern

1. You receive an SMS that appears to come from InPost
2. The message says something like:
   • "Twoja paczka czeka w Paczkomacie. Dopłać 1,49 zł za przedłużenie" (Your package is waiting. Pay 1.49 PLN for extension)
   • "Paczka nie mogła zostać dostarczona. Zaktualizuj adres" (Package could not be delivered. Update your address)
   • "Opłata celna do uregulowania. Kliknij tutaj" (Customs fee to be paid. Click here)
3. The SMS contains a link to a fake payment page
4. The page mimics InPost or a Polish bank and asks for your card details or banking credentials
5. You enter your details, and the scammer empties your account

Why It Is So Effective

• Timing: Scammers send these during peak shopping periods when most people are expecting packages
• Small amounts: The requested "fee" is tiny (1-5 PLN), making it seem harmless
• Urgency: The message implies your package will be returned if you do not act quickly
• Familiarity: Everyone in Poland uses InPost, so the message feels relevant

Real vs. Fake InPost Communications

How to Verify Legitimate InPost Messages

1. Open the InPost Mobile app — All real deliveries appear in your app
2. Check the tracking number — Enter it at inpost.pl, not through SMS links
3. Look for the pickup code — Real InPost SMS includes a Paczkomat pickup code
4. Verify the sender — Real InPost messages come through their official system
5. Never click links in SMS — Go directly to the InPost app or website

Common Fake InPost SMS Variations

• "Dopłata za paczkę" — Additional payment for your package (InPost never charges extra after purchase)
• "Paczka zwrócona do nadawcy" — Package returned (check in the app, not via link)
• "Zmień adres dostawy" — Change delivery address (always do this in the app)
• "Opłata celna" — Customs fee (legitimate customs fees are handled by the courier at delivery or through official customs portal)
• "Twoja paczka jest za duża" — Your package is too large (this is not how InPost communicates)

What to Do If You Clicked a Fake Link

1. Do not enter any information — Close the page immediately
2. If you entered card details, call your bank NOW to block the card
3. If you entered banking credentials, change your password immediately
4. Check your bank account for unauthorized transactions
5. Report the SMS to CERT Polska by forwarding it to 8080
6. File a report at incydent.cert.pl
7. Install or update antivirus on your phone

Protecting Yourself Long-Term

1. Use the InPost Mobile app as your primary tracking tool — Not SMS
2. Enable push notifications in the InPost app for real delivery updates
3. Report fake SMS to 8080 — CERT Polska's dedicated phishing number
4. Keep your phone OS updated — Security patches help prevent malware
5. Consider using a spam filter app to catch suspicious SMS messages
6. Educate family members — Elderly relatives are especially vulnerable

Share Delivery and Address Information Safely

When you need to share your delivery address, Paczkomat pickup code, or other logistics details with someone, use LOCK.PUB to create a password-protected link that auto-expires. It is a safer alternative to sending personal details through SMS or Messenger, where they can be intercepted or exposed in a data breach.

The Bottom Line

InPost will never ask you to pay an additional fee via SMS link. If you receive a suspicious SMS claiming to be from InPost, do not click the link. Open the InPost app directly to check your deliveries. Forward the suspicious message to 8080 to help CERT Polska fight phishing in Poland.

For sharing sensitive personal details like addresses or account information, use LOCK.PUB — free, encrypted, and auto-expiring. Stay alert and keep your money safe.