Fake Delivery Texts: Why "Your Parcel Is Waiting" Is Probably a Scam

The text almost everyone gets

"Your parcel is waiting for redelivery. A small fee of £1.45 is required to reschedule. Confirm your details here." It lands as a text or a message, wears the name of Royal Mail, Evri, DPD or the Post Office, and carries a link to a tidy page that asks for your address, your card number and, before long, rather more than the fee it mentioned. There is no parcel. There is a scammer who knows that on any given day, a large share of the country is genuinely waiting for something to arrive.

That is the quiet genius of the fake delivery text: it does not need to be convincing to you specifically, because it has been sent to millions of people at once, and it only needs a small fraction to be expecting a package right now. The scam is a numbers game played across the whole country's phones. This article explains what the message is really after — which is not the £1.45 — how to tell it from the genuine article, and, most usefully, what real couriers actually do, so the fakes stand out by contrast.

It was never about the fee

The tiny sum is the most misunderstood part of the scam, and its cleverest feature. A demand for £1.45 or £2.99 is deliberately trivial — small enough that paying it to make a nagging worry go away feels easier than arguing. But the money is not the prize. The prize is everything you type into the page around it.

To "pay the fee", you are asked for your full card details, your name, your address, often your date of birth and phone number. In one short form, a stranger collects enough to attempt fraud on your card and enough personal information to impersonate you convincingly later. And frequently the delivery text is only stage one. Days later comes a phone call from someone claiming to be your bank's fraud team, who already knows your name, address and recent "purchase", and uses that knowledge to talk you into moving your money to "safety". That follow-up is the expensive part, and the harmless-looking parcel text is what set it up — which is why it pairs so naturally with the bank impersonation scam that so often comes next. Delivery by text and messaging apps like this is what security people call smishing.

Why couriers are the perfect mask

Impersonating a delivery firm is close to ideal for a fraudster. Nearly everyone uses them, so a message about a parcel feels routine rather than alarming. The volume of genuine deliveries is enormous, so the odds that any given recipient really is expecting something are high. And the brands are trusted and instantly recognisable, so a borrowed logo does a lot of persuading for free. Royal Mail, the Post Office, Evri, DPD, DHL, UPS and the big online marketplaces all get impersonated for exactly these reasons.

The message usually leans on one of two stories: a parcel that could not be delivered and needs rescheduling, or a small charge — a "redelivery fee", a "customs fee", an "unpaid shipping" or "handling" charge — that must be settled before your item can be released. Both stories share a shape: a minor obstacle between you and a package you may well be waiting for, cleared by tapping a link and entering some details. The obstacle is fake and the link is the trap.

The tells to watch for

A genuine delivery notification and a scam can look alike at a glance, so it helps to have a short mental checklist. Any one of these is a reason to be wary; more than one and you should not go near the link.

| Tell | What it looks like | | --- | --- | | An unexpected fee by link | "Pay a small charge to release/reschedule your parcel" | | A link to an odd address | A web domain that is not the courier's real one | | A request for card and personal details | Full card number, address, date of birth "to confirm delivery" | | Manufactured urgency | "Reschedule within 24 hours or it will be returned" | | A parcel you weren't expecting | A delivery notice for something you never ordered | | A generic or slightly-off sender | No order reference, or one that means nothing to you |

The last two deserve emphasis. If you are not expecting a parcel at all, a text saying one is stuck is close to definitive — there is nothing to reschedule. And a genuine order almost always comes with a reference you recognise, from the shop you actually bought from; a "delivery" that cannot name what it is delivering is a stranger fishing.

What real couriers actually do

The most reliable defence is knowing the genuine behaviour to measure a message against, because the fakes ask for things real couriers do not.

When a real delivery is missed, couriers overwhelmingly leave a physical card through your door or a notification in their own app, telling you how to rearrange it or where to collect it — they do not, as a rule, text you a link demanding your card number to release an ordinary parcel. Genuine charges do exist, most notably customs or handling fees on some items coming from abroad, but these are handled through the courier's official website or app, with a reference tied to a specific item, not settled by tapping a link in an unsolicited text and typing your card into whatever page opens. Real tracking lives inside the courier's own app or on the address you would reach by searching for the company yourself, and it identifies your parcel; it does not begin by asking you to prove who you are with your full personal and payment details.

Hold any delivery message up against that baseline and the scam tends to reveal itself. It is asking for money and identity up front, through a link, for a parcel it cannot properly name — none of which is how the real service works.

What to do with a delivery text

The safe response is almost boringly simple: do not tap the link. If you think there is any chance the message is real, verify it the long way round. Open the courier's official app, or find their website by searching rather than by following the message, and enter the tracking number from the confirmation the shop sent you when you ordered. Better still, go back to the retailer you actually bought from and check the order status there. If none of that turns up a real, stuck parcel with a genuine fee, there is nothing to pay.

If you have already entered your card details, treat it as urgent: tell your card provider to freeze the card at once and keep a close eye on your statements, and be especially alert to any call that follows claiming to be from your bank — that call is part of the same scam, not a rescue from it. Our guide to getting your money back walks through the steps that actually recover funds. To help shut the scam down, forward the offending text to 7726 free of charge, which lets your mobile network trace and block the source, and the impersonated couriers each run their own reporting address for fraudulent messages if you want to tell them directly.

Before you go

Scammers can imitate a logo, a tone and a tracking number, but they cannot change how the real delivery companies behave — and that is the fixed point to steer by. A genuine courier leaves a card or an in-app note, ties any real fee to a named parcel handled through its own site, and never opens with "confirm your card details to release your item". Learn that ordinary, unglamorous reality well enough and every fake delivery text starts to sound wrong, the way a forged signature looks wrong once you know the real one.

So when the next "your parcel is waiting" arrives, do not measure it against your hopes for a package; measure it against what couriers actually do, and let the gap be your answer. If you are ever genuinely unsure whether a tracking link is real, the checker taking shape at CheckAScam is meant to be somewhere to test a link rather than trust it — though for a parcel you were not even expecting, the safer move is simply to delete the message and never find out where it led. The £1.45 was never the point, and the surest way to keep your card details is to never reach the page that asks for them.