Parcel scam texts: how to spot a fake delivery message

How do I know if a delivery text is genuine?

A fake usually shows several of these:

• You never asked for updates. Royal Mail only texts or emails you if the sender asked for tracking updates when posting. USPS only texts if you requested tracking yourself, and Canada Post only if you signed up.
• It wants money to deliver. A redelivery fee, "unpaid shipping fees", a small charge to release the parcel. DPD UK says it "will never ask you to pay a 'redelivery fee' via a link", An Post never charges to redeliver, and Royal Mail never asks for an underpaid postage fee by text or email: it leaves a grey Fee to pay card.
• It hurries you. "Within 24 hours", "within 48 hours", "or your parcel will be returned". As Royal Mail puts it: "Scammers often create urgency. Royal Mail does not." An Post says it never tells you to "act now".
• The link isn't the carrier's own. Shortened links (bit.ly), look-alikes such as fedx.com or unitedparcelservices.com (FedEx's and UPS's own examples), and new endings like .shop, which FedEx currently warns about.
• The sender is a mobile number or an email address. Evri texts only ever come from "Evri", and DPD UK's usually show "DPD UK", "DPD Local" or "DPDgroup UK". DPD UK says a random number or an address like [email protected] in their place means a scam.
• It asks you to reply "Y", call a number or install an app, or greets you as "Dear Customer", which DPD UK says it never writes.

A familiar sender name proves nothing: Australia Post warns that scammers can set it so a fake lands in the same thread as its real messages.

Since 1 July 2026, Australian phones show texts from unregistered sender names as Unverified. In Ireland, ComReg labels them Likely Scam, but says genuine businesses that haven't registered can get that label too. Treat both labels as a reason to check, not as a verdict.

How to read a link before you tap it

Scam links often start with the carrier's name. What counts is the end of the address, just before the first single /. That part names the owner, as in this made-up example:

Even if a link looks right, type the carrier's address yourself.

Do Royal Mail, USPS, Evri and DPD send texts?

Yes, most do, which is why fakes work. Here's what each says it sends, and what it never does:

Real carriers do send links, so a link alone proves nothing either way. The few real payment requests are nearly all for import charges, such as FedEx's link to pay duties or Royal Mail's customs fee text: the customs guide shows how carriers really ask for them.

What do fake delivery texts say?

Fakes recycle a few scripts. These are quoted from carriers' warning pages:

• Missed delivery, pay to rebook. "We couldn't deliver your package — please pay a fee" (Royal Mail).
• Address problem. "Shipment has been suspended due to missing house number", "Update your correct address", "verify your postcode within 48 hours" (Australia Post).
• Parcel on hold. "On hold due to unpaid shipping fees", with a link to pay (Canada Post).
• "Reply Y." Evri and Australia Post explain the trick: replying makes your phone trust the sender, so the link becomes clickable.
• iMessage instead of SMS. DPD UK says recent fakes arrive mainly as iMessages, while its real alerts are plain SMS.
• A phone call. Australia Post never calls out of the blue to ask for payment. UPS says a real UPS caller can always give a tracking number, which you can check on ups.com yourself.
• A courier for your marketplace sale. Australia Post never asks you to click a social media message to book a courier for something you're selling.

How to check a parcel text safely

None of these steps uses the message:

1. 1Are you expecting anything?No order, and nobody who would post you something? Treat it as a scam.
2. 2Find the real tracking numberUse the shop's shipping email or order page, never the number in the text.
3. 3Open the carrier yourselfType its address or open its app. Don't tap, scan or call anything in the message.
4. 4Look for a real requestA fee that's really due should show on the carrier's own site or app.
5. 5Report it, then delete itForward texts to 7726 in the UK, US and Canada.

UPS and Canada Post both say their own tracking is the safest way to see whether any fee is due. Can't find the number? See where to find your tracking number. Then you can paste it into Peek, which asks the carrier and, when needed, other sources, so you see the latest scans without going near the link.

A real missed delivery usually leaves a card. Canada Post leaves a delivery notice card and says an email asking you to click a link after a missed delivery "is NOT from Canada Post". For genuine cards and rebooking, see missed delivery.

Clicked the link in a scam text? What to do now

A scam text does no harm until you tap, reply, call or type something in. What to do next depends on how far you went:

1. 1Close the pageEnter nothing more. Don't reply, even "STOP".
2. 2Call your bank or card issuerUse the number on your card or banking app, and ask to block the card.
3. 3Change your passwordsWherever you typed or reused the one you entered.
4. 4Say no to callersSomeone calls next, even as your bank? Hang up and call back on a number you found yourself, as Ireland's Garda advises.
5. 5Report itTo the police or a fraud service if you lost money or details (see the table below).

Only tapped the link? Report the text and tell your bank anyway. The U.S. Postal Inspection Service advises this once you've interacted with the page, "even if you did not click 'submit'".

Entered card details or paid the fee? Call your bank at once to stop the card. In the UK, 159 connects you to most banks, and Stop Scams UK says it "cannot be spoofed". In the US, the FTC says to tell your card issuer at once and ask for a refund; federal law protects you from unauthorised use of your credit card. Then watch your statements: DPD Germany warns that these card forms can sign you up for further payments, so even a tiny fee isn't harmless.

Got a scam or spam text? Where to report it

Report a fake delivery text even if you didn't click, then delete it.

On an iPhone, an iMessage from someone not in your contacts shows Report Junk under it; in Google Messages on Android, use Block and report spam.