Fake DHL “Invalid delivery address” email tries to steal your password

An email message that claims to be sent from DHL with a subject that says “Invalid delivery address” is being sent in hopes to steal your email password and phish your personal information. The fraudulent email message says that your packages arrived at their post office and that their courier was unable to delivery the packages due to incorrect delivery address details on the packages.

Invalid delivery address

Here’s an example of what the email message might look like:

Subject: Invalid delivery address
From Dhl

Track your package at DHL

Dear customer with email

Your packages arrived at our post service since ‎September ‎18, ‎2018.

Our courier agent was unable to deliver the packages to you due to

incorrect delivery address details on the packages we received.

KINDLY CHECK HERE for dhl awb number and other details for your

consignment as sent by your customer

Best Regards,

Thanks for choosing Dhl Express.

Warm R egards,

DHL EXPRESS…………………………………………………………… ………………… ……………..

CONFIDENTIALITY CAUTION: This message is intended only for
the use of the individual or entity to whom it is addressed
and may be confidential in nature. If you are not the intended recipient,
please notify us immediately by return e-mail and please do delete this message.
You should not disseminate, distribute, copy or disclose any information contained herein to any third party.
**Please consider the environment before printing this email**
anelo

As you can see this email message might appear real to some people who are expecting packages although it is filled with typos. However, the email was not actually sent from DHL. The email message is used to steal your email password and obtain your full name, address, and phone number.

Invalid delivery address scam

If you click the link provided in the email to track your package you will be sent to a website that tries to appear like a legitimate DHL website. The web page you will be directed to at first will ask you for your email address password and will tell you to log in to view your tracking information. You can essentially type in anything to bypass this page.

Invalid delivery address dhl email

The next page asks for the delivery address for your package. It wants you to input your full name, delivery address, phone number, and postal code. Again, you can essentially type in a fake address to bypass this page. It will then bring you to a page that says there was an error locating your tracking information and then will redirect you to the actual DHL website (DHL.com).

What to do if you fell for this scam


If you fell for this email scam it is recommended to change the password to your email address immediately. You do not want scammers to obtain access to your email account.

If you provided your full name, address, and phone number there is not much that you can do. You can however expect unwanted junk mail at the address provided and phone calls from telemarketers and scammers.

Sean Doyle

Sean Doyle is an engineer from Los Angeles, California. Sean's primary focuses include Cyber Security, Web Spam, and Online Marketing.