A text lands claiming a parcel is waiting, a delivery has failed or a small fee is due, with a link to tap and a countdown before the item is "returned to sender". This is smishing, the scam that borrows the name of couriers such as Royal Mail, Evri and DPD to steal your personal and banking details. Fake delivery texts are now one of the most common scams in the UK. Here is how to spot them, what never to do, and how to report them for free.

Why fake delivery texts target your online orders

The scam works because it arrives at the right moment. Anyone who shops online is genuinely waiting for something, so a message about a held parcel feels plausible. Fraudsters send the same text to thousands of numbers at once, and only a small share of recipients need to be expecting a delivery for the trick to pay off.

The message leans entirely on urgency and a tiny sum, often a £1.45 or £2.99 "redelivery" or "customs" fee: amounts small enough to lower your guard, while the real aim is to capture your card details.

The variants of the trap message

The wording changes, but the goal is always the same: to make you tap the link. These are the versions you will see most often.

  • A parcel held and waiting to be released, said to be returning to sender unless you act at once.
  • A customs or handling fee to settle before an item from abroad can be delivered.
  • A redelivery to rearrange for a small charge, on a page that asks for your card.
  • An address to confirm or a collection point to choose through a form.

How to spot a fake delivery text

A few tell-tale signs give these messages away. It is worth keeping them in mind before you touch anything.

  • A sender that is just an ordinary mobile number rather than a recognised brand name.
  • A link that mixes random words and digits, a shortened address or an odd domain that is not the real company site.
  • An urgent tone such as "final notice" or "your parcel will be returned within 48 hours", to push you into acting without thinking.
  • A request for card details or a small payment to release the parcel.
  • Spelling mistakes, a missing order number or no retailer name anywhere in the text.

To check a suspect address, read it from right to left: the name that truly identifies a website sits at the end of the block, just before the first slash, and anything in front of it can be faked.

What to do: never tap, verify, report

Faced with a message like this, the rule is not to engage and to move straight to reporting. Here is what to do, and what never to do.

  • Check the parcel only through the official app or website of the courier, using the tracking reference from your order confirmation email.
  • Forward the message free of charge to 7726, the shortcode that spells "SPAM" on a keypad, run by the mobile networks with Ofcom and the NCSC behind it.
  • Report it to the courier directly: Royal Mail at [email protected], Evri at [email protected].
  • Flag the message as junk in your messaging app on an iPhone or Android phone.
  • Never tap the link, which leads to pages built to harvest your login details or install malware.
  • Never enter your card details or make any payment through that link.
  • Do not call back the number in the message, which may be premium rate.
  • Do not reply "STOP" to a mobile number, as it only confirms your line is active.

The 7726 service works whichever of the UK mobile networks you are with.

Genuine courier or scam: the signals side by side

Comparing a real notification with a scam attempt lets you decide in seconds.

Delivery notification: genuine or scam
Signal Genuine courier Scam attempt
Sender Brand name or alias (Royal Mail, DPD, Evri) Unknown mobile number
Payment No fee by link; any charge handled at your door Asks for £1.45-£2.99 by link
Link Official domain (royalmail.com, evri.com) Random words and digits, odd domain
Card details Never requested by text Requested on a copycat page
Tracking Checkable in the official app with your order reference Pushes you to act within 48 hours

Good to know: no delivery company or bank will ever ask for your card details by text, and any genuine charge is handled at your door or through the retailer, never through a link sent by message.

If you have tapped the link or lost money

Anyone who has opened the link and entered details should act quickly, in order.

  1. Close the page at once without entering anything further.
  2. Contact your bank to freeze the card and watch for unusual transactions.
  3. Change the passwords on any account that may be exposed.
  4. Report it to Report Fraud, the service that replaced Action Fraud in December 2025, at reportfraud.police.uk or on 0300 123 2040; in Scotland, contact Police Scotland on 101.

For more on choosing a provider and staying in control of your line, browse our mobile section.