📝 Show notes
CyberAware Daily — 2026-09-24
- Thursday Case File: the parcel delivery text that steals bank confirmation codes
- Why a small fee like one pound ninety-nine is the hook that makes people tap
- How a genuine bank code can still authorise a fraudster's payment
- Who is most at risk: anyone expecting a delivery, especially those less familiar with bank codes
- What to do if you've handed over a code: call your bank on the number on your card, immediately
- Takeaway: never share a bank code you didn't trigger yourself
More at https://cyberawareuk.co.uk
📄 Full transcript
It's Thursday, and that means case file day, where we take one real scam and pull it apart so you can spot it in the wild.
And today's case is one of the most common ones we see reported, because it starts with something completely ordinary.
It starts with a text message that lands in the middle of your day, when you're busy and not really paying attention.
Tell us how it plays out, because the whole thing hinges on one small detail people miss.
The message looks like it's from a parcel firm you've actually used.
It says a delivery is waiting, and there's a small fee to release it, usually something like £1.99.
So it's not asking for hundreds of pounds up front, which is exactly why people tap the link.
Right. The amount is small enough that your guard drops.
You tap the link and you land on a page that looks like the courier's website.
And that's where the real ask happens.
You type in your name, address, and card details.
Then it asks you to confirm with a code sent to your phone by your bank.
That's the moment that matters.
Because that code isn't confirming a £0.99 payment, is it?
No.
That code authorises whatever the fraudster has already set up behind the scenes.
Often it's a payment to a new payee they've just added to your account.
So the person sees a genuine bank code arrive, and they hand it over without a second thought.
And by the time they realise, the money has gone out.
The bank code was real, the text was not, and that gap is where the loss happens.
Who is most at risk here?
Is this targeting a particular group?
It hits anyone who orders online, which is most of us.
But the reports skew towards people who are less familiar with how bank confirmation codes work,
and people who are expecting a delivery that week.
What should someone do if they think they've already handed over that code?
Call your bank straight away using the number on the back of your card.
Not a number from the text, and not a number from a search result.
The sooner you call, the better the chance of stopping it.
And the takeaway for everyone else.
A bank will never send you a code to confirm a payment to a company you've never set up before.
If a code arrives and you didn't start the payment yourself,
stop and call your bank on the number printed on your card.
Simple rule, and it covers almost every version of this scam we see.
That's today's case file.
Stay sharp, and we'll be back tomorrow.