Australia Post has flagged a high-volume scam spreading via iMessage and RCS. A fake missed-delivery text asks you to reply with a short word like Y, which can help the message, and the scam link that follows, slip past spam filters. Don't reply or tap the link; verify any parcel directly through Australia Post.
How does the "reply Y" delivery scam work?
The scam starts with a text message that looks like a routine parcel update — something like "we missed your delivery" or "your parcel is awaiting collection." The message asks the recipient to reply with a short word or letter, often "Y," supposedly to confirm details or reschedule delivery.
That reply is the trick. Because the message arrives via iMessage or RCS rather than a plain SMS, replying can help the message — and the ones that follow — get past spam-filtering systems that are more likely to flag an unanswered message from an unknown sender. Once the recipient has engaged, the scammer follows up with a link to a fake "redelivery" or "collection" page built to look like an official Australia Post site, asking for personal details, a small "redelivery fee," or both. Any details entered go straight to the scammer — the page itself is not run by Australia Post.
Why is a one-letter reply enough to matter?
This scam doesn't ask you to believe anything unusual — it just asks for a small, low-effort action before anything suspicious has even appeared. Replying "Y" feels harmless, which is exactly why it works: most people wouldn't think twice about a one-letter reply to what looks like a normal delivery text, and by the time the scam link arrives, the message has already slipped past the filtering that would normally have caught it.
How does Scam SafeGuard fit in?
This particular scam is sent as a text message straight to a phone, and the harmful step — tapping the fake redelivery link — usually happens on the phone itself, outside the browsing and webmail activity Scam SafeGuard's extension watches over. The best protection here is simply not engaging with the message and verifying independently through Australia Post's own channels or Scamwatch. If you'd like a second opinion on a message you're unsure about, Scam SafeGuard's extension does include a "Check message" tool where you can paste text in and ask it to take a look.
Red flags to watch for
- An unexpected text about a parcel you weren't told about, or weren't expecting.
- A request to reply with a single word or letter before any other details are given.
- A link using a web address that isn't auspost.com.au, even if it looks close.
- Any request for a "redelivery fee" or payment details by text link — Australia Post does not charge a fee by text to redeliver a parcel.
- Pressure to act quickly, such as a short deadline before the parcel is "returned to sender."
What to do
- Don't reply — not even "Y," "STOP," or anything else. A reply can confirm the number is active, whether or not you follow the link.
- Don't tap the link. Check directly via the Australia Post app, or by typing auspost.com.au into your browser yourself.
- Report it to Australia Post via their official scam-alerts page, and to Scamwatch at scamwatch.gov.au.
- If you've already clicked the link or entered any details, contact your bank immediately.
Frequently asked
How does the "reply Y" delivery scam work?
A text that looks like a routine missed-delivery or parcel-collection notice asks you to reply with a short word, often "Y." That reply can help the message — and the scam link that follows — get past spam filters built to catch messages from unknown senders. The follow-up link leads to a fake Australia Post page asking for personal details or a "redelivery fee."
What's the biggest red flag in this scam?
Being asked to reply before any other details are given, and a link that doesn't use the address auspost.com.au. Australia Post doesn't charge a redelivery fee by text link.
What should I do if I get one of these texts?
Don't reply — not even "Y" or "STOP" — and don't tap the link. Check any parcel directly through the Australia Post app or by typing auspost.com.au into your browser yourself, then report the text to Scamwatch at scamwatch.gov.au.
Sourced from Australia Post, official scam alerts page: alert, published 11 September 2026.
Worried about a delivery scam text reaching someone you love?
Don't use the contact details in the message itself. Verify independently through your own accounts or the organisation's official number or website, or report it to Scamwatch.
Before you start: Scam SafeGuard uses Google's Web Risk service, which works to provide the most accurate and up-to-date information about unsafe web resources. However, Google cannot guarantee that its information is comprehensive and error-free: some risky sites may not be identified, and some safe sites may be identified in error.
Before you paste: we check any links in your message, and we look at the wording too, to help spot common scam patterns. Please don't include passwords, bank details, or other personal information — we don't need them to check your message.
A quick, one-off check.
We watch for fake versions of the Australian brands scammers copy — Linkt, AusPost, myGov — so we can flag a lookalike even before it's reported anywhere else.
Uses Google Web Risk threat data. We are not affiliated with, or endorsed by, Google.
Built for Australia today. Not local to you yet? Tell us where you'd like us next →
← See all scam alerts