Fake Parcel Delivery Texts: The UK Smishing Scam to Know

ROYAL MAIL: Your parcel is waiting for delivery. Please confirm your address and pay the £1.99 redelivery fee at the link below. It looks routine — and if you are expecting a parcel, it feels urgent. This is the fake delivery text, the most widespread smishing scam in the United Kingdom, impersonating Royal Mail, DPD, Evri, Amazon and others. Millions of these texts circulate, and the links lead to convincing fakes that harvest personal and card details.

The script, step by step

Delivery smishing follows a well-tested formula:

1. The hook. A text about a missed delivery, an unpaid fee, a failed address check or a parcel held at the depot. It arrives out of the blue or — worse — while you genuinely wait for a package.
2. The link. A shortened or lookalike web address that resembles the courier's site at a glance but belongs to the scammer.
3. The harvest. The fake site asks for your name, address, date of birth and then card details to pay a small fee. Some versions then request a one-time passcode, which the criminals use immediately for larger purchases.
4. The follow-up. Days later the stolen card details fund fraud, or the victim gets a call from a fake bank fraud team completing the theft.

The small fee is deliberate: it feels too trivial to be a scam, and it gives the criminals a convincing reason to ask for your full card details.

Why the courier names feel so convincing

Scammers impersonate the delivery brands Britain trusts most — Royal Mail, DPD, Evri, Amazon, DHL and others — copying logos, colours and tracking-page layouts with professional polish. Texts can arrive in the same thread as genuine courier messages, because scammers spoof the sender name. Around Christmas, Black Friday and January sales, parcel volumes surge and a delivery text barely raises an eyebrow.

Remember what the real firms do: Royal Mail does charge certain fees, but it does not demand them through unexpected text links with card re-entry, and couriers do not ask for one-time passcodes to release parcels. When in doubt, treat the link as hostile.

Red flags to memorise

• An unexpected text with a link, especially about fees, redelivery or address problems.
• Urgency and threats: act now or your parcel will be returned or destroyed.
• A sender you cannot verify: sender names are easily spoofed, so Royal Mail on the screen proves nothing.
• Requests for card details or passcodes to release an ordinary parcel.
• Odd web addresses: misspellings, extra words, strange endings, or shortened links hiding the destination.
• Sloppy details: wrong branding, American spellings, or a fee in the wrong format.

What to do instead of tapping

The safe routine takes seconds:

1. Do not tap the link. Do not reply, and do not call any number in the text.
2. Check tracking independently. Open the retailer's or courier's official app, or type the courier's web address into your browser yourself and enter your tracking number there.
3. Ask the sender. If you ordered something, the retailer's order page shows the real delivery status.
4. Forward the text to 7726, then delete it and block the sender.
5. If you are unsure about a genuine-looking fee, call the courier on its published customer-service number.

If the parcel is real, it will still be there when you check through official channels. Scammers rely on you skipping this step.

If you already entered details

Act fast — smishing victims often have a short window before the stolen data is used:

1. Call your bank on the number on your card. Ask about freezing, chargebacks and reissuing your card.
2. Change passwords for any accounts whose details you entered, starting with email, and enable two-factor authentication.
3. Check your statements closely for small test payments followed by larger ones.
4. Report to Report Fraud at reportfraud.police.uk or on 0300 123 2040 — in Scotland, Police Scotland on 101.
5. Warn your household: smishing texts often target several numbers at the same address.

Make delivery texts boring again

Switch on spam protection in your messaging app so most smishing never reaches your inbox, keep deliveries tracked through official apps rather than text links, and talk the routine through with older relatives — the fake Royal Mail text is many people's first encounter with serious fraud. A filtering layer such as NoCall adds one more net for unknown senders. Delivery smishing works on volume and haste; a ten-second independent check breaks the whole business model.