A suspicious package in an Australian workplace is rarely a hoax dressed in obvious wires and a flashing light. Far more often, it is an unexpected envelope addressed to a senior staff member, a parcel left near a reception desk with no return address, or a Tyvek courier bag that arrived without paperwork. The decisions made by the person who first notices it, in the first sixty seconds, shape whether the incident ends in a quiet police response or in a building evacuation.

This guide focuses on recognition and immediate response: what to look for, what to do, and what not to do. For the full bomb threat procedure including delivery-channel handling (phoned, written, email, in-person) and the AFP 4 Cs framework, see our complete bomb threat procedures guide. For broader Australian threat context, see our risk and threat preparedness guide.

Why this is an Australian workplace issue, not a Hollywood one

Most Australians associate “suspicious package” with overseas news footage. The reality is closer to home. Australian workplaces in government, legal, media, financial services and crowded retail environments have all received suspicious mail and unattended items in the last decade. In January 2019, packages containing suspicious substances were sent to multiple foreign consulates in Melbourne and Canberra, requiring multi-agency hazmat response. Mail-targeted incidents against politicians, judges, journalists and corporate executives occur regularly enough that the Australian Federal Police maintains specific mail-handling guidance and the National Security Hotline (1800 123 400) is a recognised reporting channel.

Australia’s current National Terrorism Threat Advisory level is PROBABLE, raised by ASIO from “Possible” in August 2024 and maintained since. That elevated baseline does not mean an attack is imminent at any specific workplace. It does mean that suspicious-package recognition is no longer an “extra” component of workplace emergency planning. It is a baseline capability every Australian organisation should equip its front-of-house and mail-handling staff to deliver.

For the underlying training framework, see our bomb and hazardous substance threat training service.

What makes a package suspicious

A suspicious package is any item that should not be where it is, or whose appearance, characteristics or context cannot be readily explained. AS 3745:2010 Appendix B treats suspect items as a distinct category requiring specific response, separate from a phoned bomb threat. The AFP and state police share a consistent set of recognition cues, which fall into three groups.

Visual indicators

• Unexpected delivery. No matching purchase order, no expected courier, no named sender, or a return address that appears fabricated or inconsistent
• Excessive wrapping or sealing. Multiple layers of tape, unusual binding, or attempts to disguise contents
• Visible powder, residue or staining on the exterior of the package
• Protruding wires, batteries, switches or unfamiliar electronic components
• Holes, soft spots, or unusual rigidity suggesting a hidden device
• Excessive or unusual postage (many small-denomination stamps, hand-cancelled when normal post would be machine-cancelled, or international postage on a domestic-looking item)
• Misspelled words, addressing errors, or fictitious addressing (addressed to a title rather than a named individual, or to a person who has not worked at that address for years)

Sensory indicators

• Unusual smell. Chemical, almond-like, marzipan, ammonia, solvent or other unfamiliar odour
• Audible mechanism. Ticking, buzzing, sloshing or grinding sounds
• Unusual weight for size. Heavier, lighter or differently balanced than expected
• Greasy or oily exterior that may indicate leaking substance

Contextual indicators

• Recipient profile. Packages addressed to politicians, judges, journalists, executives, controversial public figures, or organisations recently in the news
• Timing. Arrival coinciding with public statements, court decisions, controversial reporting or anniversaries of relevant events
• Lack of explanation. Items left in public-access areas with no owner, no tag and no business justification
• Discrepancy between sender and content claim. A package claiming to be a routine business delivery but lacking the supporting paperwork or courier identification

A package does not need to display multiple indicators to warrant a cautious response. A single significant indicator, particularly in combination with an unusual recipient or timing, is enough to apply the procedure below.

The immediate response: the first 60 seconds

If you have identified a package as suspicious, the next sixty seconds matter more than the next sixty minutes. The procedure below is consistent with AS 3745:2010 Appendix B, AFP guidance and First 5 Minutes’ Warden Handbook used across Australian facilities.

