What this scam actually looks like
Delivery smishing works by sending a text message that appears to come from a well-known courier, typically Royal Mail, Evri or DPD. The message claims a parcel could not be delivered because of an address problem or an unpaid customs fee, and it includes a link to a convincing lookalike website. Once there, the victim is asked to pay a small redelivery charge, usually between £1 and £3, by entering full card details.
The goal is not the small fee itself. It is the card number, expiry date and security code that the fraudsters harvest and then use for larger unauthorised transactions, or sell on criminal marketplaces.
Action Fraud, the UK’s national fraud reporting centre, lists delivery lures as one of the most reported forms of smishing in the country. The National Cyber Security Centre (NCSC) similarly flags parcel-themed messages as a persistent and high-volume threat to UK consumers.
Why timing makes this scam unusually convincing
Most people have learned to treat unexpected texts with suspicion. The problem with delivery smishing is that it does not always arrive unexpectedly.
A Reddit user in r/Scams described almost falling for exactly this scenario in May 2026. They had ordered something online and had been checking the tracking regularly. A fake failed-delivery text arrived roughly an hour after they had last looked at the real tracking page.
The user clicked the link, found a page with a logo, a fake tracking number and official-looking buttons, and only stopped when the site asked for full card details. They then checked the real courier’s tracking page directly and confirmed the parcel was moving normally with no failed delivery recorded.
Scammers do not know you are waiting for a parcel. They send these messages in bulk to thousands of numbers simultaneously. Occasionally the timing will coincide with a real order, and when it does, the psychological barrier that would normally stop someone falls away.
How the fake websites pass a quick glance
The landing pages linked from delivery smishing texts are designed to mimic the visual identity of real courier websites. They typically include a copied logo, a plausible-looking tracking number, progress bars and call-to-action buttons that mirror the style of legitimate services.
The pages are often hosted on domains that superficially resemble official ones, for example using hyphens, misspellings or country-code suffixes that are not used by the real company. Checking the full URL in the browser address bar before entering any information is one of the most reliable ways to spot a fake site. If in doubt, close the tab and navigate to the official site by typing the address directly.
The NCSC advises that you should treat any unsolicited link with caution, regardless of how convincing the page appears once you arrive.
The card details request is the clearest warning sign
Legitimate UK couriers do not ask customers to pay redelivery fees by entering card details via a link sent in an unsolicited text message. This is the single most reliable indicator that something is wrong.
Royal Mail, Evri and DPD all have official processes for redelivery or address amendment, accessible through their own websites or apps. None of these processes involves clicking a link in an SMS and entering payment information on a third-party page. If a text asks you to do that, it is a scam.
Even where a courier does charge a legitimate surcharge (for example, for certain customs handling situations), the official notification will direct you to a verified account area, not to an anonymous payment form via an SMS link.
What to do if you receive a suspicious delivery text
Do not click the link. If you have already clicked but not entered any details, close the tab immediately and do not return to it.
Check your tracking independently. Go directly to the courier’s official website (royalmail.com, evri.com, dpd.co.uk or whichever service you are expecting) and enter your tracking number there. If there is a genuine delivery issue, it will be visible in the official system.
Forward the text to 7726. This is free on all UK networks. The number spells SPAM on a keypad and feeds reports directly to Ofcom and network operators for investigation and blocking.
Report to Action Fraud if you have provided any personal or payment information. You can report online at actionfraud.police.uk or by calling 0300 123 2040.
Contact your bank immediately if you entered card details. Ask them to cancel the card and monitor for unauthorised transactions. UK banks are generally required to reimburse victims of authorised push payment fraud, and many also have policies covering card fraud arising from phishing, though outcomes vary.
Why delivery scams are so widespread in the UK
The volume of online deliveries in the UK creates a large and consistent pool of potential victims. With millions of parcels shipped daily, a significant proportion of mobile users are, at any given moment, actually waiting for something. This means even a low conversion rate across a mass smishing campaign can yield meaningful returns for fraudsters.
The NCSC’s annual review has consistently highlighted SMS-based phishing as a growth area, and Ofcom has worked with mobile operators to implement filtering at network level. However, filtering is not comprehensive, and smishing messages continue to reach UK numbers in significant volumes. Figures on the precise scale of delivery-themed smishing in 2025 and 2026 are pending publication in upcoming Action Fraud and NCSC annual reports.
How to stay ahead of this scam
A few practical habits significantly reduce the risk:
- Save the official tracking page for any order you are waiting for and check it there directly, rather than via any link sent by SMS.
- Be aware that feeling impatient about a delivery lowers your critical thinking threshold. That psychological state is exactly what these messages are designed to exploit.
- Enable spam filtering on your device. Both Android and iOS have built-in options to filter messages from unknown senders.
- If you manage deliveries for an elderly or less digitally confident family member, make sure they know that any text asking for card details to release a parcel is a scam, regardless of how official it looks.
For more on mobile fraud affecting UK consumers, see our mobile scams hub or read about SIM swap fraud and how to protect your number.
Comments
0 comments
Loading comments…