A text arrives on your phone. It looks like it's from DPD. It says your parcel couldn't be delivered and you need to pay a small redelivery fee — usually somewhere between £1.45 and £2.99 — or your package will be returned. There's a link. There's a deadline. It arrives exactly when you might be expecting a delivery.
It is not from DPD. It is a scam.
DPD delivery text scams — known technically as smishing, or SMS phishing — are among the most widely reported fraud campaigns in the UK. They work because they are timed to feel plausible, they use real branding, and they exploit the fact that most of us order things online constantly and can't always remember exactly what's arriving when.
This guide explains exactly how the DPD text scam works, what every variant looks like, the specific red flags that identify every fake message, and what to do whether you spotted it in time or already clicked.
What Does a DPD Scam Text Actually Look Like?
The messages have evolved significantly. Early versions were easy to spot — poor grammar, vague details, obviously wrong domains. Current versions are considerably more convincing. Here are the most commonly reported phrasings:
"DPD: We tried to deliver your parcel however no one was available to receive it. To arrange your redelivery, please proceed via: [link]"
"DPD notification: Your parcel could not be delivered. A redelivery fee of £1.45 is required to reschedule: [link]"
"Your DPD parcel could not be delivered due to an incomplete address. Please confirm your details here to arrange redelivery: [link]"
"DPD: Your package is being held at our depot. To avoid return, please complete verification and pay the storage fee of £2.50: [link]"
"DPD: Action required — your parcel will be returned to sender in 24 hours unless you update your delivery preferences: [link]"
The messages share a consistent structure: a claim that delivery failed, a plausible-sounding reason, a small fee or "verification" requirement, a link, and urgency. The fee is always kept deliberately low — low enough that many people pay without thinking twice.
What is new in 2025 and 2026 is the delivery mechanism. Scammers are increasingly sending these messages via iMessage and Android's Rich Communication Services (RCS) rather than standard SMS. Both protocols use end-to-end encryption, which prevents mobile carriers from scanning messages for malicious links and blocking them before they reach you. iPhone users are particularly targeted through iMessage campaigns, often sent from international numbers with country codes from the Philippines (+63) or Morocco (+212) to make mass-sending cheaper.
How the DPD Text Scam Works Step by Step
Understanding the full sequence is the most useful thing for recognising it — and for explaining it to others who might be less alert.
Step 1 — The message arrives
You receive a text claiming to be from DPD. It uses DPD's branding, sometimes displays "DPD" as the sender ID (which can be spoofed), and references a parcel, a missed delivery, or an outstanding fee. The language is urgent: act within 24 hours or the parcel will be returned.
Step 2 — The link
The message contains a URL. It may look plausible at a glance — it might include the word "dpd", "delivery", or "parcel" — but it does not go to dpd.co.uk or dpdlocal.co.uk. It goes to a fraudulent site specifically built to look like DPD's website.
Step 3 — The fake website
The copycat site is convincing. It uses DPD's colours, logo, and layout. Which? researchers who investigated one version noted that the only visible errors were in date formatting (the site showed dates like "-1 August" and "0 August") and that the site blocked screenshots — a sign that its operators were aware of being investigated. Visitors who don't notice these details will see what appears to be a legitimate DPD page.
Step 4 — Data collection
The site asks you to confirm your delivery details and pay the redelivery fee. The form collects your name, home address, phone number, email address, and full card details including the security code. Some variants also ask for your date of birth or National Insurance number under the guise of "identity verification."
Step 5 — The consequences
Once submitted, your details go to the scammer. The immediate consequence is an unauthorised charge on your card. The longer-term ones are more serious: your card details may be sold, your personal information combined with other records to build an identity profile, your email and phone added to "responsive" lists for future fraud attempts, and in some cases your account credentials stolen if the site prompts a login.
In certain variants — particularly those that encourage you to download a "tracking app" or open a file — malware is installed on your device. The UK's National Cyber Security Centre has specifically warned about missed-parcel scam texts that can deliver malware through this route.
The Red Flags That Give Every Fake DPD Text Away
You don't need to be a fraud expert to identify these. The pattern is consistent across every variant.
You weren't expecting a delivery from DPD. The scam works best when you are expecting something — but millions of messages are sent to people who aren't. If you haven't ordered anything arriving via DPD, the message is fraudulent by definition.
It's asking for a redelivery fee. DPD does not charge for redelivery of standard parcels. If you genuinely missed a delivery, DPD rearranges it through your original retailer or through its app and website — no payment required. Any text asking for a payment to release or redeliver a parcel is a scam, regardless of the amount.
The link isn't dpd.co.uk or dpdlocal.co.uk. DPD's two legitimate UK tracking domains are dpd.co.uk and dpdlocal.co.uk. DPD itself states that notification links should always point to one of these. Any link using a different domain — including variations like dpd-delivery.co, dpd-parcel.com, or any URL shortener — is fraudulent. Look at the full URL before tapping anything.
