The Redelivery Fee That Wasn't: How 2026's Parcel Scams Fool Even Careful Clickers

A text lands at 18:42 on a Tuesday. We tried to deliver your parcel today but nobody was in. A £1.45 redelivery fee is outstanding — reschedule within 24 hours or it returns to the depot. There's a link, and the link has a padlock.

If you happen to be waiting on something from Evri, DPD or Royal Mail, that message does exactly what it was built to do: it slots into a gap you already have open. And in the run-up to Christmas 2026, with Black Friday parcels landing in the same fortnight as the usual Q4 crush, that gap is wider than at any other point in the year.

So here's what has genuinely changed in this year's wave, why your filters keep waving it through, and what to do about it without becoming insufferable at the dinner table.

The tell that isn't a tell anymore

Older smishing was easy to spot. A Hotmail address, a mangled URL, spelling that fell apart around the second sentence. The 2026 crop is tidier and considerably more annoying.

Scammers now register domains that read plausibly — royalmail-redelivery.co.uk, evri-parcelhub.com, dpd-support.co.uk — and stick a proper TLS certificate on them, because Let's Encrypt has no opinion on whether you're actually a courier. Some of the more ambitious operations park the landing page on a subdomain of a compromised small-business site, so the registrable domain carries years of history and the link looks like tracking.genuine-looking-business.co.uk/rm/....

Then there's the link layer. A shortener hops you through two or three redirects before landing on the phishing form, which means the domain that appears in the message is not the domain that harvests your card details. A few campaigns skip the link entirely and ask you to reply with your postcode — a low-effort way to confirm a live number for the next round.

The uncomfortable geeky point: these domains authenticate perfectly well. They have SPF, DKIM and DMARC records, because the scammer owns the domain and can publish whatever they like. Authentication answers did this domain send this message, not is this domain honest. Filters that treat a DMARC pass as a trust signal are being charmed by a forged reference letter.

Timing is the actual payload

Peak-season scams aren't random. Campaigns cluster in the early evening, when people are home and half-watching television with a phone in hand. They spike the day after a genuine delivery surge, and again in the first week of January when returns and 'held parcel' notices are entirely plausible.

The 24-hour deadline is doing more work than any logo. Urgency suppresses the bit of your brain that checks a URL properly, and £1.45 is deliberately small enough that paying it feels cheaper than thinking about it.

Why the Bayesian filter shrugs

Bayesian classifiers are trained on words. These messages barely have any — twenty-five tokens of transactional language that looks almost identical to a real courier notification. There's no 'Viagra', no all-caps shouting, no suspicious attachments. Score-wise, the message is a blank.

Blocklists struggle too. The sending domains are often days old, the URL shortener is legitimate, and the redirect chain changes hourly. Volume is spread thin: a few hundred messages per domain across hundreds of domains beats twenty thousand from one. And because the payload sits behind a redirect or a form hosted on a reputable platform, URI blocklists only catch the campaign after it's already burned through a chunk of the list.

Mobile networks filter some of it, but SMS has no equivalent of a mailbox provider with a reputation engine. That's why the same scam that Gmail would quarantine often arrives with a cheerful ping.

Filtering rules worth deploying

If you run mail for a UK business, a few practical controls do more than any amount of wishful thinking:

• Courier lookalike rule. Quarantine anything where the display name or subject references Royal Mail, Evri, DPD, Parcelforce or UPS but the From: domain isn't on your short allowlist of that courier's real sending domains.
• Fresh-domain scoring. Feed newly registered domains (under 30 days) into your spam score. Most legitimate courier mail comes from domains older than your mortgage.
• Pattern matching on the shape, not the words. Urgency plus a sub-£5 payment plus a shortened link is a combination real couriers use rarely and scammers use constantly.
• Alignment checks with a hyphen budget. Count hyphens and lookalike characters in the registrable domain. More than two, or a suspicious rn/m swap, and it should be flagged for review rather than delivered.
• Platform-specific tooling. In Microsoft 365, a transport rule or Defender policy handles the courier-lookalike case neatly. In Google Workspace, a content compliance rule with a domain condition does the same job. Self-hosted? SpamAssassin header and uri tests still work fine.
• On the phone, enable unknown-sender filtering on iOS and the built-in spam protection on Android. EE, O2, Vodafone and Three all run some network-level filtering, but it is not a guarantee.

Verify in thirty seconds

Don't tap the link. Open the courier's app or type the domain yourself, then enter the tracking number from the card or the order confirmation. Genuine redelivery fees, where they exist, are paid on the courier's own site after you've pulled up the item. No legitimate UK courier asks you to re-enter full card details, including the CVV, to release a parcel worth less than a coffee. If a message claims customs duty is owed, check the official guidance rather than the link — the handling fee is charged through the courier's own portal.

And ask the boring question: are you actually expecting anything?

Reporting routes that do something

• Forward scam texts to 7726 — free on all UK networks, and the reports feed operator and NCSC filtering.
• Send email versions to the NCSC's Suspicious Email Reporting Service at [email protected].
• Report to the courier's own phishing mailbox; Royal Mail, Evri, DPD and Parcelforce all run one, and takedowns are quicker when the brand is the complainant.
• Lost money or entered card details? Call your bank on 159 and report to Action Fraud.
• If the message hit a work address, tell IT. Corporate filters learn from what staff report, and one forwarded sample can protect the whole tenant.

Expect the pattern to flip in January, when 'your return is on hold' and fake HMRC parcel charges take over from redelivery fees. The branding changes; the urgency doesn't.