1. Stop interacting with the item

Do not touch it. Do not open it further if partially opened. Do not move it. Do not turn it over. Do not shake it. Do not smell it. Do not place it on another surface “to be safe”. This contradicts older advice but is the current AFP position: any movement of a suspect item changes the risk profile and contaminates the scene for police forensic work.

2. Move yourself and others away

Move calmly away from the immediate vicinity. Direct nearby colleagues away without touching them and without causing a crowd to gather around the item. The objective is to reduce the number of people exposed, not to alert as many as possible.

3. Maintain a 25-metre electronic exclusion zone

Do not use mobile phones, two-way radios, or any electronic equipment within 25 metres of the suspect item. Radio frequencies can potentially trigger certain electronic detonation mechanisms. This rule applies to staff approaching the area as well, not just those already adjacent to it. Move to a safe distance, then make any required calls.

4. Notify the Chief Warden and call 000

From a safe distance, alert the Chief Warden through your facility’s internal communication channel. Call Triple Zero (000) and report: the location of the item, what makes it suspicious, who has been in the vicinity, and whether the item has been touched or opened. Police take operational control of the suspect-item response on arrival.

5. Isolate the area

Prevent further entry to the area until police arrive. If the item is in a public-access area, redirect occupants away through alternative routes. The Chief Warden, in consultation with police, will decide whether to evacuate the building, evacuate part of the building, lockdown the building, or maintain a localised cordon. See our emergency evacuation procedures by emergency type for how this decision differs from a fire evacuation.

6. Record what you can

While the response is underway, document what you saw before further contamination changes the scene: the appearance of the package, where exactly it was, what time you noticed it, who else was in the vicinity, any unusual activity in the lead-up. Police will ask. Memory degrades fast under stress, and written notes made immediately are far more accurate than recollections an hour later.

For the full bomb threat procedure including the AFP 4 Cs framework (Confirm, Clear, Cordon, Control), see our complete bomb threat procedures guide.

When the package has already been opened

A package that has been opened before its suspicious nature was recognised changes the response. The priority shifts from preventing exposure to managing exposure that may have already occurred.

• Stop further contact immediately. Do not continue examining the contents.
• Treat any visible powder, liquid, vapour or unfamiliar material as potentially hazardous.
• Do not shake clothing, brush off material, or move through the building. This spreads contamination.
• Move calmly to an isolated area where the person who opened the package can be assessed.
• Wash hands and exposed skin with cool soapy water if facilities are immediately accessible. Do not use hot water (which can open pores) or alcohol-based cleansers (which can absorb some substances).
• Note everyone who was in the room when the package was opened, and how long each person was exposed. Police and hazmat will need this list.
• Do not eat, drink, smoke or apply cosmetics until cleared by emergency services.
• Call 000. Triple Zero coordinates the police, fire and ambulance response. State that a suspicious package has been opened, what the contents appeared to be, and whether anyone is showing symptoms.

If anyone is showing symptoms (difficulty breathing, skin irritation, eye irritation, dizziness, nausea), this becomes a medical emergency in parallel with the security response. State this clearly to the Triple Zero operator. Fire and Rescue Hazmat units, supported by Ambulance, will coordinate decontamination on arrival.

The mail room and reception: where most suspicious items first appear

In most Australian workplaces, suspicious items first appear in one of two places: the mail room, or the reception desk. These two areas warrant specific procedural attention.

