Three UK Warn Customers Over Rise in Missed Parcel SMS Scams
Mobile network operator Three UK has warned customers this week about an increase in fraudsters using “missed parcel” SMS (text) scam messages this summer, which are not a million miles from the fake DHL or FedEx delivery messages that tried to infect phones with malware a few years ago (and continue to do so today).
The operator states that, since January 2024, they’ve blocked over 20 million “fraudulent messages” (roughly 111,111 a day). But recent research from Citizens Advice indicated that almost half (49%) of people targeted by scammers are now a victim of malicious parcel delivery scams, with 84% of 18-24 years being targeted, usually through text or mobile messaging.
Similarly, Three UK’s network filtering and detection systems have also “identified an uptick” in criminals exploiting increased activity to deceive and defraud unsuspecting consumers during the summer period, often by exploiting an individuals desire to take advantage of online deals (e.g. holiday clothes shopping to summer sales).
Advertisement
The ‘missed parcel’ scam involves criminals sending a text or email informing an individual that a courier is attempting to deliver a parcel, but they need to pay a fee or rearrange collection. The message will contain a link to a website or request to download an app – this will be ‘spoofed’ to look like it belongs to a legitimate delivery company. Common features that appear in scams include:
- Saying they have failed to deliver a parcel and are trying to arrange redelivery so require your personal details.
- Claiming that a small fee has to be paid to release the parcel, which aims to scare consumers by stating the package will be sent back or to a depot if they don’t pay.
- Including a fake tracking link that could install malware.
Mark Fitzgerald, Three’s Director of Finance & Fraud, said:
“The ‘missed parcel’ scam has been around for a while, but online shoppers are more vulnerable at this time of year with summer deals and holiday shopping. Our fraud prevention team is working hard to block fraudulent messages and advise our customers on the latest watchouts so they can rest stay alert.
If you’re expecting a delivery and you receive a ‘missed parcel’ message, do not click on any text links you receive. Use official apps or websites to track your parcel. Any texts that look suspicious, forward the message to 7726, the free spam-reporting service.”
The security notice is timed to coincide with a new call from a coalition of businesses, including Three UK and Which? (among others), which are attempting to encourage the Government to make tackling fraud a national priority.
How can you spot a delivery scam text?
Delivery scam texts often contain information about failed delivery attempts and include fake tracking links. Key red flags to look out for are:
- Random phone numbers
- Poorly written English
- Texts that rush you to act
- A lack of real information about your parcel
- A web link that contains additional text
If customers are expecting a delivery and receive a ‘missed parcel’ message:
- Do not click the link and never give out personal bank details
- Use the official websites of delivery companies to track your parcel
- Forward the message to 7726, a free spam-reporting service provided by phone operators
- Delete the message
- For more information on how to stay safe from parcel delivery fraud and other online scams, visit Three’s website at three.co.uk/privacy-safety/report-a-problem
If customers are expecting a parcel, they can track its status by using the official website of the delivery companies:
- DHL Track a Parcel https://track.dhlparcel.co.uk/
- DPD Track It https://www.dpd.co.uk/service/
- Evri Track Your Parcel https://www.evri.com/track-a-parcel
- FedEx Tracking https://www.fedex.com/en-gb/tracking.html
- Royal Mail Track your item https://www.royalmail.com/track-your-item
- UPS Track https://www.ups.com/track?loc=en_GB&requester=ST/
- Yodel Track your parcel https://www.yodel.co.uk/track
Mark is a professional technology writer, IT consultant and computer engineer from Dorset (England), he also founded ISPreview in 1999 and enjoys analysing the latest telecoms and broadband developments. Find me on X (Twitter), Mastodon, Facebook, BlueSky, Threads.net and Linkedin.
« Full Fibre UK Broadband ISP BeFibre Launch 30 Day Contracts and Biz Plan
Royal Mail contribute to this problem by using ‘ryml.me’ in their (legitimate) messages rather than ‘royalmail.com’, thus training people that it’s advisable to click unknown domains.
Came here to say the same thing. Using a .me domain is utter insanity. How can we advise people not to click on suspicious looking links, when Royal Mail are normalising scam links.
I don’t get these as text, people should realise a courier would not normally have your phone number.
I do get them a fair bit via email, but my spam filter collects most of them.
You don’t get these as texts but others do.
I’ve had legitimate tracking texts in the past from Amazon orders, DPD, etc. as well as numerous scams, although these days my phone blocks most of the latter.
80% of the couriers have my phone number (judging by the legitimate delivery notifications I get). It’s quite useful when the courier can’t find your house and you have to guide them in…!
I switched on my backup phone the other day (on Three) and it received 43 of these scam text messages. It had only been off a week!
@Ad47uk I tell you what I have never been scammed before as I am quite wise to them but they are getting very good with the courier ones, I almost got scammed by one of them as I was expecting a delivery from evri and I get an email which bypassed my spam filter and said that I missed my delivery when my missus was at home waiting for it, I clicked on the link and it wanted to charge me for redelivery so I thought nothing of it and started filling out the form and was about to enter my card details but i phoned my missus complaining that she was at home and she missed my delivery and that evri are now gonna charge me, she said no one had been then something just clicked inside of me and I went on the tracking and it said it was out for delivery, then i rechecked the email sender and it was definitely not evri! I must admit it was good as the timing of receiving it when i was expecting a delivery on the same day, made me think it was an inside job or something for them to know.
‘I have never been scammed before as I am quite wise to them’
‘wanted to charge me for redelivery so I thought nothing of it’
Right…
I always check the links to see where they go. The thing is most couriers these days just chuck what ever they are delivering by the front door or in a bin if you got one these days. If i am expecting anything, I put a notice on my door to take it next door., The postman knows to take parcels next-door if I am not here, Barry is very good.
The problem is people that can be scammed easily.
As for phone numbers, none of the couriers have my number, but then very few companies I use have my phone number, no need to these days with email. The company I got my freezer from have my number and the two companies that I get my coffee beans from do, and that is it .
In my 20s I used to get scammers like them on my phones way back (I’m 30 now), I rarely ever get these scammers messages (maybe 1 would creep through) and I set things on my SMS and blocking scam phone calls in place where my phone blocks them instantly.
Yes that’s right I’ve still not been scammed, like I said it was very close. You’ve taken it out of context when I wrote alot more than that explaining in detail the situation and what happened. You’re just a troll mate, read it properly and you will get the picture.
Got a scam phone call with someone who left a message with an indian accent. He said that a parcel is going to be delivered. He asked for my full UK home address and mentioned a URL. I back traced to AWS. I emailed AWS and mentioned that their services are being used by indian scammers. AWS emailed me back in a few hours and said that the scam URL had been shut down and scammers who setup the AWS account were banned from them.
Thank you. Not something that the average person could do.