It came from a mobile number rather than "DPD". Genuine DPD texts display "DPD" as the alphanumeric sender ID, not a phone number. A message from a mobile number — UK or international — claiming to be from DPD is not genuine. Note: sender IDs can be spoofed, so a text displaying "DPD" is not automatically verified as real — the content still needs to be evaluated.
There is a tight deadline. Artificial urgency — "your parcel will be returned within 24 hours" — is designed to stop you from pausing and verifying. Real DPD missed-delivery notifications don't threaten immediate return and don't give you hours to act.
The message is generic. Real DPD notifications include your name, a tracking number, and the sender's name or order reference. A message that opens with "Your parcel" rather than your name, and contains no tracking reference, is not from DPD's systems.
It arrived via iMessage from an unfamiliar international number. Scammers using iMessage to bypass SMS filtering often come from numbers with overseas country codes. A delivery notification arriving as an iMessage from a number you don't recognise, with no prior message history, should be treated as suspicious regardless of what it claims to be from.
Fake vs Real: How to Tell a Genuine DPD Message from a Scam
The quickest and most reliable check is this: go directly to dpd.co.uk and enter your tracking number there. If the delivery is real, it will show in the tracking system. Do not use the link in the message you received.
Beyond that, here's what genuine DPD communications look like:
Genuine DPD texts display "DPD" as the sender ID. They reference a specific tracking number. They include your name. They do not request payment. They do not contain links to payment pages. They direct you to the DPD app or official website. They appear in a thread with previous DPD messages if you've used them before.
Genuine DPD emails come only from @dpd.co.uk, @dpdlocal.co.uk, or @dpdgroup.co.uk. They include your name and a tracking number. They do not ask for card details or payment via the email. They link only to dpd.co.uk or dpdlocal.co.uk.
DPD has stated publicly that it only sends emails from those three domains, and that its legitimate tracking links go only to dpd.co.uk or dpdlocal.co.uk. It has also recommended that customers download the "Your DPD" app to receive push notifications instead of texts and emails — the app is a more reliable source of genuine delivery updates than any message.
The most important rule: DPD will never ask you to pay a fee via a link in a text message. If the text contains a payment request, it is a scam.
Similar Scams Using Other Courier Brands
The DPD scam is part of a wider campaign that rotates between courier brands. The same fraudulent infrastructure — bulk messaging tools, copycat websites, stolen branding — is used to send equivalent texts impersonating Royal Mail, Evri (formerly Hermes), Amazon Logistics, and UPS.
The script is identical across all of them: missed delivery, small fee, urgent deadline, fake link. Scammers rotate between brands to stay ahead of public awareness — once enough people recognise the DPD version, campaign emphasis shifts to Royal Mail or Evri, then back again.
The rules are the same for all couriers. Royal Mail does not send payment links by text. Evri does not charge redelivery fees via SMS. If any courier text asks for card details via a link, it is fraudulent, regardless of which brand it claims to be from.
For the same smishing approach applied to government impersonation, see our guide to DWP scam text messages and how to spot them — the psychological mechanics and red flags are identical.
What to Do If You Receive a DPD Scam Text
The right response is quick and requires no engagement with the message:
1. Do not click the link and do not reply. Even replying "STOP" confirms your number is active and monitored, making it more valuable to scammers for future attempts.
2. Forward the text to 7726 (SPAM). This is free on all major UK networks — EE, O2, Vodafone, Three, and others. Forwarding to 7726 feeds into carrier-level spam-blocking systems and helps protect other people from the same campaign.
3. Report to the NCSC. Forward the text to [email protected] — this is the National Cyber Security Centre's reporting address for suspicious messages, used to track and disrupt active campaigns.
4. Report to Action Fraud. Online at actionfraud.police.uk or by phone on 0300 123 2040. If you've lost money, this creates an official record that supports any bank dispute or reimbursement claim.
5. Block the number and delete the message. This prevents accidental clicks and reduces the chance of follow-up attempts from the same number.
6. Check your real delivery status by typing dpd.co.uk directly into your browser address bar and entering your tracking number there. Never use the link from the message.
What to Do If You Already Clicked
If you clicked but didn't enter any information:
Close the browser tab immediately without entering anything. Clear your browsing history and cookies for that site. Run a security scan using a reputable tool such as Malwarebytes. Monitor your accounts for unusual activity over the following days. If your device behaves unusually — unexpected battery drain, apps crashing, unexpected data usage — take it to a professional, as some variants can deliver malware through the browser.
If you entered personal information (name, address, email, date of birth, National Insurance number):
Report to Action Fraud immediately at actionfraud.police.uk. Place a fraud alert with the three UK credit reference agencies — Experian, Equifax, and TransUnion — to prevent scammers from opening credit accounts in your name. Monitor your credit report for any applications you don't recognise. Be alert for follow-up phishing attempts by email and phone, as scammers frequently use data from one campaign in secondary attacks.
