What's going on
You get a text that looks like it came from DPD or Evri. It says a parcel could not be delivered because there was nobody home, or because the address was incomplete, or because a customs fee is outstanding. There's a link to sort it out.
The link goes to a fake website designed to look like the real DPD or Evri tracking page. It asks for your name, address, and card details so you can pay a small "redelivery fee" of a pound or two. That fee is bait. Once the criminals have your card details, they use them for much larger purchases or sell them on. Evri reported a 235% rise in scam reports from customers in the twelve months to October 2024, and took down 12,000 fake websites in the same period (Evri, October 2024). Action Fraud confirmed that fake DPD messages alone accounted for over £200,000 in reported losses in a single quarter.
How the scam works
It runs in stages. The text is just the opening move. The real damage comes later.
1. The text arrives
Criminals send thousands of these texts every day. Evri's Chief Information Security Officer has described it as the "spray and pray" method. They don't know whether you're actually expecting a parcel. They just know that millions of people in the UK are, so a decent percentage will think it's real and click the link.
Why DPD and Evri get impersonated so often
DPD and Evri between them handle millions of parcels a week in the UK. The odds of someone receiving one of these texts while they're actually waiting for a delivery are high. That's why it works. UK Finance found that delivery scam texts made up more than half of all smishing attempts over a recent 90 day period.
2. The fake website
The link in the text goes to a site that looks almost identical to the real DPD or Evri tracking page. It has the same logo, the same colours, the same layout. On a phone screen, it's very hard to spot the difference. The URL will be wrong if you look closely, but most people don't.
What the fake sites look like
- • They copy the exact branding, colours, and layout from the real site
- • The URL often includes the courier's name but with extra words or a different domain
- • Many show an HTTPS padlock, which does not mean the site is genuine
- • They're usually registered hours before the texts go out and taken down within days
3. They take your card details
The fake site asks for your full name, address, date of birth, and card details to pay a redelivery fee of £1.45 or £2.99, something low enough that most people wouldn't think twice about it. Once you've entered your details, the criminals have everything they need.
The fee is not the point
They're not after your £1.45. They're after your card number, expiry date, and CVV. With those, they can make purchases online, set up subscriptions, or sell the details in bulk. Some operations also capture your date of birth and address, giving them enough information for identity fraud.
4. The follow up call
This is where the real money gets stolen. A few days after you paid the "fee", you get a phone call from someone claiming to be your bank. They say suspicious transactions have been spotted on your card, which is true because the criminals are already using it. They tell you to move your money to a "safe account" for protection. That safe account belongs to them. Action Fraud has flagged this as a common pattern where victims lose thousands of pounds, not the original £1.45.
What these texts look like
The wording varies but the structure is always the same: a problem with your delivery, followed by a link. Here are the versions reported most often to Action Fraud and the NCSC.
"Failed delivery"
The most common version. Your parcel could not be delivered because nobody was home. You need to pay a small fee to rebook. This one catches people because it sounds exactly like something a courier would say.
"DPD: We attempted to deliver your parcel today but no one was available. Please pay a redelivery fee of £1.45 to reschedule: [link]"
"Address incomplete"
Your delivery cannot go ahead because the address details are wrong or incomplete. You need to update them through a link. The goal is to collect your full address along with your card details when you "confirm" the redelivery.
"Evri: Your parcel is on hold due to an incomplete address. Please update your details to arrange delivery: [link]"
"Customs charge"
Your parcel is held at customs and you need to pay a fee before it can be released. This one has become more common since Brexit, because some international orders genuinely do attract customs charges. That makes it more believable.
"DPD: Your package has been held at customs. A fee of £2.99 is required before we can release it for delivery. Pay here: [link]"
"Parcel too large"
A newer variation. The text says your parcel couldn't fit through the letterbox and you need to book a redelivery slot. Some versions ask you to choose a time slot on the fake site, which makes the experience feel more legitimate before they ask for payment.
