.png)
16 hours ago
7
You have landed a lot of bargains in the run-up to Black Friday and most of your Christmas shopping is done.
So when a text arrives about a delivery, it’s no surprise. A quick click on a link and you have paid the £2 redelivery charge it’s asking for.
The problem is, the package in the text does not exist, and you have just handed your bank details to a criminal gang which has been “spraying” thousands of similar messages to mobile phones around the UK after one of the year’s biggest shopping days.
Warnings have been issued by the government, mobile phone operators and delivery companies as fraud reaches record levels in the run-up to Christmas. Criminals rely on confusion as people expect deliveries, but also lose track of the details.
Evri, one of many couriers operating in the UK, says it had 10,000 cases of delivery fraud reported to it between November 2024 and January 2025.
Lee Howard, head of information security and information risk at Evri, says the “spray and pay” method of sending out thousands of messages each day means some will probably reach people who are really expecting a parcel.
“Lots of these try to charge a ‘redelivery fee’ which is nonsense – we will attempt delivery three times before an item is returned. We will never charge a re-delivery fee,” he says.
What the scam looks like
It starts with a text that says your delivery can’t be made and directs you to a website to rebook.
“Sorry! for the inconvenience but there seem’s to be a problem with your parcel. Please visit: (the name of the scam site) to resolve this. Thanks!” says one highlighted by Virgin Media O2.
“When our driver attempted to deliver today, nobody was present. Visit (the name of the scam site) to track and reschedule delivery,” says another.
And another: “Your package is waiting at your local depot. To arrange a delivery date, go to (the name of the scam site).”
The messages won’t use your name but will have a sense of urgency, says Murray Mackenzie, Virgin Media O2’s director of fraud prevention.
If you click on the link, you will typically be taken to a site which closely resembles one belonging to a courier company. You may be asked to pay a small sum of money – £1 or £2 – to rearrange the delivery.
The criminals – usually gangs operating on a large scale – are looking for personal information.
“The best-case scenario from a fraudster is you share payment information. Their goal here is to monetise what you provide to them,” says Mackenzie.
“However, you might provide an email address and a password for a login to a delivery site and that allows them to redirect future parcels. It may be that they just obtain your email address and phone number through a contact form and then that makes you susceptible to future scams.”
Previously, Guardian readers have told us that details they gave after getting these texts were later used by fraudsters claiming to be from their bank.
Some gangs may play a long game and try to take small amounts of money from your card often over a prolonged period, hoping they will not be noticed. Others will try to take one large amount and hope it goes through at a time when many large transactions are being processed.
The National Cyber Security Centre (NCSC) has warned that fraudsters will also try to persuade people to download malicious software (malware) through links on the fake text messages. This software is then used to steal personal details.
What to do
Take your time to check before responding to any text message.
“If you’re expecting five parcels and you get 27 text messages, then 22 of them are not going to be legitimate,” says Mackenzie.
“Be aware of who’s delivering your parcels. If a delivery is going to be sent by DPD, Evri, or Royal Mail, expect contact from them and no one else.”
Be wary if there is no personal details, such as what you have ordered, or if the text comes from a random number.
If you do hand over your account details, contact your bank once you realise your mistake. If you get a notification on your phone that a payment has been attempted, then tell the bank that it was not you.
When you get a text message which you know is fraudulent, report it on your messaging app if possible, or forward to it to 7726, then delete it. This means the phone company can prevent other people getting the same text message.
