Scammers are taking advantage of the festive rush and targeting groups such as Facebook Marketplace users, with Australia Post urging customers to be wary of fake emails and delivery messages.

They often pose as interested buyers and send links or QR codes via Messenger to fake ‘Australia Post courier service’ websites. These sites claim that payment will be processed online and that a courier will collect the item once payment is made when, in reality, these fraudulent sites are designed to steal personal and financial information.

This trend reflects a broader national issue with research from Australia Post showing more than 90 per cent of Australians have received a scam text or call, and nearly three-quarters reporting that scams most commonly impersonate shipping and parcel delivery services.

Adam Cartwright, Australia Post chief information security officer, advised customers to track parcels through the official AusPost app and ignore any message requesting personal or payment information.

“As the pre-Christmas sales ramp up and more Aussies are expecting deliveries, scammers are exploiting that anticipation and urgency to trick people into clicking fake links or handing over personal information,” Mr Cartwright said.

“If you receive a message asking for personal or payment details, you can be confident it’s not from us. In fact, the safest way to track your item is through the official AusPost app.”

Key advice for residents:

• Download the official AusPost app and enable push notifications for parcel tracking. This is the most secure and reliable way to receive genuine delivery updates.

• Australia Post will never ask for personal or financial details via phone, text or email including passwords, credit card, or bank details.

• Don’t click on suspicious links in text message or emails Australia Post is also seeing a resurgence of sophisticated phishing ahead of Christmas, including the global ‘Darcula’ operation, which rents scam toolkits to criminals that mimic trusted delivery brands.

By sending messages via end-to-end encrypted channels such as iMessage and Rich Communication Services (RCS), Darcula can bypass traditional filters, making these scams harder to detect and block.