If you entered card details or made a payment:
Call your bank immediately. Ask them to flag the account for fraud and issue a new card. The "small fee" is just the opening — your card details are the real target, and further unauthorised charges often follow. Banks are familiar with this scam and will act quickly.
Under Authorised Push Payment (APP) scam rules, your bank may be required to reimburse you if you were deceived into making a payment. Acting quickly and keeping records of when you called significantly improves your chances.
How Your Number Ends Up on These Lists
DPD scam texts are not sent to random numbers — they are sent to lists. Those lists are compiled and sold through a data ecosystem that most people don't know exists.
The typical route: you sign up for an online retailer, competition, or service using your real email address and phone number. That service shares or sells its user data. A data broker links your email to your name, phone number, home address, and purchasing habits. That enriched record eventually finds its way into databases used by fraudsters — either through data broker channels or through breaches of the broker's own data.
The connection between email data and text scams is direct: once your email is in a broker's database, cross-referencing with phone number records is routine. The more places your real contact details appear online, the more likely your number is on multiple targeting lists.
Using a disposable email address for online sign-ups — particularly for retailers, competitions, and services you're unsure about — means any breach or sale of that sign-up data contains a throwaway address rather than your real contact details. That breaks the chain before your real information enters the data broker pipeline. VanishInbox generates a working temporary inbox instantly with no account required — use it for any sign-up where you're not certain about the service's data practices. For a full explanation of how that pipeline works, see what actually happens when a website sells your email address.
For a broader look at protecting all your personal contact details from these data flows, see how to protect your personal information online.
Why This Scam Is So Effective
The DPD text scam has persisted and evolved for years because it is unusually well-aligned with real user behaviour. Most people in the UK receive regular parcel deliveries. Most people don't track every expected delivery with precision. A missed delivery notification feels normal — not suspicious — because missed delivery notifications are a normal part of online shopping.
Scammers exploit three specific psychological mechanisms:
Authority bias. A message appearing to come from a well-known brand like DPD carries automatic credibility. The brain extends trust to familiar logos and brand names without requiring verification.
Urgency. A 24-hour deadline prevents the rational process of pausing, verifying, and asking someone else what they think. The more urgency the message creates, the less likely the recipient is to question it.
The small fee. A request for £1.45 doesn't trigger the same alarm response as a request for £145. The small amount is deliberately calibrated to sit below the threshold where most people ask questions. Once card details are entered, that threshold no longer applies.
Understanding these mechanisms makes the scam easier to resist. The moment you notice urgency being created by a delivery text, that urgency is a red flag rather than a reason to act.
Frequently Asked Questions
Is it safe to click a DPD link just to check if it's real?
No. The entire point of a phishing site is that it looks real. Visiting a fake DPD site will show you something that looks like DPD's website — that tells you nothing about whether it's genuine. Visiting it may also expose your device to tracking scripts or malware. Always check your delivery status by typing dpd.co.uk directly into your browser.
I received a text from "DPD" — does the sender name mean it's real?
No. Sender IDs like "DPD" can be spoofed. Scammers can make a text appear to come from any alphanumeric sender name, including the real DPD. The sender display name is not a reliable indicator of authenticity. Evaluate the content — if it contains a payment link or requests personal details, it's fraudulent regardless of what the sender field shows.
The text has a tracking number in it. Does that mean it's genuine?
Not necessarily. Some more sophisticated scam messages include tracking number formats that look plausible. Take that tracking number and enter it manually at dpd.co.uk. If the delivery is real, it will appear in the system. If it doesn't appear on the official site, the message is fraudulent.
DPD has charged me for redelivery before. Isn't that normal?
DPD does not charge for standard redelivery of parcels within the UK. If there was a customs or import fee on an international shipment, that would be communicated through official channels and typically collected by the retailer or at the point of delivery — not via a random link in a text message. Any payment request via SMS is a red flag.
Can I get my money back if I paid the fee?
Contact your bank immediately. Under APP scam rules, banks may be required to reimburse you if you were deceived into making a payment. Acting quickly — ideally within hours — significantly improves your chances. Also report to Action Fraud at actionfraud.police.uk to create an official record.
Why am I receiving these texts if I didn't sign up for DPD notifications?
Because the text is not from DPD. It came from a scammer who has your phone number — likely acquired through a data broker or a breach of a service you've used. You don't need any relationship with DPD to receive a text impersonating them. The messages are sent in bulk to phone number lists, not to known DPD customers.
I clicked the link and now my phone is acting strangely. What should I do?
Run a full security scan using Malwarebytes or a similar tool. If unusual behaviour continues, change your passwords from a separate clean device first (starting with email and banking), then back up your data and consider a factory reset to remove any user-level malware. On iPhone, the risk from tapping an iMessage link is lower but not zero — close the tab, clear history and website data for that site in Settings, and monitor for unusual activity.
For more on how phishing and social engineering work across email and other channels, see how to spot a phishing email. If you want to understand how your contact details end up in the databases these scammers draw from, what actually happens when a website sells your email address explains the full picture.
