Skip to content
Scammers.com
Toll & delivery text (smishing)Reviewed

Fake Aramex customs-fee texts lead to card and OTP theft pages such as armx.me, says Trend Micro

On 26 October 2026 Trend Micro's TrendLife blog described an SMS and iMessage scam impersonating courier Aramex in the UAE, Australia and New Zealand. Texts claim a parcel is held at customs or delivery failed and dem…

First reported
Reports
1

Source: trendlife.com · published

Illustration: Phishing, texts and email scams

What happened

On 26 October 2026 Trend Micro's TrendLife blog described an SMS and iMessage scam impersonating courier Aramex in the UAE, Australia and New Zealand. Texts claim a parcel is held at customs or delivery failed and demand a small fee, usually 9.99 to 15 AED in the UAE or AUD 1.71 in Australia, with a deadline. Sender names are misspellings such as 'Arramex', 'Armex' and 'Aramx', and many iMessage versions come from foreign numbers including +212 numbers. Recipients are told to reply 'Y' or '1' so the link becomes clickable, which also confirms the number is live. Links run through URL shorteners (did.li and choto.co) or lookalike domains; TrendLife says it has seen armx.me, techodion.online and aramexexpress.top used in these campaigns. The cloned tracking page asks for cardholder name, card number, expiry date and CVV, and more advanced versions in Australia and New Zealand also ask for the one-time passcode sent by the bank, letting scammers approve a transaction in real time. TrendLife says Aramex is not involved in the scam; the genuine site is aramex.com.

How the scam works

TrendLife says the texts arrive by SMS or iMessage and read like courier notices: a shipment is held at customs, delivery failed because of a missing house number, or a parcel is waiting at a warehouse. Each cites a shipment number and a deadline, and warns of a second-delivery charge or return to sender.

The reply prompt is there because phones often disable links from unknown senders. Replying 'Y' or '1' makes the link tappable, and also tells the scammers the number is live. The link opens a page built to mirror Aramex's tracking page on mobile, where only part of the address is visible. It asks for the cardholder's name, number, expiry date and CVV and, in some versions, the bank's one-time passcode.

Aramex and its services are not involved. TrendLife says the real site is aramex.com and that the fee is small so that it feels routine. Its advice is to ignore the message and track the parcel yourself.

Source

TrendLife (Trend Micro), "How a small Aramex “delivery fee” text ends with your card details stolen" (26 October 2026).

Red flags

  • A text about an Aramex parcel you aren't expecting.
  • A sender name one letter off, such as 'Arramex', 'Armex' or 'Aramx'.
  • A prompt to reply 'Y' or '1' to make the link work.
  • A shortened or lookalike link, such as armx.me, rather than aramex.com.
  • A tiny fee, a deadline and a threat of return to sender.
  • A page asking for full card details, CVV or a bank passcode.

If you were targeted

  1. 1Don't reply to the text or tap its link; even a one-letter reply confirms your number is active.
  2. 2Track parcels only by entering the number on aramex.com.
  3. 3If you entered card details, call your bank to freeze the card and dispute charges.
  4. 4If you entered a one-time passcode, tell your bank immediately.
  5. 5Report the message through your national scam channel; forwarding to 7726 works in Australia, New Zealand and the US.
ReportFraud.ftc.gov FBI IC3 More resources
Fake Aramex customs-fee texts lead to card and OTP theft…