Households across the United Kingdom are being urged to stay vigilant against a widespread parcel delivery fraud known as the 'spray and pay' scam. The sophisticated operation involves criminals sending out thousands of deceptive text messages daily, preying on the millions of people expecting online orders.
How the 'Spray and Pay' Scam Operates
The fraud works by bombarding mobile phones with SMS messages that appear to be from legitimate courier companies like Evri, DPD, or Royal Mail. These texts typically claim a parcel delivery was attempted but failed, prompting the recipient to click a link to pay a small 'redelivery fee' or to rearrange delivery.
Between November 2024 and January 2025 alone, the delivery firm Evri recorded 10,000 cases of this type of fraud being reported to them. Lee Howard, Evri's head of information security and information risk, explained the tactic's effectiveness. "The 'spray and pay' method of sending out thousands of messages each day means some will probably reach people who are really expecting a parcel," he stated.
Howard was keen to debunk the fraudsters' central claim. "Lots of these try to charge a 'redelivery fee' which is nonsense – we will attempt delivery three times before an item is returned. We will never charge a re-delivery fee," he clarified.
Examples of Fraudulent Messages
Virgin Media O2's fraud prevention team has highlighted several convincing examples of the scam texts currently in circulation. These include messages such as:
"Sorry! for the inconvenience but there seem’s to be a problem with your parcel. Please visit: [scam website] to resolve this. Thanks!"
Another common version reads: "When our driver attempted to deliver today, nobody was present. Visit [scam website] to track and reschedule delivery."
A third example states: "Your package is waiting at your local depot. To arrange a delivery date, go to [scam website]."
The Real Goal: Your Data and Money
Murray Mackenzie, Virgin Media O2’s director of fraud prevention, outlined the multiple dangers for victims. "The best-case scenario from a fraudster is you share payment information. Their goal here is to monetise what you provide to them," he warned.
However, the risks extend far beyond immediate financial loss. Mackenzie explained that even providing an email address and password for a fake delivery site login can have severe consequences. "That allows them to redirect future parcels. It may be that they just obtain your email address and phone number through a contact form and then that makes you susceptible to future scams," he added.
How to Protect Yourself from Delivery Scams
Experts advise a simple but effective rule of thumb for identifying these fraudulent messages. "If you’re expecting five parcels and you get 27 text messages, then 22 of them are not going to be legitimate," said Mackenzie.
The key advice from security professionals is to always verify the sender. "Be aware of who’s delivering your parcels. If a delivery is going to be sent by DPD, Evri, or Royal Mail, expect contact from them and no one else," Mackenzie emphasised.
Consumers are reminded never to click on links in unsolicited texts about deliveries. Instead, they should track parcels directly through the retailer's website or the official app of the genuine courier company they are expecting. Any request for a payment to release a parcel should be treated as a major red flag and reported to Action Fraud.