"Evri: We couldn't deliver your parcel as it was too large for your letterbox. Book a redelivery slot: [link]"
Why this scam catches so many people
The UK is one of the biggest online shopping markets in Europe. Millions of parcels move through the system every single day, and most of us have something on the way at any given time. When a text lands saying your parcel is delayed, your first thought isn't "this is fraud". It's "which parcel?"
These texts also tend to arrive at the busiest times of year. Black Friday, Christmas, January sales. Fraudsters know when parcel volumes peak and they time their campaigns to match. UK Finance found that delivery scam texts made up three times the number of banking scam texts during busy shopping periods.
What makes it convincing
- • Most people are expecting a parcel at any given time
- • The fee is small enough to seem harmless
- • Real couriers do text delivery updates, so the format feels normal
- • The fake websites are near perfect copies of the real ones
- • The texts spike during busy shopping periods when people are distracted
What should make you stop
- • Any text asking you to pay a fee to redeliver a parcel
- • A link that doesn't go to dpd.co.uk or evri.com
- • No tracking number or order reference in the message
- • Being asked for your full card details for a tiny payment
- • Requests for your date of birth or other personal details
How to tell a real delivery text from a scam
DPD and Evri both send genuine text messages about deliveries. Here's how to tell the real ones from the fakes, based on official guidance from both companies.
Real courier texts
- Include a tracking number or reference you can check on the official app
- Will never ask you to pay any fee
- Link to dpd.co.uk or evri.com only
- Tell you the delivery time window or driver name
- Correspond to something you actually ordered
Scam texts
- Ask you to pay a fee for redelivery or customs
- Link to a URL that is not the official website
- Contain no tracking number or order reference
- Ask for your full card details for a payment under £3
- Use vague language like "your parcel" without specifics
If you get a suspicious text
Do not click the link
Even if you are expecting a parcel. Even if the text mentions the right courier. Do not click the link. If you want to check on a delivery, go to the courier's website yourself by typing the address into your browser, or use their official app.
Check with the retailer
If you're expecting a delivery, go to the retailer's website and check your order status there. Most retailers give you a tracking link when your order ships. If the delivery is genuinely delayed, it will show up in the retailer's system, not in a random text message asking for money.
Forward the text to 7726
7726 spells "SPAM" on a phone keypad. Forwarding the message reports it to your mobile network, which helps block the sender. Over 100 million suspicious messages were reported through 7726 in the year to April 2025 (Ofcom). It is free to use on all UK networks.
You can also report suspicious emails to [email protected] and report Evri scams directly at evri.com/cyber-security.
Block the number
On both iPhone and Android, you can block the sender so they can't message you again. This won't stop all scam texts since they come from different numbers each time, but it stops that particular one.
Delete the text
Once you've reported it, delete the message. This removes any chance of you or someone else with access to your phone clicking the link later.
Already entered your details?
Act quickly. The sooner you do something about it, the better your chances of keeping your money safe.
-
1
Call your bank or card provider now
Tell them you've entered your card details on a website you think was fake. They can cancel the card and issue a new one before the criminals use it. Use the number on the back of your card or dial 159 to be connected to your bank's fraud team directly.
-
2
Check your statements for unusual activity
Look at your recent transactions. Criminals sometimes make small test payments before larger ones. If you see anything you don't recognise, report it to your bank straight away.
-
3
Report to Action Fraud
Call 0300 123 2040 or report online at actionfraud.police.uk. If you're in Scotland, report to Police Scotland on 101. You'll get a crime reference number which you may need later.
-
4
Watch out for follow up calls
If someone rings you claiming to be from your bank about suspicious transactions on your card, be very careful. This could be the second stage of the same scam. Hang up and call your bank yourself using the number on your card or by dialling 159.
The short version
Red flags
- • Any text asking you to pay for redelivery
- • A link that doesn't go to dpd.co.uk or evri.com
- • No tracking number or order details in the message
- • Being asked for your card details for a small fee
- • A follow up call from your "bank" about suspicious activity
What to do
- • Do not click the link
- • Check deliveries through the retailer's website or app
- • Forward the text to 7726
- • Dial 159 if you've given out card details
- • Report to Action Fraud (0300 123 2040)