"Your parcel could not be delivered. Pay the 3.57 lei fee to rebook: [link]." The amount is so small it seems harmless. You're expecting something anyway, maybe from someone close to you in another country. You tap the link, fill in your card details, and only a few days later do you see charges on your statement that you never made.
What happened
If you live in Romania or receive parcels there, this one is for you. Romania's National Cyber Security Directorate (DNSC) has warned for years about text messages pretending to come from courier companies or the postal service. The versions keep changing, from a rebooking fee to choosing a parcel locker to a customs charge.
In 2026, a campaign using the name of a large courier company reached more than a million people in Romania, according to a cybersecurity firm. The fake page did more than ask for card details. It also stole the verification code for the victim's messaging app. With that code, the scammers took over the account and asked the victim's friends for money. The courier company said its own systems had not been breached.
DNSC's figures for 2025 show how much the problem has grown:
- 4,975 phishing incidents, 70.6% more than the year before;
- 3,937 frauds and attempted frauds, almost double the 2,061 of the year before;
- 1,125 compromised accounts, more than four times the 248 of the year before.
How it works, step by step
- You get a text saying your parcel is on hold and a small fee must be paid.
- The link leads to a site that looks almost identical to the real company's. The address is different, but easy to miss on a phone.
- The site asks for your card details, and sometimes for a code you received by SMS.
- With your card details, the scammers make payments. With the code, they take over your messaging account or confirm payments in your name.
One important point for parcels sent to Romania. Since 1 January 2026, parcels from outside the European Union worth under €150 carry a real fee of 25 lei. Scammers take advantage of this. Not every fee is fake, but you should only ever check a fee in the courier's official app or website, opened by you, never through the link.
What protects you
- Don't tap links in texts about parcels. Open the courier's app or website yourself and look up the parcel by its tracking number.
- Courier companies don't ask for card details by SMS for a few lei.
- Never enter a code you received by SMS from your bank or your messaging app on any website.
- Turn on bank notifications for every card payment. You'll see an unfamiliar payment straight away.
- If you've already entered your card details, call your bank and block the card. In Romania, report the text to DNSC on 1911.
Where a VPN helps and where it doesn't
To be direct, a VPN does not protect you from fake texts. This fraud leaves your connection alone and instead convinces you to hand over your details on a fake site. What protects you is the habit of opening the official app yourself instead of the link you were sent.
RoTunneling in short
RoTunneling VPN does a different job. It encrypts the connection between your device and our servers on any Wi-Fi, and our apps for Windows, macOS, Linux and Android also connect on restrictive networks that block VPNs. Your traffic leaves through a fast EU exit in Romania, our DNS protection stops malware, phishing and scam sites before they load and blocks some trackers, and we keep no browsing logs. We have been running since 2010, and if you need Romanian sites from abroad, you can also get a Romanian IP. For anything involving links and codes, the rules above are still your best defence. More at rotunneling.net.
Sources
- Digi24, on the DNSC report for 2025, August 2026 (in Romanian): https://www.digi24.ro/digieconomic/digital/atacurile-cibernetice-s-au-inmultit-in-2025-dnsc-incidentele-de-compromitere-a-conturilor-au-crescut-cu-353-114743
- Alba24, 9 September 2026 (in Romanian): https://alba24.ro/frauda-cu-sms-uri-despre-colete-peste-un-milion-de-romani-au-primit-mesaje-false-cum-recunosti-capcana-1157173.html
- DNSC, security alerts: https://dnsc.ro
