A parcel scam is a fake text or email that says you’ve missed a delivery and asks you to pay a small fee to rebook it, through a link to a page that takes your card details. It feels real when you’re expecting a parcel, but the timing is just a coincidence: messages like this are often sent to thousands of people, and some of them happen to be waiting for a delivery. This two-minute video, made as a 1940s newsreel, shows how it happens and what to do: don’t click the link, check on the delivery company’s own website or app, and forward scam texts to 7726 and scam emails to report@phishing.gov.uk.
Why does a missed parcel message feel so real?
It feels real when you’re expecting a parcel, but the criminals don’t need to know that you are. Which? reports that scammers send thousands of fake texts that seem to come from companies people expect to hear from, such as Evri, Royal Mail and the NHS. Some of the people who get them happen to be waiting for a delivery, and for them the message looks like it must be genuine.
That helps explain why these messages are especially common at Christmas and on Black Friday, when lots of us are expecting parcels. Ofcom says texts pretending to be from Royal Mail, DHL or Evri, claiming a parcel is waiting or a delivery fee is due, are particularly common at those times of year.
So a message about a parcel you’re expecting isn’t proof that it’s real. Look at what it asks you to do instead: hurry, click a link, and pay.
What happens if you click the link?
The link opens a page that looks official and asks for your card details to pay the fee. Royal Mail says it will never ask you to enter information on a page that isn’t part of Royal Mail. Once the criminals have your card details, they can take your money, and if it’s a company card, it’s the company’s money at risk.
It doesn’t always end there. Which? describes a 73-year-old who got a missed delivery text from “Evri” while she was expecting a parcel, so she assumed it was genuine and entered her credit card details to pay £1.45. A few days later, a caller claiming to be her card provider’s fraud team talked her into sharing security codes, and nearly £3,500 was spent on her card. Which? warns that people who enter their details on fake websites are extremely vulnerable to further scams, including calls from criminals pretending to be their bank.
The same trick arrives by text, which is called smishing. Our guide to what smishing is explains more, and our guide to phishing, spear phishing and whaling covers the emails.
What to do about a parcel scam
- Don’t click the link. Even if you are expecting a parcel, check its status yourself: type the delivery company’s real web address, such as royalmail.com/track-your-item, or use its official app.
- Forward scam texts to 7726. It’s free, and your phone provider can investigate and block the sender.
- Forward scam emails to report@phishing.gov.uk. It’s free, and the NCSC can remove scam email addresses and websites.
- At work, press the report button if you have one, or tell your IT team. Our KnowBe4 security awareness training clients use the Phish Alert Button, which sends the email to an engineer to check.
- Already typed in your card details? Ring your bank straight away, on the number on the back of your card, not one from a message or a call you’ve received.
Video transcript
Read the full transcript
Narrator: Presenting: the delivery scam! A fake text or email that says you’ve missed a parcel, and asks you to pay a small fee.
Narrator: Meet Reginald. He’s expecting a parcel from Royal Mail. But it hasn’t arrived. So he checks his electronic notebook for letters. Electronic ones, naturally.
Narrator: And there it is! “Sorry we missed you,” it says. “Pay a small fee, and we’ll deliver it again.” And what timing! Just as he’s expecting a parcel. For Reginald, it’s pure coincidence, and that’s what makes it so convincing.
Narrator: And it invites him to click, with his trusty screen-moving device. What’s that, Reginald, have you clicked a naughty link again?
Narrator: The page looks terribly official. It asks for his card details, just to pay the small fee. But this was a spoof letter! It didn’t come from Royal Mail at all. It came from criminals.
Narrator: Now they have his card details, and they can take his money. If he used the company card, that’s the company’s money at risk.
Narrator: Days later, his pocket telephone rings. “Your bank here,” says the caller. It isn’t. It’s the criminals again, trying to get more money.
Narrator: Oh dear. Let’s wind the film back. Here’s the clever bit: the criminals didn’t need to know Reginald was expecting a parcel. Messages like this are often sent to thousands of people. Some of them just happen to be waiting for a delivery. For Reginald, it was pure coincidence.
Narrator: That helps explain why these messages are especially common at Christmas and on Black Friday, when lots of us are expecting parcels. So a message about a parcel you’re expecting isn’t proof that it’s real. And look: it tells you to hurry, and it asks for money.
Narrator: So, don’t click the link. Check for yourself: type the delivery company’s real web address, or use its official app.
Narrator: Scam text? Forward it to 7726. Scam email? Forward it to report@phishing.gov.uk. It’s free. At the office, press the report button if you have one, or tell your IT team.
Narrator: Already typed in your card details? Ring your bank straight away, on the number on the back of your card.
Narrator: And Reginald’s parcel? It came on Tuesday. Jolly good show! And now… in colour, if you please!
Narrator: Don’t click. Check for yourself. And talk to Ingenio.
Frequently asked questions
How do I know if a parcel delivery text is a scam?
Be wary of any message that asks you to pay a fee through a link, tells you to act within a deadline such as 24 hours, or comes from an address that isn’t the delivery company’s own. Expecting a parcel isn’t proof the message is real; check on the company’s official website or app instead.
What do fake Royal Mail texts look like?
They typically say a parcel couldn’t be delivered and ask for a small fee, such as £2.99, to rebook it, often with a deadline. Royal Mail says it will never ask you to enter information on a page that isn’t part of Royal Mail. If you’re unsure, check the tracking number at royalmail.com/track-your-item.
Where do I report a scam text in the UK?
Forward it to 7726. It’s free, and most phone providers are part of the scheme, so they can investigate and block the sender. Forward scam emails to report@phishing.gov.uk.
I’ve entered my card details on a scam website. What should I do?
Ring your bank straight away, using the number on the back of your card. Be wary of any call that follows claiming to be your bank: criminals can use the details they’ve taken to sound convincing. If you’ve lost money, the NCSC says to tell your bank and report it as a crime to Report Fraud (or Police Scotland in Scotland).
Why are parcel scams so common at Christmas?
More of us are expecting deliveries at Christmas and on Black Friday, so a fake missed parcel message is more likely to reach someone who is waiting for one. Ofcom and the NCSC both say these scams are more common around then.
What should staff do if they get a parcel scam at work?
Don’t click the link. Press the report button in your email if you have one, or tell your IT team, so they can check whether anyone else received it.
How we help
At Ingenio, our KnowBe4 training gives your team regular short lessons and simulated phishing messages, with a report button that sends suspicious emails to an engineer to investigate. Our managed cyber security service includes email spam filtering and management. We’re based in Brighton and support businesses across Sussex and the South East.
Final thought
A message that arrives just as you’re expecting a parcel can still be a scam. Don’t click; check the delivery on the company’s own website or app, and report the message.
👉 Talk to us about helping your team spot scam messages. We’re happy to talk it through.
Sources
- Which?: Delivery text scammers could then pose as your bank
- Ofcom: Types of scam calls, texts and messages
- Royal Mail: Scam protection
- NCSC: Phishing, spot and report scam emails, texts, websites and calls
- NCSC: Report a scam text message
- NCSC: Report a scam email
- NCSC: What to do if you’ve been scammed
