📝 Show notes
CyberAware Daily — 2026-10-06
- Today's threat deep dive: fake delivery parcel texts and emails
- How the scam works and why it's so effective
- What Royal Mail and Evri actually say about delivery fees
- Steps to take if you've already entered your card details
- How to report suspicious texts and emails in the UK
- Quick news: Microsoft Exchange flaw, NetScaler and FortiMail attacks
- One action: always verify deliveries through the official app or website
More at https://cyberawareuk.co.uk
📄 Full transcript
Welcome to CyberAware UK. It's Tuesday the 6th of October.
I am here with Alex and today is our threat deep dive where we take one scam type and pick it apart
properly. And today's scam type is really simple and it catches thousands of people every single
week. It's the fake delivery parcel text or email. You know the one. You're waiting for something
and a message lands saying your parcel couldn't be delivered and you need to pay a small re-delivery
fee. The clue is often in the detail. It might say it's from Royal Mail or Every but the link doesn't
go anywhere near their real website. These messages are designed to do one thing. Get your card details.
That tiny fee, usually around £2, is the bait. And once you put your card in, they don't just
take the fee. They can keep charging or sell your details on to other criminals.
We're covering this today because it's so common and so convincing. Royal Mail and Every both say
they will never ask you to pay a fee by text or email for a missed delivery.
So what should people do if they get one of these messages? I think the temptation is to just click
and get it sorted. That's exactly what they want. The safest thing is to stop. Don't click the link.
Don't reply. If you want to check a delivery, open the retailer's app or the courier's official website
using a bookmark you already have or type the address in yourself. And if you've already clicked
and put your card details in, what then? Ring your bank straight away using the number on the back of
your card. Tell them what happened. They can stop the card and watch for unusual payments.
It's much better to call quickly than wait and hope. Should people report it too?
Yes. Forward the text to 7726, which spells spam on a keypad. That's the free spam reporting service
used by UK networks. You can also report suspicious texts and emails to the National Cyber Security
Centre by forwarding them to report at ncsc.gov.uk.
And one more thing. It's not just texts. These scams come by email and sometimes by phone call with a
recorded message. Same rule applies. If you didn't order anything or you did order something but the
message feels off, verify it independently. Never use the contact details in the message itself.
Now, some quick news from the last day or so. Microsoft has confirmed a flaw in Exchange
that lets someone who has already signed in read other people's mailboxes.
That's a concern for IT teams running their own Exchange servers, not really something a home user
can fix. If you're a home user worried about your email, the best step is to turn on two-step
verification on your account. And researchers have flagged some new attacks on Netscaler and FortiMail
devices. Those are business networking products. So again, one for the IT department to patch.
For everyone else, the message is the same. Keep your devices updated and keep an eye out for delivery scams.
Let's finish with one action. This week, if you get a delivery message you're not expecting,
don't click the link. Go to the courier's official app or website yourself and check there. It takes 10
seconds and it could save you a lot of hassle. That's all for today. Stay sharp, stay skeptical,
and we'll be back tomorrow.