"Your parcel is held, pay the fee": the redelivery scam

Escudo guide · Updated July 2026

What the scam looks like

The amount is deliberately tiny, a pound or a few pence, because a small number feels harmless and easy to just pay and move on. That is the trap. It is the same idea Correos customers see in Spain with "paquete retenido" and Correios customers get in Brazil. One script, many flags.

The tells, one by one

• A fee out of nowhere. You did not agree to any redelivery charge. Real postage owed is handled at the door with a card the postie leaves, or in your official courier account, not by a surprise text.
• The web address is not the real one. Royal Mail uses royalmail.com. Scam links look like royalmail-fee.info, evri-redelivery.info or dpd-reschedule.online. Anything hyphenated onto the name, or with an odd ending, is fake.
• It wants your card on a web page. The "fee" is bait to reach a form that asks for your full card number, expiry, security code and often your address. That is the real prize.
• You were not even expecting a parcel, or you were, because most of us usually are. Scammers send millions of these knowing some will land on someone waiting for a delivery.
• The message is vague about what the parcel is. A real delivery update ties to a specific order and sender. The scam text cannot name what you bought or where from, because it never knew. It just says "your parcel" and hopes.

Why the fee is so small

It is worth understanding the trick, because it is clever. A pound or a few pence is beneath the amount you would ring your bank about. It feels too trivial to be a scam, so your guard drops. But the fee is never the goal. The scammer does not want your pound. They want the card number, expiry, security code and address you type onto the payment page. With those, they can charge you for far more, or sell the details on within minutes. A tiny ask is the doorway to a large loss. The moment a surprise "small fee" arrives by text with a link, that smallness should make you more suspicious, not less.

What to do, in order

1. Do not tap the link. Not even out of curiosity.
2. Check the tracking yourself. Go to royalmail.com directly, or use the courier's own app, and enter the tracking number from the sender you actually ordered from.
3. If you use the Royal Mail app or a courier account, real updates live there, not in a random text with a link.
4. Report it, then set it aside. Forward the text to 7726 free of charge, it spells SPAM on the keypad. On iPhone you can also report it as junk.

Already tapped it or entered your card?

• Call your bank now using the number on the back of your card. Ask them to freeze the card and watch for charges.
• If you entered your address and details, be alert for follow up calls pretending to be "fraud support". The same gang often rings next to finish the job. Hang up and call your bank yourself.
• Change any password you reused on the fake page.
• Report to Action Fraud at actionfraud.police.uk or 0300 123 2040. In Scotland, report to Police Scotland on 101.

For the calm, step by step version, see you already tapped a scam link. The cousin of this scam is the fake bank text, and it often arrives the same week.

What if it reaches my mum or dad?

A parcel fee text is easy to fall for precisely because it is boring and small. No drama, just "pay a pound". The people most at risk are the ones who never see a guide like this. The same delivery scam runs in Portugal as fake CTT messages and in Spain as fake Correos texts. It is one playbook, translated per country. To see how the whole operation works, read how SMS scam gangs actually operate.

That is what the Escudo app is for: it helps filter these known scam patterns on the iPhone and quietly sets them aside before they are read. It cannot judge whether one specific parcel text is real, and it does not pretend to. Nothing is deleted, it is only moved to a junk folder, and your messages never leave your phone.