Parcel delivery scam texts: how to spot fake DHL, DPD, UPS, Royal Mail and USPS messages

"Your parcel could not be delivered. Please confirm your address and pay the redelivery fee of 1.99." It arrives as a text message, sometimes by e-mail or WhatsApp, and it looks like it comes from DHL, DPD, UPS, Royal Mail, Evri, USPS, FedEx or your national post. Because so many of us are waiting for a parcel at any given moment, it works.

This type of scam is called smishing (SMS phishing). The small fee is not the point. The point is your card details, and sometimes your online banking login.

What these messages typically look like

The wording changes all the time, but the structure rarely does:

• A delivery problem: "missed delivery", "incomplete address", "parcel on hold", "customs fee unpaid"
• A small payment: often a tiny amount so it doesn't feel risky
• A deadline: "today", "within 24 hours", "or the parcel will be returned to sender"
• A link: often a strange domain, a shortened link or an address that combines the carrier's name with words like track, redelivery, parcel or customs

Typical examples (fictional, but in exactly the style we see):

• "DPD: your parcel is waiting. Update your delivery preferences here: dpd-redeliver-uk.info"
• "USPS: The package arrived at the warehouse but could not be delivered due to incomplete address information. Please confirm your address in the link within 12 hours."
• "Royal Mail: Your package has a 1.45 GBP shipping fee outstanding. To avoid return, please pay at royalmail-fees-help.com"

Why the fee is a trap

When you tap the link you land on a convincing copy of the carrier's website. You enter your address, then your card details to pay the small fee. What happens next varies:

• The card details are stolen and used for much larger purchases, often within hours.
• You are subscribed to something you didn't agree to, hidden in the small print.
• A "bank" calls you a day or two later. They know you just made a payment and claim your account is at risk. This is the second stage of the scam: they try to get you to move money to a "safe account" or read out a code.

That last step is worth repeating: if you receive a call from "your bank" shortly after paying a parcel fee, hang up and call your bank yourself using the number on your card.

How to tell real from fake

Real carriers do send text messages and e-mails, sometimes even about customs charges, which is exactly why this scam works so well. You don't need to guess which messages are genuine. One habit protects you every time:

Never pay or enter details through a link in a delivery message. Open the carrier's official app or type its address yourself, and enter the tracking number from the shop where you placed the order.

Other warning signs:

• You aren't expecting anything from that carrier, or the shop you ordered from uses a different carrier.
• There's no tracking number, or it doesn't match your order.
• The link isn't on the carrier's own domain. The carrier's name inside a longer domain (like carrier-parcel-help.com) doesn't count. See how look-alike domains work.
• It comes from a regular mobile number or an e-mail address on a free mail service.
• The page asks for more than an address, such as your full card details plus your date of birth, or your banking login.

Carrier by carrier: what to keep in mind

We can't promise how each company communicates in every country, and they change their processes. But these general points hold:

• DHL, DPD, UPS, FedEx, Evri, Royal Mail, USPS and national postal services all publish scam warnings on their own websites with examples of fake messages. Look them up by typing the carrier's address yourself.
• USPS says it doesn't send unsolicited texts asking for payment, and only sends tracking texts if you signed up for them. Forward suspicious texts to your carrier's spam number (7726 in the US) and report them to the US Postal Inspection Service.
• Royal Mail has published repeated warnings about fake texts and e-mails asking for "shipping fees".
• Customs charges are real for some international parcels, for example goods shipped into the EU from outside it, or between the EU and the UK. If in doubt, check with the shop you bought from and look up the parcel on the official carrier site.

What to do if you receive one

1. Don't tap the link and don't reply, not even with STOP.
2. Report the message. In the UK, the US and Canada, you can forward spam texts to 7726 (it spells SPAM on a phone keypad), which is free on major networks. Many phones also have a "Report junk" option.
3. Delete it.
4. Check your real deliveries in the shop's order history or the official carrier app.

If you want to see what a link would lead to without opening it, copy the address (long-press on most phones and choose "Copy") and paste it into websurely.com. We check whether trusted security databases list it as phishing, how long the website has existed, and whether its name imitates a well-known brand. Many smishing sites are only a few days old.

What to do if you already paid

Act quickly. This is fixable in many cases if you're fast.

1. Call your bank using the number on your card and tell them you entered your card details on a fake website. Ask them to block the card and issue a new one.
2. Check your recent transactions and report anything you don't recognise.
3. Be ready for a follow-up call. Your bank will not ask you to move money to a safe account or to read out a one-time code.
4. If you entered a password, change it on the real website and anywhere else you used it.
5. Report it to the police and the carrier. The guide How to report a scam website lists the places by country.

For the full step-by-step process, read What to do if you've been scammed online, and for chargebacks and other refund options see How to get your money back.

Helping older relatives

Parcel scams hit everyone, but people who shop online less often can be especially unsure what a real message looks like. A few simple rules you can share:

• "The parcel company never needs your card number by text."
• "If you're worried, call me or check in the app."
• "Never pay a fee from a link. Ever."

Installing the free websurely.com browser extension on a relative's computer adds a coloured rating to every site they open, which gives them a clear warning sign if they land on a fake.

Make the scam site visible to others

If you've received a message and found the website, report it on websurely.com. Reports confirmed by our moderators raise the site's Scam Score and warn everyone who checks it later. Our list of latest scam websites often includes fresh parcel-scam domains, and our general guide to spotting phishing websites helps with the next fake login page.

Check a website now

Got a delivery text with a link? Don't tap it. Paste the link into websurely.com and check it first. It's free.