Dodgy DHL email doing the rounds
A fake DHL delivery email is circulating across NZ, using the subject "Delivery Notification , Action Required" to pressure you into clicking and handing over information.
You could receive an email with the subject "Delivery Notification , Action Required", appearing to relate to a DHL Express delivery on hold. It presents itself as a shipment notice and tells you there is a problem with your address or customs information, pushing you to take action quickly so the parcel can be released.
What gives it away is that the email does not properly prove who sent it. Although one technical signature passed, the wider checks your mail system uses to confirm the sender failed or were missing, which means the message cannot be trusted as genuine DHL correspondence. The sending domain, back.auto4.lt, also has no established reputation as a legitimate DHL sender, which is a strong red flag for impersonation.
The attacker is trying to get you to click, reply, or hand over details by exploiting the urgency of a delayed parcel. If you engage, you could be led to a fake page, asked for business or personal information, or exposed to follow-on credential theft and account compromise.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Verify any delivery issue directly through DHL's official website or your known courier contact, not through links or reply options in the email.
- Do not: Click links, open attachments, or reply to delivery emails that create urgency but cannot clearly prove who sent them.
- Check: Review whether similar parcel-themed emails reached other staff, especially shared inboxes like accounts, reception, or dispatch.
- Report: Mark the message as phishing in your mail platform and escalate it to your IT provider or security team for review.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine DHL message looks like, the real sender domain, the real link destination, and where to report a fake.