Mail room

Mail rooms benefit from a documented screening procedure. Best practice covers:

• Defined receipt area physically separated from the rest of the building, ideally with limited ventilation connection to other spaces
• Trained staff with role-specific suspicious-package recognition training
• A visual screening checklist at the workstation listing the recognition cues from this guide
• Personal protective equipment available for handling questionable items (gloves at minimum)
• A defined escalation pathway to the Chief Warden, security or facility manager
• No further distribution of any item flagged for screening until it has been cleared
• Annual refresher training at minimum, with documented attendance

Reception

Reception staff are typically the first to handle hand-delivered packages, walk-in deliveries from unknown couriers, and any “envelope dropped off for the CEO”. They benefit from:

• Suspicious-package recognition as part of induction and annual refreshers
• A clear non-confrontational protocol for handling unexpected hand deliveries: take the item to a designated holding area, do not accept it at the front desk if the sender cannot identify themselves and the recipient
• A discreet alert mechanism to summon security or the Chief Warden without alarming the person who delivered the item, if they are still present
• A panic-alarm or duress arrangement for situations where the delivery is accompanied by threatening behaviour

For broader training in these roles, see our bomb and hazardous substance threat training and threat preparedness training.

Common mistakes we see in Australian workplaces

From more than 30 years of delivering threat preparedness training to Australian organisations, these are the recurring mistakes we encounter in workplaces that thought they were prepared:

• The mail room screens for explosives, not for substances. White powder, liquid, vapour and biological material are far more common in Australian incidents than improvised devices.
• Reception has no protocol for hand-delivered items. The “envelope for the CEO” is taken to the executive floor by the receptionist, in a lift, without screening.
• Staff use mobile phones to photograph the package. Radio frequencies within 25 metres of a suspect item are exactly what the procedure forbids.
• The package is “moved to a safe area” before authorities are contacted. This is older guidance and is no longer current AFP practice. Do not move suspect items.
• The Chief Warden has not been told. A staff member calls 000 directly without alerting the ECO, leaving the Chief Warden uninformed when police arrive.
• The 25-metre rule is not enforced. Curious colleagues approach the package “to have a look” while the response is underway.
• No post-incident debrief. Even when the response works, the lessons are not captured into the emergency plan.

After the incident: what happens next

A suspicious-package response does not end when police give the all-clear. The post-incident phase matters for compliance, learning and welfare.

• Wait for the police all-clear before re-occupying the affected area. Do not assume the absence of an explosion or visible incident means the scene is safe.
• Capture the staff statements while memories are fresh. Police will require statements from the person who identified the item, the Chief Warden, the Communications Officer and anyone in the vicinity.
• Provide psychological first aid and EAP access to staff who were directly involved. Suspicious-package incidents are stressful even when they resolve as hoaxes.
• Debrief within 24 to 72 hours with the ECO and facility management. Capture lessons.
• Update the emergency plan with anything the incident exposed.
• Notify under WHS Regulations if applicable. Recent (2025) model WHS amendments extended notification duties for certain violent incidents, with jurisdiction-specific adoption.
• Brief staff on the outcome once police have cleared the incident. Avoid speculation. Accurate, calm communication after the event reduces lingering anxiety.

Build the capability before you need it

The difference between a workplace that handles a suspicious package well and one that does not is rarely intelligence or instinct. It is preparation. Trained staff, a documented procedure, defined escalation pathways and regular exercises turn a high-stress moment into a procedural one.

First 5 Minutes has been delivering AS 3745-compliant threat preparedness training to Australian organisations for more than 30 years, with the largest Emergency Control Organisation training team in the country. Our bomb and hazardous substance threat training covers recognition, mail-room procedure, reception protocol and the immediate response sequence. For broader threat preparedness covering active threat, lockdown and personal threat scenarios, see our threat preparedness training.

Contact our team on 1300 321 120 to discuss suspicious-package preparedness for your facility.

Frequently Asked Questions

What is a suspicious package?
A suspicious package is any item that should not be where it is, or whose appearance, characteristics or context cannot be readily explained. Common indicators include unexpected delivery without paperwork, excessive wrapping, visible powder or residue, protruding wires, unusual weight or smell, fictitious or unusual addressing, and recipients who are public figures or in the news. A single significant indicator can be enough to apply the procedure, particularly when combined with an unusual recipient or timing.

Why can’t you use a mobile phone near a suspicious package?
Radio frequencies, including those from mobile phones and two-way radios, can potentially trigger certain electronic detonation mechanisms. Both AS 3745:2010 and AFP guidance call for a 25-metre electronic equipment exclusion zone around suspect items. Move to a safe distance before making any calls.

Should you move a suspicious package to a safer location?
No. Current AFP guidance is do not touch, do not move, do not turn over, do not shake. Older advice to “place the item on a flat surface” is no longer current. Any movement changes the risk profile and contaminates the scene for police forensic work. Move yourself away, not the package.

Does AS 3745:2010 cover suspicious packages?
Yes. AS 3745:2010 Appendix B specifically addresses suspect items as a distinct category requiring specific response, separate from a phoned bomb threat. The standard’s procedure is built on the AFP 4 Cs framework: Confirm, Clear, Cordon, Control. For the full procedure, see our complete bomb threat procedures guide.

What’s the difference between a suspicious package and a bomb threat?
A bomb threat is a communication (phone call, letter, email or in-person) indicating an explosive device may be present. A suspicious package is a physical item that has been identified as a possible threat. The two often occur separately. A bomb threat may not be followed by a real device; a suspicious package may appear without any prior threat communication. The procedures overlap but begin from different triggers.

What should mail-room staff do if they suspect a package is dangerous?
Stop handling the item. Do not open it further. Move it to a designated screening area only if your facility has a documented procedure that includes this step. If in doubt, leave the item where it is, move away, maintain the 25-metre electronic exclusion zone, and alert the Chief Warden. Call 000 if there is visible hazardous material, indication of exposure, or any symptoms.

Who do you call when you find a suspicious package?
Call Triple Zero (000) for any immediate threat. For suspicious activity that does not require immediate police response (a suspect item already secured, unusual surveillance activity, suspicious behaviour reported after the fact), call the National Security Hotline on 1800 123 400. The hotline operates 24 hours and accepts anonymous information.

What happens when police arrive?
The Chief Warden briefs the senior police officer on arrival, providing the location of the item, the appearance and characteristics, when it was identified, who has been in the vicinity, what actions have already been taken, and the current status of the building. Police take operational control. Depending on the assessment, police may use the Australian Bomb Data Centre or local Explosive Ordnance Disposal units. The Chief Warden and ECO follow police direction from that point.

What if the package has already been opened?
Stop further contact immediately. Treat any visible powder, liquid or vapour as potentially hazardous. Do not shake clothing or brush off material. Move calmly to an isolated area. Note everyone who was in the room and the duration of their presence. Wash hands and exposed skin with cool soapy water if accessible. Do not eat, drink or smoke. Call 000. Fire and Rescue Hazmat will coordinate decontamination on arrival.

Are suspicious package incidents common in Australia?
More than most workplaces realise. Mail-targeted incidents against politicians, judges, journalists, corporate executives and government agencies occur regularly in Australia. The January 2019 Melbourne and Canberra foreign-consulate incidents involved multiple suspicious-substance packages requiring hazmat response. While the absolute number is low compared to fires, the consequences of an unprepared response are disproportionately serious.

How often should mail-room and reception staff be retrained?
Best practice is annual refresher training for these high-risk roles, with documented attendance. AS 3745:2010 requires Emergency Control Organisation skills retention at intervals no greater than six months for designated wardens. Mail-room and reception staff who are not formal ECO members should still receive at least annual refreshers given their elevated exposure profile.

What should you do after the incident is over?
Wait for the police all-clear before re-occupying the area. Capture statements from staff while memories are fresh. Provide psychological first aid and EAP access to those directly involved. Debrief with the ECO and facility management within 24 to 72 hours. Update the emergency plan with lessons learned. Notify under WHS Regulations where applicable. Brief staff on the outcome to reduce lingering anxiety.