The "pay R50 to release your parcel" text targeting Temu, Shein and Takealot shoppers.
Home / Scam guides / Courier & delivery
The fake "pay a small delivery fee" SMS is one of the most common scams hitting South African online shoppers. Here's what the real messages look like, the tricks scammers use, and how to check before you pay.
Published 21 May 2026 · Last reviewed 21 May 2026
Typical ask A small "customs" or "redelivery" fee, usually R20 to R200
Main targets Temu, Shein, AliExpress and Takealot shoppers expecting a parcel
The giveaway A payment link to a domain that isn't the courier's real website
Golden rule Real couriers don't collect card details by SMS link
If you shop on Temu, Shein, AliExpress or Takealot, you’ve probably received one: a text saying your parcel is being held until you pay a small delivery or customs fee. It looks routine. The amount is tiny. There’s a convenient link to pay. And that’s exactly why it works.
This is one of the most common scams in South Africa right now, and it has surged alongside the boom in cheap international online shopping. Here’s how to recognise it, what the genuine version actually looks like, and how to check any courier message before you act on it.
The fake delivery-fee SMS is effective because every part of it is plausible.
If you’ve ordered something from overseas, you genuinely might owe import VAT or a customs charge, so a request for a small fee doesn’t immediately feel wrong. The amount is kept deliberately low, usually somewhere between R20 and R200, because a small number doesn’t trigger the same scrutiny a large one would. And the message arrives exactly when you’re expecting a parcel, so the timing feels legitimate.
Scammers rely on you being busy and slightly impatient. You’re expecting a delivery, you don’t want it delayed, the fee is trivial, so you tap the link and pay without thinking twice. The whole design of the scam is to get you to act before you scrutinise.
Here’s a representative example of the kind of message that circulates, impersonating a real South African courier:
Buffalo Logistics: Your R49.99 payment was not processed successfully. Kindly complete payment immediately. https://bufflo-exp.com/Elq5f
Read that again and notice what’s doing the work. The brand name is close to a real courier. The amount is small and specific. There’s manufactured urgency (“immediately”). And there’s a link that looks vaguely official but points to a domain that has nothing to do with the real company.
The most important detail is the link. Scammers can copy a courier’s name, logo, tone and message format perfectly. What they cannot do is send you to the courier’s real website, because they don’t control it. So they register a lookalike domain instead.
This is the heart of almost every courier scam: a web address designed to look like the real one at a glance, but subtly wrong.
A real courier might use a domain like buffaloex.co.za. A scammer will register something like:
What it looks likeWhat it actually isLooks like the courier’s sitebuff4lo-paynow.xyzLooks official enoughbufflo-exp.comLooks like a tracking pagebuffalo-customs-pay.online
The tricks are always the same: a letter swapped for a number (the “4” standing in for an “a”), an extra word bolted on like “pay” or “customs”, or an unusual ending like .xyz, .top, .online or .icu instead of the .co.za or .com a South African company would normally use.
Under pressure, scanning quickly on a small phone screen, almost nobody notices. That’s the entire point.
You don’t need to be technical to spot these. Run through this list whenever a courier message asks you to pay or click:
If even one of these is present, treat the message as a scam until you’ve verified otherwise.
Knowing the genuine version is just as useful as knowing the fake one.
A legitimate courier communication will point you to the company’s real, official website, one you can verify by typing the address yourself or searching for the company independently. It won’t demand your card details directly inside an SMS. It will give you a tracking number you can check on the courier’s own site or on the retailer’s order page. And it won’t manufacture panic over a small amount.
The safest habit: ignore the link entirely. If you’re genuinely expecting a parcel and think there might be a real fee, don’t tap anything in the message. Instead, go to the courier’s official website directly, or open your order on the retailer’s app, and check the status there. If there’s a real charge, you’ll find it through the front door, and you’ll never need the link the scammer sent.
If you entered card details on one of these fake pages, act quickly. Speed matters more than anything else:
Being scammed isn’t a sign of carelessness. These messages are engineered to catch busy, reasonable people in an unguarded moment. The useful response is fast action, not self-blame.
The reason this scam keeps working is that checking a link properly (expanding shortened URLs, comparing against the real courier domain, checking how recently the domain was registered) is genuinely hard to do by eye on a phone.
That’s the exact problem Verifyd was built for. Paste the suspicious SMS in, and it expands the link, compares it against verified South African courier identifiers, checks the domain’s age and reputation, and gives you a clear verdict (safe, caution, or scam) with plain-language reasoning for what it found. No guessing, no squinting at a tiny URL.
When a courier message lands and something feels off, you don’t have to make the call alone.
01 Is a courier delivery-fee SMS always a scam? Not always. Import VAT and customs charges on international parcels are real, and some couriers do collect them. But a legitimate charge can almost always be paid through the courier's official website or app, which you reach by typing the address yourself. The scam is the link in the SMS, not the idea of a fee. If you can't verify the fee on the courier's official site, treat the message as a scam.
02 How much do these scams usually ask for? Deliberately small amounts, typically R20 to R200. The amount is kept low so it feels plausible and not worth questioning. The goal usually isn't the fee itself; it's capturing your card details on the fake payment page so the scammers can make much larger charges later.
03 I clicked the link but didn't enter card details. Am I in trouble? Clicking alone is far less dangerous than entering details. If you didn't type any card or banking information, you're most likely fine, but watch for follow-up scam messages, since clicking can mark your number as "active." If you did enter card details, contact your bank immediately to freeze the card and dispute any charges.
04 How can I tell a real Buffalo / DHL / Aramex message from a fake one? Check the link destination, not the wording. Scammers copy the wording and branding of real couriers exactly. What they can't fake is the real domain. If the link points anywhere other than the courier's genuine website, it's a scam. When unsure, ignore the link entirely and track your parcel by going to the courier's official site directly or using the tracking number on the retailer's order page.
05 What should I do if I think I've been scammed? Contact your bank's fraud line immediately to freeze the card and reverse any transactions. Change any passwords you may have entered. Report the incident to SAPS. Keep screenshots of the message and the fake site as evidence. And going forward, you can paste suspicious courier messages into Verifyd to check them before acting.
##
Got a message like this? Check it first.
Paste the SMS, email or WhatsApp into Verifyd and get a clear
verdict in seconds, with plain-language reasoning for exactly
what we found.
Get the app More scam guides
Other Trending scams in South Africa Banking Fake bank fraud calls & SMS