Scam texts in the UK: how to spot fake parcel, HMRC and bank messages

Scam texts work because they look like the messages we get every day: a delivery update, a note from HMRC, a fraud check from the bank. The link is the trap — it leads to a convincing copy of a real website that asks for a 'small fee', your card details or a login. The good news is that the real organisations have published exactly how they do and don't contact you, so most fakes can be caught in seconds.

The scam texts people in the UK see most

• Parcel and delivery — 'We couldn't deliver your package, please pay a fee' is the example Royal Mail gives on its scam-protection page.
• HMRC — messages about a tax refund, a penalty or something that needs paying urgently.
• DVLA — a vehicle tax refund or a problem with your licence or vehicle tax, with a link to 'sort it out'.
• Your bank — 'Did you make this payment?' or 'Your account has been locked', followed by a link or a request to call a number.

What the genuine messages look like

• Royal Mail says it only contacts you by email or text if the sender asked for tracking updates when posting the item. A fee request out of the blue is a red flag — the one caveat Royal Mail mentions is customs charges, which you can check on its website directly.
• Evri says its texts only come from 'Evri', not from a mobile number, and that it will never ask you to reschedule a delivery or pay to do so.
• HMRC says a contact could be a scam if it rushes you, is threatening or is unexpected, and that it will never ask you to pay with gift or payment vouchers. HMRC does send some texts, so judge the content rather than the fact that a text arrived.
• The DVLA says vehicle tax refunds are issued automatically — never through an email with a link — and that it will never ask for your bank account details.
• Banks: if a message says it's from your bank, contact the bank yourself using the number on its website or the back of your card, or call 159.

How to check without tapping the link

1. Don't tap the link and don't reply — Evri warns that some scam texts ask you to reply 'Y'.
2. Open the organisation's own app, or type its web address yourself, and look for the same message or charge there.
3. For a parcel, check the tracking number on the courier's own website — or ask the sender whether they posted anything.
4. If you're still unsure, call the organisation on a number you already know is real.

How to report a scam text

• Forward the text to 7726. It's free on most UK networks, and the NCSC uses the reports to take scam sites down — it says 40.9K scams across 93.3K URLs had been removed through the 7726 service as of July 2026.
• You can also send a screenshot to [email protected], the NCSC's Suspicious Email Reporting Service.
• HMRC-related texts can be forwarded to 60599 (charged at your network rate); HMRC phishing emails go to [email protected].
• Royal Mail asks for a screenshot of a fake Royal Mail message at [email protected].
• Then delete the text.

If you've already tapped, paid or shared details

1. Call your bank straight away on 159 or the number on the back of your card, and tell them what you shared.
2. Change the password on any account you entered on the fake site — and anywhere else you use the same password — and turn on two-step verification.
3. Report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 if you live in England, Wales or Northern Ireland. In Scotland, report it to Police Scotland on 101.
4. If someone then calls claiming to be your bank or the police and asks you to move money, hang up and call your bank on 159 yourself.

Can a security app help?

Partly. Mainstream browsers already warn about some known scam sites, and the NCSC's advice is to install updates to your apps and your phone's software as soon as they're available. Several security suites add link and scam checking on phones on top of that. It's a useful safety net — especially for family members who are less confident online — but no app replaces the habit of checking through the official app or website before you pay anything.

The message isn't the scam. The link is. Go to the real website yourself, every time.