A Royal Mail text or email can look convincing, especially when you are expecting a parcel. This guide gives you a repeatable way to check delivery messages safely, recognise red flags, and respond quickly if you clicked a link, paid money, or shared personal information.
Overview
Scam messages often imitate familiar delivery situations: a missed delivery, an incomplete address, an unpaid fee, a request to reschedule, or a small redelivery charge. The message may use Royal Mail branding, a parcel reference, and language designed to make you act before checking.
The safest rule is simple: do not use the link, phone number, attachment, or reply option in an unexpected delivery message. Instead, open the official Royal Mail website or app independently, type the address yourself, and check the parcel using information you already have. If you do not have a tracking number, contact the sender or retailer through a separate, trusted route.
A genuine-looking message is not proof of authenticity. Sender names can be copied, email addresses can be disguised, and a message can contain accurate details gathered from a data leak or a public order notification. Treat the message as unverified until the request makes sense and the same information can be confirmed independently.
Checklist by scenario
You receive a Royal Mail scam text
- Pause. Do not tap the link, call the number, reply, or download anything.
- Read the request carefully. Be cautious if it asks for a payment, full card details, account credentials, a password, or personal information to release or redirect a parcel.
- Look at the web address without opening it. A shortened address, an unusual domain, a misspelling, or a domain that does not clearly belong to the relevant official service is a warning sign. A padlock alone does not prove that a site is genuine.
- Open a new browser window and navigate to the official Royal Mail website yourself. Use its tracking or help tools rather than the message link.
- Keep the text as evidence if you plan to report it, then delete it after taking any necessary screenshots.
You receive a Royal Mail scam email
- Check the complete sender address, not just the display name. Be wary of extra words, random characters, misspelled domains, and addresses that do not match the organisation named in the email.
- Inspect the destination of buttons and links without clicking. On a computer, hover over a link; on a phone, use the available preview carefully. Do not enter information merely because the page uses familiar colours or logos.
- Check whether the email creates artificial urgency, threatens a failed delivery, or says you must act immediately to avoid a fee.
- Be cautious with attachments, including delivery notes, invoices, and address forms. Do not open an unexpected attachment simply because you are waiting for a parcel.
- Verify the order through the retailer or sender using a website, app, or phone number you already trust. Do not use contact details supplied only in the suspicious email.
You receive a redelivery or unpaid-postage request
Do not assume a small payment is harmless. A low-value charge can be used to obtain card details, billing information, or access to a payment account. Check the parcel status independently and consider whether the message matches a real purchase, the expected delivery timeframe, and the address used for the order.
If you need genuine delivery help, start from Royal Mail's official website. For related guidance, see our Royal Mail missed delivery guide and guide to tracking that is not updating. These checks should be completed without relying on the suspicious message.
You receive a fake postage, customs, or parcel-fee claim
Claims about postage, customs, or an outstanding delivery fee deserve the same independent check. