You're sitting at your desk. Your phone buzzes. "Royal Mail: Your parcel could not be delivered. Please pay a redelivery fee of £1.45 to reschedule."
You are expecting a package. You click through to a page that looks exactly like Royal Mail's website. You enter your card details. And just like that, someone in another country has your full card number, expiry date, and CVV.
This is the most common email and text scam in the UK. Royal Mail and other UK couriers have repeatedly warned about the surge in delivery scams, and Action Fraud regularly reports on parcel delivery fraud causing hundreds of thousands of pounds in losses. It works because it's so plausible — we all order stuff online, and missed deliveries actually happen.
Let's break down exactly how to spot these fakes.
The playbook: how delivery scams work
Every delivery scam follows the same formula:
Create urgency — "Your parcel will be returned to sender in 24 hours"
Ask for a small payment — Usually £1.20 to £2.99 (small enough you won't think twice)
Harvest your card details — That's the real goal. The £1.45 "fee" is irrelevant. They want your full card number.
Use or sell your details — Within hours, they'll attempt larger transactions or sell your card on the dark web
The small payment is the clever bit. If they asked you to "verify your identity" by entering card details, you'd be suspicious. But paying a small redelivery fee? That feels normal.
The real domains: bookmark these
Here are the only legitimate domains each courier uses for tracking and notifications. If the link in your email doesn't go to one of these, it's fake.
Royal Mail:
royalmail.com- Email from:
@royalmail.com - Tracking:
www.royalmail.com/track-your-item - 🚩 Royal Mail will never email you to ask for a redelivery payment. Their redelivery service is free and lives at
redelivery.royalmail.com
DPD:
dpd.co.uk- Email from:
@dpd.co.uk - Tracking:
track.dpd.co.uk - 🚩 DPD will never ask for payment to redeliver. They'll leave a card or send you to their app.
Evri (formerly Hermes):
evri.com- Email from:
@evri.com - Tracking:
www.evri.com/track - 🚩 Old "myhermes.co.uk" links are still legitimate for older tracking, but Evri will never ask for payment via email.
DHL:
dhl.co.ukordhl.com- Email from:
@dhl.com - Tracking:
www.dhl.com/gb-en/home/tracking.html
FedEx:
fedex.com- Email from:
@fedex.com - Tracking:
www.fedex.com/fedextrack
Amazon Logistics:
- Tracking is always within
amazon.co.uk— never a separate domain - Email from:
@amazon.co.uk
Red flags that scream "scam"
Even without checking domains, these details give it away:
1. They ask for money No UK courier charges a redelivery fee via email. Not Royal Mail, not DPD, not Evri, not anyone. If an email asks you to pay anything to receive your parcel, it's a scam. Full stop.
2. The sender address is wrong
The display name might say "Royal Mail" but hover over it (or tap on mobile) and the actual email address is something like [email protected] or [email protected]. The bit after the @ is what matters.
3. Generic greeting Real delivery notifications reference a specific tracking number. Scam ones say "Dear Customer" or just "Hi" because they've been sent to millions of people.
4. The link goes somewhere weird
Before clicking, hover over the link (long-press on mobile). If it goes to royal-mail-redelivery.com or dpd-uk-tracking.info or anything with extra words, dashes, or unusual extensions — it's fake. Legitimate companies use their main domain.
5. Poor formatting and mixed branding Many scam emails use slightly-off logos, wrong colours, or mix old and new branding (like using the Hermes logo with the Evri name). Real companies get their own branding right.
6. No specific tracking number Real notifications always include a tracking number you can independently verify. If there's no tracking number, or the one given doesn't work on the courier's real website, it's fake.
"But I AM expecting a parcel..."
This is exactly why these scams work. You are waiting for something, so the email feels relevant. Here's what to do:
Don't click the link in the email. Not even to "check."
Go directly to the courier's website by typing the URL into your browser (or use the app).
Enter your tracking number — you'll have this in your order confirmation from the retailer.
Check the retailer's website — Amazon, ASOS, etc. all show delivery status in your order history.
If you genuinely missed a delivery, Royal Mail leaves a grey "Something for you" card. DPD sends you to their app. Evri leaves a card or texts you from a short code.
The golden rule: never follow a link from an email to pay for delivery. Always go to the source directly.
What if you already entered your details?
Don't panic, but act fast:
- Call your bank immediately. Tell them your card details may have been compromised. They'll block the card and issue a new one. Most banks have 24/7 fraud lines.
- Check your statements for any transactions you don't recognise, even small ones. Scammers often test with a small charge first.
- Report it to Action Fraud at
actionfraud.police.ukor by calling 0300 123 2040. - Forward the email to
[email protected]— the National Cyber Security Centre collects these. - Forward scam texts to 7726 (spells SPAM on your keypad). Your mobile provider will investigate.
Why these scams spike at certain times
Delivery scams surge during:
- Christmas and Black Friday (November-January) — peak online shopping
- January sales — still lots of parcels moving
- Amazon Prime Day (July) — another spike
- Any postal strike — scammers exploit uncertainty about delayed deliveries
But honestly, they're year-round now. Online shopping is just how we live.
The bottom line
Legitimate couriers will never email you asking for money to redeliver a parcel. That's it. That's the one rule you need. If an email asks for payment — any payment, even 99p — to release your parcel, delete it.
And if you're ever in doubt, go directly to the courier's real website and enter your tracking number. The truth is always there.
