Which? reveals Top 5 brands impersonated by scammers in the UK

Home delivery companies Amazon, DHL, Evri, Royal Mail and UPS are the top five brands impersonated by scammers targeting the UK. And with Christmas fast approaching, Which? is warning shoppers to expect a flurry of fake texts and emails. 

Which? teamed up with the DNS Research Federation (DNSRF), an Oxford-based non-profit, to explore the worst-hit brands when it comes to copycat websites. 

It found that home delivery is the second-most-abused sector, topped only by the technology, media and telecoms sector. There were more than 50,000 reports of copycat websites duping popular home delivery companies in the past 12 months (November 2023 to mid-November 2024). 

It asked which brands were most commonly affected and found that USPS (United States Postal Service) accounted for the vast majority of reports.  The rest of the top 10 feature brands that operate in the UK, including Amazon, DHL, Royal Mail and Evri, as well as InPost (which operates local lockers for individuals and businesses) and eBay. 

Typically, scammers work by directing their victims to fake home delivery websites by sending fake text messages and emails, claiming they need to rearrange a missed delivery.

Mobile network Three UK told Which? it noticed a 500% uptick in scam activity in December 2023, compared with the monthly average from August to October. This equated to 170,000 more scam messages than the monthly average of the previous quarter. Three also said it identified and blocked four million scam messages in December 2023.  

Other networks, however, said they didn’t see as much of a seasonal spike. For example, EE said approximately 230,000 texts were reported to it in December 2023 (describing it as nothing exceptional) and it blocked approximately 9.2 million scam and spam texts in December 2023, which was only ‘slightly elevated from other months’. 

Says Lisa Webb, Which? Consumer Expert: 

“With many of us expecting Black Friday orders and Christmas gift deliveries at this time of year, it’s no surprise that delivery firms are one of the sectors most commonly impersonated by scammers. 

“Messages received out of the blue about missed deliveries are best treated with a bit of suspicion. If you’re in any doubt about whether a message you’ve received is legitimate, use the original order confirmation email from the retailer to check who will be delivering your parcel and track it. 

What are delivery companies doing about it?

Which? shared its findings with the delivery companies. These are their responses:

• Amazon offers extensive help pages to help you both identify and report any impersonation scams. 
• DHL says genuine emails will always end in dhl.com, dhl.nl, dhlparcel.nl or dhlecommerce.nl and real payment requests from DHL always state the number of your package (so check that this matches your shipment). 
• Royal Mail has some examples of typical scams. It says in cases where customers need to pay a surcharge for an underpaid item, it will leave a grey Fee To Pay card (and would not request payment by email or text). 
• Evri urges customers to look out ‘the three L’s’: Language – poor language and badly written messages; Lack of – no personal greeting, lack of personal information such as a tracking number of your delivery address; and Links – unusual links or buttons that urge you to take action such as pay a re-delivery fee (something Evri will never charge for).
• InPost has a security section online and said anyone expecting a delivery to one its lockers or a shop will get a message with the parcel number, delivery address, collection code and pick-up reminder. If something seems off, double-check the parcel number and delivery address and report suspected scams to InPost.
• eBay told us the vast majority of communications from eBay, and eBay buyers and sellers, will appear in the Messages tab of the eBay app and website.

What should you do if you receive a fake text?

Don’t respond to any suspicious messages, click on links or provide personal details. 

Instead, report the message by forwarding it to 7726 (for free) so that your network can investigate. Then delete the message and block the contact. 

If you aren’t sure whether a message is genuine, get in touch with the company or organisation it claims to be from. Never use any of the contact details from the text – go to the organisation’s website directly to find more info.  

Check your phone’s security settings for features aimed at reducing unwanted messages and calls, such as spam filters and call blocking.

If you’ve been scammed, call your bank immediately using the number on the back of your bank card and report it to Action Fraud, or call the police on 101 if you live in Scotland.