📦 Parcel Delivery Scam Texts UK — The Complete Guide

Sunday, 02 August 2026

Fake delivery texts are the most common scam message in the UK. Every day, millions of texts pretending to be from Royal Mail, DPD, Evri, Parcelforce, Hermes and Amazon try to steal card details or install malware.

You're expecting a parcel — that's exactly why they work. This guide shows you the tell-tale signs and what to do.

How the scam works

  1. The text. "Your parcel is being held at the depot — pay a £2.99 redelivery fee" or "your address needs updating, confirm here."
  2. The link. The text contains a short link (e.g. royal-mail.top-update.xyz or dpd-track-4u.com) — not the real website.
  3. The trap. The fake page looks like the courier's real site. You enter your card details for the "fee" — the criminals take the fee and your card, then often subscribe you to repeat charges.
  4. The malware variant. Some links install spyware that steals banking logins.

The tell-tale signs

  • Generic greeting — "Dear customer" instead of your name
  • Weird sender — texts come from random numbers or shared shortcodes, not "RoyalMail"
  • Urgency — "action needed within 24 hours", "final attempt"
  • Too small a fee — £1.99–£2.99 to make you not think twice
  • Suspicious link — check the domain: real Royal Mail is royalmail.com, DPD is dpd.co.uk, Evri is evri.com
  • They ask for payment — couriers never text you to pay a redelivery fee; fees are paid when you book online

⚠️ The golden rule: couriers never send unsolicited texts asking you to pay or confirm details via a link. If in doubt, go directly to the courier's app or website — never via the link in the text.

What happens if you click

  • You land on a convincing fake page that asks for card number, expiry, CVC
  • Criminals immediately test your card with small purchases
  • Your details may be sold on to other fraudsters
  • Malware variants can hijack your banking session (see access device fraud)

What to do if you've clicked and entered details

  1. Call your bank's fraud line immediately — cancel the card and check for test transactions
  2. Report to Action Fraud — 0300 123 2040 or actionfraud.police.uk — get a crime reference number
  3. Forward the text to 7726 (free) — this alerts your network provider to block the sender
  4. Change your banking passwords if you used the same details anywhere
  5. Run a malware scan if you installed anything from the page

Real vs fake: quick comparison

Real courier contact Scam text
Via the official app or tracking page Random phone number or shared shortcode
Never asks for card details by text Asks for a "redelivery fee"
Uses royalmail.com, dpd.co.uk Uses lookalike domains (.xyz, .top, .info)
Knows your name and order "Dear customer"

Report it — always

  • Forward suspicious texts to 7726 (free, all networks)
  • Report to Action Fraud — every report feeds the National Fraud Intelligence Bureau
  • Report to the courier — Royal Mail, DPD and Evri all have scam-reporting pages
  • If money was taken, call your bank first, then report — see how to get your money back after a scam

Protect yourself

  • Never click links in delivery texts — use the courier's app or site directly
  • Set up delivery notifications via the official app so you know what's real
  • Don't share one-time codes with anyone who calls after a "missed delivery"
  • Tell older relatives — this scam targets them hardest

Related guides

CyberAware UK — helping families report crime, recover from scams, and stay safe online.