The Royal Mail Missed Parcel Text Scam
Fake Royal Mail texts claiming a missed parcel needed a small redelivery fee — but entering card details led to much larger charges.
Attack Chain
- 1Bulk SMS sent impersonating Royal Mail
- 2Victim clicks link and lands on fake site
- 3Card details captured for £1.99 charge
- 4Large unauthorised transactions follow
Background
During the explosion of online shopping in 2020–2021, criminals launched a highly effective text message campaign impersonating Royal Mail. With so many people expecting deliveries, the timing was perfect. Millions of texts were sent daily at the peak of the campaign.
The Attack
The SMS messages said something like "Your parcel could not be delivered. A redelivery fee of £1.99 is required." The link led to a fake Royal Mail website asking for a home address and payment card details. The £1.99 charge was real, but the real goal was capturing full card details. Victims later found unauthorised charges of hundreds or thousands of pounds appearing on their accounts.
Response
Royal Mail issued urgent warnings that they never charge fees by text message. The National Fraud Intelligence Bureau logged tens of thousands of reports. Several UK banks introduced additional friction for small card transactions to catch these fraud patterns.
Outcome
The campaign affected over 750,000 people in the UK alone. Victims lost an average of £270. Many only discovered they were victims weeks later when checking bank statements.
Key Takeaways
- Royal Mail, DPD, Evri, and DHL never ask you to pay a redelivery fee by clicking a link in a text
- If you receive one of these texts, forward it to 7726 (the UK spam reporting number)
- Use a credit card rather than a debit card for online shopping — fraud protection is stronger
- Never enter full card details on a page reached through an unexpected text message
- Check bank statements weekly, not monthly, so you catch fraud faster