As millions of Britons hunt for Black Friday bargains to complete their Christmas shopping, a sophisticated fraud scheme is creating a golden opportunity for criminals. Dubbed the 'spray and pay' parcel delivery scam, this criminal tactic preys on the confusion of shoppers who lose track of their online orders.
How the 'Spray and Pay' Scam Works
The fraud begins with a simple text message. It typically claims that a delivery attempt for a parcel has failed and instructs you to click a link to rearrange delivery. The messages are deliberately vague, lacking personal details like your name or order information, but create a sense of urgency.
One example highlighted by Virgin Media O2 reads: "Sorry! for the inconvenience but there seem's to be a problem with your parcel. Please visit: [scam website] to resolve this. Thanks!" Another common version states: "When our driver attempted to deliver today, nobody was present. Visit [scam website] to track and reschedule delivery."
Once you click the link, you are directed to a website that convincingly mimics a legitimate courier service. You are then asked to pay a small redelivery fee, usually around £1-£2. This is the criminal's hook.
The Real Cost of a Small Fee
According to Lee Howard, Head of Information Security at Evri, the request for a redelivery fee is a clear red flag. "We will attempt delivery three times before an item is returned. We will never charge a re-delivery fee," he states emphatically.
The small payment is not the end goal. Murray Mackenzie, Virgin Media O2’s Director of Fraud Prevention, explains that criminals are mining for valuable personal and financial data. "The best-case scenario from a fraudster is you share payment information. Their goal here is to monetise what you provide to them," he says.
The consequences can be severe. The information you provide can be used to redirect future genuine parcels, or your email and phone number can be sold to other criminals for future, more sophisticated scams. Some Guardian readers reported that details given in response to these texts were later used by fraudsters impersonating their bank.
Record Fraud Levels and Official Warnings
The scale of the problem is significant. The government, mobile phone operators, and delivery companies have all issued warnings as fraud reaches record levels in the run-up to Christmas.
Courier company Evri reported a staggering 10,000 cases of delivery fraud between November 2024 and January 2025. The National Cyber Security Centre (NCSC) has also warned that these text messages can contain links that install malicious software (malware) designed to steal personal details directly from your device.
How to Protect Yourself from Parcel Scams
Protecting yourself requires vigilance. Mackenzie advises, "If you're expecting five parcels and you get 27 text messages, then 22 of them are not going to be legitimate."
Here are the key steps to stay safe:
- Be aware of who is delivering your parcels. If you ordered from a retailer that uses DPD, expect contact only from DPD.
- Check for personal details. Legitimate messages often reference your name or order number. Be wary of generic texts.
- Never pay a redelivery fee. Major couriers do not charge small fees for rearranging a delivery.
- If you make a mistake and share bank details, contact your bank immediately.
- Report fraudulent texts by forwarding them to 7726, then delete them. This helps phone companies block the scam.
By staying alert and knowing the signs of this 'spray and pay' fraud, you can ensure your Black Friday bargains arrive safely, without lining the pockets of criminals.
