The Bin Day Test: Auditing Hyper-Local Phishing Without Trusting the Postcode

There is a particular kind of scam email that does not shout. It does not promise a lottery win or threaten immediate arrest. Instead, it mentions that your bin collection has moved to Thursday, names the correct council, and points you at a link to reschedule a missed pickup. It feels less like a phish and more like a slightly annoying civic update. That is the trick.

Hyper-local phishing works because local detail is cheap. Postcode databases, council calendars, NHS trust names, Royal Mail delivery office lists and planning notices are all public or scraped. Sticking a real street name into a fake message costs almost nothing. Filtering, meanwhile, is mostly interested in whether the sender is who they claim to be, not whether the content correctly identifies your wheelie bin day.

Why local colour is cheap

A scammer does not need to know you. They need to know the shape of where you live. A postcode gets them the council area, the MP, the nearest hospital, the delivery office and often the local newspaper. Council websites publish waste schedules. NHS trust sites list departments and appointment letter styles. Royal Mail has a delivery office locator. Social media fills in the rest: street names, local Facebook groups, the fact that everyone in your road moans about the same recycling rules.

That data is then stitched into a template. The message might say your council tax rebate needs a bank detail check, your hospital appointment needs confirming, or a parcel is waiting at the delivery office on the high street. The local accuracy is set dressing. The payload is still a link to a credential-harvesting page or a malware download.

Anatomy of a hyper-local lure

The giveaway is rarely the local detail itself. It is the mismatch between the local detail and the delivery channel. Ask a few boring questions before you let the message influence you.

• Does the sender domain match the organisation? A council will not send from a random .co.uk or a freemail address. Check the actual address, not just the display name.
• Does the link go to the organisation's real domain? Hover or long-press. Lookalike domains often swap a letter, add a hyphen, or use a different top-level domain.
• Is it asking you to log in, pay, confirm bank details or download something? Local councils and NHS trusts do sometimes ask you to use a portal, but the portal should be reachable through the official site you already know.
• Does the tone match? A real bin day notice is dull. A scam bin day notice often has urgency, a button, and a penalty for ignoring it.

The weakest signal in the room

The sentence 'it mentions my street' is the weakest possible authentication signal. It is not proof of anything except that someone has access to a scraped list or a public map. Sender authentication is different: SPF, DKIM and DMARC tell you something about the domain that sent the message. Domain age, link reputation and whether the message came from a newly registered lookalike domain tell you more. Local accuracy tells you almost nothing about intent.

This is why a filter can pass a hyper-local scam and block a legitimate newsletter. Filters score sender reputation and authentication signals. They are not sitting there checking whether your council's waste collection day really did move to Thursday. A message from a compromised but reputable domain, or from a freshly registered domain with decent setup, can sail through while a clumsy but genuine bulk mail gets quarantined.

A short local exposure audit for your organisation

If you run a UK organisation, assume some local detail about you is already circulating. The question is how much of it would make a convincing lure. Spend fifteen minutes on this.

1. Search your organisation's name plus the words invoice, payroll, council, NHS, delivery and appointment. Note what public pages appear. Are any of them PDFs with staff names, direct dial numbers, office addresses or signatures?
2. Check your public staff pages and social accounts. Do they list full names, roles, email addresses and office locations together? That is useful for genuine contact and useful for pretexting.
3. Look at your out-of-office and auto-reply templates. Do they reveal internal project names, travel dates or a named deputy? A scammer can use that to sound local and internal.
4. Search for your postcode and building name alongside terms like planning, licence or tender. Public notices often expose operational details you would not put on a homepage.
5. Review what your newsletters and job adverts say about systems and suppliers. 'We use X portal for Y' is a gift to someone building a convincing fake login page.
6. Ask reception and finance which local details they hear most often in suspicious calls and emails. Then warn the rest of the team in plain language.

You cannot remove every public detail, and you should not try. The goal is to stop treating local accuracy as trust. If a message mentions your street, your council and your bin day, that is not a character reference. It is a template with good props.

What to do when a local lure lands

Do not use the contact details in the message. Open a browser, go to the organisation's official site, and use the number or portal you find there. If you are reporting a suspicious email in the UK, forward it to the NCSC's Suspicious Email Reporting Service at [email protected]. If you have already clicked, change the password you entered and tell your IT or security contact immediately. For a workplace, report it internally even if you feel silly. One report can protect the next person who gets the same template with a different street name.

The bin day test is simple: local detail can make a scam feel real, but it cannot make a sender authentic. Check the domain, check the link, and verify through a channel you chose. The postcode is not a password.