This article discusses a scam that impersonates Aramex. Neither Aramex nor its services are involved in the scam. All brand names are trademarks of their respective owners. 

That Aramex customs fee text is a scam 

A text arrives saying your Aramex parcel is held at customs. The fee is small, 12 AED in the UAE or AUD 1.71 in Australia. There’s a shipment number, a deadline, and a link. Tapping it opens what looks like Aramex’s tracking page. No parcel exists, and no fee is owed. Here’s how this scam runs across the UAE, Australia, and New Zealand, and the details that give it away. 

How the scam works 

1. A delivery text arrives with a shipment number and a deadline 

The message comes by SMS or iMessage and reads like a real courier notice. Some versions say a shipment is held at customs pending a clearance fee. Others say delivery failed because your address is missing a house number, or that a parcel is sitting at a warehouse waiting for an update. 

The details are what make it work. Scammers cite real-looking shipment numbers and name a fee small enough to feel routine, usually 9.99 to 15 AED in the UAE or AUD 1.71 in Australia. Then they add a deadline and a consequence: a second-delivery charge, no liability for valuable contents, or return to sender at your cost. 

Sender names are often close misspellings of the real brand. “Arramex,” “Armex,” and “Aramx” read as the real brand at a glance. Many iMessage versions come from foreign numbers, including +212 numbers. 

2. A reply prompt makes the link tappable 

Phones hide links from unknown senders, so the scam works around it. The message tells you to reply “Y” on iMessage or “1” on SMS, then reopen the message or switch to Safari before the link becomes active. 

That reply does something else too. It tells the scammers your number is live and monitored, which usually means more scam texts and calls. 

3. A cloned tracking page collects your card details, then your passcode 

The link runs through a shortener or a lookalike domain. TrendLife has seen did[.]li, choto[.]co, armx[.]me, techodion[.]online, and aramexexpress[.]top used across these campaigns. 

The page it opens closely mirrors Aramex’s real tracking experience and is built for mobile, where the address bar shows only a fraction of the URL. It confirms your shipment details, asks you to update your delivery information, then requests your cardholder name, card number, expiry date, and CVV as the final step. 

The more advanced versions in Australia and New Zealand (ANZ) add one more page asking for the one-time passcode your bank just sent. Entering it lets the scammers approve a transaction in real time, while you’re still on the page. 

Red flags 

You’ve got this. Here’s what to watch for. 

1. Reply-to-unlock instructions: Real couriers never ask you to reply “Y” or “1” before a link will work. 
   
   
2. A sender name that’s one letter off: A single doubled or missing letter reads as the real brand at a glance. 
   
   
3. A shortened or unfamiliar link: Aramex uses aramex.com. Short links and Aramex-flavored lookalike domains are not the same thing. 
   
   
4. A very small fee: The amounts are picked to sit below the level where you’d stop and question them. 
   
   
5. A generic greeting: “Dear Customer” or “Dear client” instead of your name. 
   
   
6. A countdown with consequences: Fixed deadlines paired with extra charges or return-to-sender threats are pressure tactics, not courier policy. 
   
   
7. A card form on a tracking page: Couriers don’t collect full card numbers and CVV codes to release a parcel. 

How to stay safe 

1. Check the tracking number yourself. Enter it directly on aramex.com. 
   
   
2. Ignore the message instead of replying. Even a single “Y” or “1” confirms your number is active. 
   
   
3. Confirm you’re actually expecting a parcel. If nothing is on its way, it’s fake. 
   
   
4. Call your bank right away if you entered card details. Freeze the card and dispute the charges. Same for a passcode. 
   
   
5. Report the message. Australia: Scamwatch. New Zealand: Netsafe. UAE: the Ministry of Interior, Dubai Police eCrime, or Aman in Abu Dhabi. US: ReportFraud.ftc.gov. Forwarding the text to 7726 also works in Australia, New Zealand, and the US. 
   
   
6. Add scam detection to your phone. Trend Micro ScamCheck flags suspicious links before you tap. 

The takeaway 

This scam is built to look ordinary. The logistics wording, the shipment number, the tiny fee, and the mobile page that mirrors the real one all work together, and even careful people encounter it. But now you know the tells: the reply prompt, the misspelled sender, the short link, and the card form that no courier would ever show you. Take your time to verify, and trust your instincts when a delivery notice starts asking for money.