Delivery Text Scam: How to Spot Fake USPS, Royal Mail, Evri and DHL Messages

The delivery text scam works because almost everyone is waiting for a parcel at some point. A message says your package could not be delivered, the address is incomplete, or a small fee is due, and a link promises to fix it in seconds. Variations impersonate USPS, Royal Mail, Evri, DHL, Australia Post and others, and the same trick is now used for unpaid road toll texts. This guide shows you how to spot the fakes, check your real deliveries and report the messages.

How the delivery text scam works

The scammer does not need to know whether you are expecting a delivery. Texts are sent in bulk, so a share of recipients will be waiting for something. The link leads to a convincing copy of the carrier's website that asks you to:

• Confirm your name, address, date of birth and phone number.
• Pay a small redelivery, customs or address-correction fee by card.
• Sometimes enter a one-time code sent by your bank, which actually authorises a much larger payment or adds your card to the scammer's digital wallet.

The small fee is the hook. The real goal is your card details and personal data, which can be used for larger fraud or to make follow-up calls more convincing. Some victims receive a call days later from someone claiming to be their bank's fraud team, armed with the details they entered. Because the fee is so small, many people never notice the first charge at all.

Delivery text scam warning signs

• You did not sign up for text updates from this carrier, or you are not expecting anything.
• There is no tracking number, or the tracking number does not work on the carrier's own website.
• The link is not on the carrier's official domain. Look for extra words, odd endings or misspellings.
• A fee is requested for redelivery or an address update.
• There is a deadline: your parcel will be returned or destroyed within 24 or 48 hours.
• The message comes from a personal mobile number, an email address or an unusual international number.
• Odd spacing, mixed languages or generic greetings such as Dear customer.

A sender name such as USPS or Royal Mail in your messages app is not proof either. Sender IDs can be spoofed, and fake messages sometimes land in the same thread as genuine ones.

How each carrier really contacts you

USPS

The US Postal Inspection Service says USPS will not text or email you about a package unless you signed up for tracking updates with a tracking number, and those genuine updates do not contain links. Report USPS smishing by forwarding the text to 7726 and by emailing spam@uspis.gov with a copy of the message text and a screenshot showing the sender and date. Do not tap the link while you do it.

Royal Mail

Royal Mail says it only asks for payment by text or email when a customs fee or underpaid postage is due, and in those cases it also leaves a grey Fee to Pay card at your address, which may arrive after the message. Royal Mail does not charge for redelivery. If you are asked to pay, check the item yourself on the official Royal Mail website or app, or wait for the card.

Evri

Evri is one of the most impersonated names in UK parcel scams. Evri says it does not charge customers to rearrange or redeliver a parcel. Use the tracking number from the retailer you bought from and check it on Evri's own site or app rather than via a link in a text.

DHL

DHL can legitimately ask for import duties and taxes on international shipments, which makes its name useful to scammers. Check any fee by entering your tracking number on DHL's official website, typed in yourself, and compare the amount with what the sender or retailer told you. Be wary of any request to pay a duty on a parcel you are not expecting from abroad.

Australia Post

Australia Post says it will never call, text or email asking for personal or financial information such as passwords or card details. It asks people to send suspicious messages to scams@auspost.com.au and then delete them. You can also report delivery scams to Scamwatch, and Telstra customers can forward scam texts to 7226.

Other carriers and couriers

FedEx, UPS, Yodel, DPD, Canada Post and many local couriers are impersonated in exactly the same way. The test does not change from brand to brand. A genuine courier message relates to a parcel you can match to an order, its tracking number works on the courier's own site, and any charge it mentions also appears when you check that tracking number yourself.

Toll fee texts: the same scam on the road

A closely related wave of texts claims you owe an unpaid toll, with names such as E-ZPass, SunPass, FasTrak or a state toll authority in the US. The message threatens late fees and links to a payment page. The FBI's Internet Crime Complaint Center has warned about these toll smishing texts. If you use toll roads, sign in to your toll account by typing the operator's official address or using its app. Do not pay through the text link, and report it to the FBI's IC3 and to 7726.

How to check a delivery safely

1. 1Do not tap the link or reply, not even STOP. A reply confirms your number is active.
2. 2Find your tracking number in the order confirmation from the shop you bought from.
3. 3Type the carrier's website address yourself, or open its official app, and enter the tracking number.
4. 4If you still have doubts, contact the retailer you bought from. They can tell you which carrier holds your parcel and whether anything is owed.
5. 5If the message came from an ordinary phone number rather than a short code, a free lookup on WhoCallsMe can show whether it is a mobile, a VoIP line or a number others have flagged.

How to report a delivery text scam

• US — forward the text to 7726, report USPS-themed texts to spam@uspis.gov, and report other fraud to the FTC at ReportFraud.ftc.gov.
• UK — forward the text to 7726, which passes it to your mobile network so it can block the sender.
• Australia — report to Scamwatch and to the impersonated carrier, such as scams@auspost.com.au.
• Canada — report to the Canadian Anti-Fraud Centre, and forward the text to 7726 on most networks.
• On iPhone and Android you can also report the message as junk or spam inside the messages app, then delete it.

If you already entered your details

1. 1Call your bank or card issuer straight away using the number on the back of your card. Ask them to cancel the card and check for pending payments.
2. 2Do not share any one-time codes with anyone who calls you afterwards, even if they claim to be your bank.
3. 3If you entered a password, change it everywhere you used it and turn on two-step verification.
4. 4Watch your accounts and credit reports for unfamiliar activity over the following weeks.
5. 5Report what happened to the fraud reporting service in your country.

Expect follow-up attempts. Scammers who collect details through a fake delivery page often call later posing as your bank's fraud department, quoting the card you just used to sound credible.