Who tops the list of home delivery scams in the past year?

Home delivery titans Amazon, DHL, Evri, Royal Mail and UPS are the top five brands impersonated by scammers targeting the UK, and with Christmas fast approaching, Which? is warning shoppers to expect a flurry of fake texts and emails. 

These messages invite you to click links to copycat delivery websites so that scammers can steal your payment details or even retarget you with perfectly timed bank impersonation scams.

Here we tell the story of a home delivery text scam that led to one victim losing £278,000, and we explain what to do when you receive a nuisance or scam message. 

The most impersonated delivery companies

Which? teamed up with the DNS Research Federation (DNSRF), an Oxford-based non-profit, to explore the worst-hit brands when it comes to copycat websites. 

The DNSRF aggregates abuse report URLs (a web address that points to webpage or file on the internet), removes duplicates and matches these to market sectors.

It told us home delivery is the second-most-abused sector, topped only by the technology, media and telecoms sector. There were more than 50,000 reports of copycat websites duping popular home delivery companies in the past 12 months (November 2023 to mid-November 2024). 

We asked which brands were most commonly affected and found that USPS (United States Postal Service) accounted for the vast majority of reports. 

The rest of the top 10 feature brands that operate in the UK, including Amazon, DHL, Royal Mail and Evri, as well as InPost (which operates local lockers for individuals and businesses) and eBay. 

What are the delivery companies doing about it?

We shared these findings with the delivery companies. They told us:

• Amazon offers extensive help pages to help you both identify and report any impersonation scams. 
• DHL says genuine emails will always end in dhl.com, dhl.nl, dhlparcel.nl or dhlecommerce.nl and real payment requests from DHL always state the number of your package (so check that this matches your shipment). 
• Royal Mail has some examples of typical scams. It says in cases where customers need to pay a surcharge for an underpaid item, it will leave a grey Fee To Pay card (and would not request payment by email or text). 
• Evri urges customers to look out ‘the three L’s’: Language – poor language and badly written messages; Lack of – no personal greeting, lack of personal information such as a tracking number of your delivery address; and Links – unusual links or buttons that urge you to take action such as pay a re-delivery fee (something Evri will never charge for).
• InPost has a security section online and said anyone expecting a delivery to one its lockers or a shop will get a message with the parcel number, delivery address, collection code and pick-up reminder. If something seems off, double-check the parcel number and delivery address and report suspected scams to InPost.
• eBay told us the vast majority of communications from eBay, and eBay buyers and sellers, will appear in the Messages tab of the eBay app and website.

Fake home delivery messages

Scammers will typically direct you to fake home delivery websites by sending fake text messages and emails, claiming that you need to rearrange a missed delivery. The public faces phishing and other scams all year round, but with Christmas little more than a month away, your chance of falling for a delivery scams is particularly high. 

The mobile network Three UK told us it noticed a 500% uptick in scam activity in December 2023, compared with the monthly average from August to October. This equated to 170,000 more scam messages than the monthly average of the previous quarter. Three also told us it identified and blocked four million scam messages in December 2023.  

Other networks told us they didn’t see as much of a seasonal spike. For example, EE said approximately 230,000 texts were reported to it in December 2023 (describing it as nothing exceptional) and it blocked approximately 9.2 million scam and spam texts in December 2023, which was only ‘slightly elevated from other months’. 

‘I lost £278,000 to a home delivery text scam’

These impersonation scams can not only be incredibly convincing – they can also have a devastating impact.

A fake Post Office text sparked a chain of events that led to one fraud victim losing a staggering sum. With help from Which? she was finally reimbursed half of her losses earlier this year, after battling for 15 months. 

In October 2022, Sarah (not her real name) received a message with a link to a copycat Post Office website. She entered her card details before twigging it was a dupe and quickly contacted her provider, American Express, to block the card. The following day, she received a call from the ‘American Express fraud department’ seemingly from the correct phone number. But this was an impersonator using number spoofing software, claiming that her banking apps had been hacked following the phishing incident. 

Sarah took precautions, by contacting American Express to confirm the call was genuine, using its live chat function. The adviser told her the number was correct, failing to warn her about the possibility of spoofing. And when she asked if there was an open fraud case about her account, they said yes. They were referring to the phishing text a few days earlier, but this disastrous misunderstanding reassured Rebecca that the call was entirely legitimate. 

She was now firmly under the fraudster’s spell and spent 25 hours over several days on the phone to him. She was told to download AnyDesk (which gave him remote access to her phone) and coached to transfer the money in batches from her main Lloyds account (both via her banking app and at her local branch) to accounts she held with Revolut and Wise, before being moved to various ‘safe’ accounts that were controlled by criminals.

Revolut did suspect something was amiss and referred her to customer support specialists via the app ‘chat’. But Sarah said the transactions were genuine – as instructed by the fraudster – and it wasn’t until she was asked if she had downloaded remote access software that something twigged. She realised it was all a lie, but by then, the money was gone and only £95 was recovered.

The long battle to get refunded

All three firms involved refused to reimburse Sarah. Lloyds said Revolut should bear responsibility, while Revolut said it provided ‘meaningful intervention’ and explicit warnings that were ignored. American Express paid £500 as a gesture of goodwill, admitting its chat adviser had inadvertently created a misunderstanding by referring to a live fraud case. 

We told Sarah each of the firms involved missed key opportunities to ‘break the spell’, the most striking example being when she initially told Revolut that she was on the phone with American Express, who had told her to move the money. This should’ve been a clear sign that she was being coached by fraudsters. 

Sarah escalated her complaints to the Financial Ombudsman Service (FOS). It reached a final decision in January 2024, instructing Revolut and Lloyds to refund 50% of her losses, equivalent to £137,500, between them.

Revolut told Which? in March that it ‘engaged with and supported FOS with its investigation’, adding that it is ‘deeply concerned that large numbers of frauds are being enabled by criminals using fake and spoofed phone calls.’ It called for criminals to be stopped at the source, to prevent them using convincing-looking fake texts and phone calls.  

Lloyds said it accepts the Ombudsman’s decision and reminded customers that banks will never ask them to move money to protect it, in any circumstances. American Express declined to comment on this case. 

• Find out more: best and worst banks for fraud refunds

What should you do if you receive a fake text?

Don’t respond to any suspicious messages, click on links or provide personal details. 

Instead, report the message by forwarding it to 7726 (for free) so that your network can investigate. Then delete the message and block the contact. 

If you aren’t sure whether a message is genuine, get in touch with the company or organisation it claims to be from. Never use any of the contact details from the text – go to the organisation’s website directly to find more info.  

Check your phone’s security settings for features aimed at reducing unwanted messages and calls, such as spam filters and call blocking.

If you’ve been scammed, call your bank immediately using the number on the back of your bank card and report it to Action Fraud, or call the police on 101 if you live in Scotland.