Fake Royal Mail, Evri and DPD texts: how to spot a parcel scam before Christmas

What's happened

Fake delivery texts are the most widely seen scam in the UK, and the run-up to Christmas is when they're hardest to spot. With Black Friday on 27 November and millions of parcels on the move, a text saying your Royal Mail, Evri or DPD delivery is stuck looks entirely believable.

Virgin Media O2's scam index for April to June 2026 put delivery scams top of its list of ten scam trends: 63% of people it asked had seen one. They describe them as fake Royal Mail, DPD and Evri texts about held parcels, redelivery fees or tracking updates.

Ofcom's own research from February 2026 found that 40% of UK mobile users had received at least one suspicious message in the previous three months. On 15 July the regulator published new rules forcing mobile networks to do more to block scam texts, and it named parcel couriers as one of the businesses scammers pretend to be. Those rules don't start until 18 January 2027 for ordinary texts and 15 July 2027 for business messages, so they won't help this Christmas.

The warning signs

• A small fee to release or redeliver a parcel. Evri says its genuine texts will never ask you for payment. Royal Mail says the only time it asks for a payment by text or email is when customs charges are due on an item from abroad, and even then it also leaves a grey 'Fee to Pay' card.
• A made-up problem with your address. Which? found fake Evri texts blaming "incomplete address information", "package damage and missing postal code" or "the delivery address not being clear".
• A link that isn't the courier's own. Evri says its texts only ever link to tracking at evri.link, and adds that even this can be faked, so if you're unsure, don't click. Shortened links and odd web addresses are red flags.
• A text from an ordinary mobile number. Evri says its genuine texts won't show a mobile number as the sender.
• Pressure to act now, such as a warning that the parcel will be returned to the sender today.

What it could cost: a worked example

This is an illustration, not a real case. Priya is waiting for several Christmas orders when a text says her parcel is held over a £1.45 redelivery charge. She taps the link, enters her name, address, date of birth and card details, and pays.

The £1.45 is the least of it. The criminals now have everything they need to try spending on her card, and enough personal detail to make a follow-up call sound convincing. A few days later, someone rings claiming to be from her bank's fraud team. They know her address and the last digits of her card, and they tell her to move £2,400 of savings to a "safe account". If she does, that's the money at risk, not £1.45.

That second step is why these texts matter. UK Finance figures quoted by Ofcom show £1.28 billion was lost to fraud in 2025.

How to check if a delivery text is genuine

1. Don't use the link. Open the courier's app or type its website address yourself, then enter the tracking number from the retailer's order confirmation.
2. Check with the shop. Your order history will tell you which courier is delivering it. A text from a different courier is a warning sign.
3. Look for the card. If Royal Mail is genuinely holding an item for a fee, you should also get a grey card through the door.
4. Never pay a redelivery fee by text. Evri says it never asks for payment by text, and Royal Mail only asks for customs charges.

What to do if you've been caught

1. Call your bank straight away using the number on the back of your card, or dial 159 to reach your bank's fraud team. Ask it to block the card.
2. Report it to Report Fraud on 0300 123 2040 or online. In Scotland, call Police Scotland on 101.
3. Forward the text to 7726. It's free and helps networks block the sender. Forward scam emails to [email protected].
4. Change passwords you entered on the fake site, and turn on two-step verification for email and banking.
5. Expect follow-up calls. Your bank will never ask you to move money to a "safe account". If someone does, hang up and call 159.

Your questions answered

Will my bank refund me?

If criminals use your card details for payments you didn't authorise, your bank should normally refund you unless it can show you acted with gross negligence. If you were tricked into sending money yourself, banks must usually reimburse authorised push payment fraud up to £85,000 under rules introduced in October 2024. Report it quickly either way.

I clicked the link but didn't enter anything. Am I safe?

Probably. Close the page without entering anything. If something downloaded, Which? advises not logging into accounts on that device until it's been checked or reset.

Do couriers ever text genuinely?

Yes. Royal Mail, Evri and DPD send tracking updates when a sender asks them to. The difference is that genuine texts won't ask you to pay a small fee or re-enter your card details through a link.

Will Ofcom's new rules stop these texts?

They should make it harder, but they don't start until 18 January 2027 for person-to-person texts and 15 July 2027 for business messages.

Sources: Virgin Media O2 scam index, Ofcom, ISPreview (rule start dates), Evri, Royal Mail, Which?, GOV.UK (Report Fraud)