Parcel on hold? The fake Royal Mail text and other delivery scams

Parcel on hold? The fake Royal Mail text and other delivery scams

"Royal Mail: your parcel could not be delivered due to an unpaid shipping fee. Pay £1.99 here to rearrange delivery." Plus a link. This text, sent in the name of Royal Mail, Evri, DPD, Yodel, DHL or UPS depending on the wave, is one of the most persistent scam texts in the UK. It works because almost everyone shops online and almost everyone has a parcel on the way at some point: the message lands on fertile ground.

The amount is deliberately tiny. The goal was never to collect those couple of pounds: it's to get you to enter your full card details on a fake website imitating the delivery company, and sometimes also the security code your bank sends you afterwards, so they can make much bigger payments.

Why it works even when you're not expecting a parcel

The scammers don't know whether you're waiting for an order. They don't need to:

• Volume. They send the same text to thousands of numbers. With so much shopping done online, a large share of recipients really do have something on the way, or had one recently, so the message fits.
• A negligible amount. A pound or two doesn't set alarm bells ringing. Nobody "checks" a £1.99 payment the way they'd check a £300 one.
• Urgency and zero friction. "Pay now and get it tomorrow" pushes you to sort it out on the spot, from your phone, without stopping to look at the sender or the domain.
• A rotating disguise. When people get wise to one brand (they start warning that "that Royal Mail text is fake"), the campaign switches to another courier. The skeleton is always the same as the fake DVLA vehicle-tax text: well-known organisation + something pending + urgency + payment link.

How to spot the fake text

None of these signs is conclusive on its own, but together they make a fairly reliable diagnosis:

• It asks you to pay a fee through a link. Even if a fee were genuinely due, you'd never need the link in an unexpected text to pay it: a real charge will show up when you go to the courier's official website or app yourself.
• The link isn't the official domain. Domains with extra hyphens or words ("royalmail-redelivery", "evri-parcel-fee", "dpd-tracking-uk") or odd endings. On a phone screen, in a hurry, they slip through; look calmly and they stand out.
• There's no real tracking number. The fake text talks about "your parcel" in general terms because it doesn't know which one it is. A genuine notice includes the tracking number, and that number matches the one the shop gave you.
• A sender that varies. Sometimes any old mobile number, sometimes a name imitating the company. The sender of a text can be faked: it proves nothing.
• Clumsy writing. Awkward translations, odd capital letters, exaggerated urgency ("final notice before your parcel is returned to the sender"). Real companies write better than this.

How to check a real delivery

The method is always the same, and it works for any company:

1. Don't tap the link in the text. Close it.
2. Open the official channel yourself: the app of the shop you bought from, the order confirmation email, or the courier's official website, typing the address in yourself.
3. Enter your tracking number there. If there's a genuine problem (a customs charge, an incomplete address, a missed delivery), it will show up in the official tracking. If nothing shows up, the text was fake.

This sequence (close the message, go to the official channel yourself) is the same one we recommend for checking a call or text from your bank and a message from HMRC or the DWP (see our step-by-step guides). It's the habit that stops the most fraud at the root.

What to do if you've already entered your card details

• Call your bank now, explain what happened and ask them to block the card and send you a new one. That's the step that stops the problem in its tracks.
• If you also entered a security code you received by text, tell the bank that too: a payment may already have been authorised.
• Keep an eye on your statements over the following weeks and turn on transaction alerts in your banking app. Fraudulent payments don't always appear straight away.
• Report it with screenshots of the text and the link: to Report Fraud (formerly Action Fraud) on 0300 123 2040 in England, Wales and Northern Ireland, or to Police Scotland on 101. For advice, contact the Citizens Advice consumer service (in Scotland, Advice Direct Scotland; in Northern Ireland, Consumerline).
• Forward the text to 7726, free on most networks, so your provider can investigate and block the sender (how to report a scam text), and report the sender's number in the spam numbers directory.

Quick questions

What if I am expecting a parcel and the text matches? The coincidence proves nothing: with so many orders in circulation, hitting the mark by chance is easy. Always check through the official channel with your tracking number. It takes a minute and removes all doubt.

Do couriers send genuine texts? Yes, many send delivery updates or missed-delivery notices. A genuine notice gives your tracking number, doesn't rush you with threats of immediate return, and anything it tells you can be checked by going to the courier's official app or website yourself. If a text asks for money, don't use its link: check through the official channel first.

Does the same thing happen on WhatsApp or by email? Yes, the same bait circulates on WhatsApp, by email and even through QR codes on fake stickers. The channel changes; the defence doesn't: never pay through a link you've been sent, always check through the official channel yourself. Scam emails can be forwarded to [email protected], as GOV.UK explains.

If you've received one of these messages, report it in NoCall's spam numbers directory: these campaigns reuse numbers for days, and your report is the warning the next person will see before entering their card details.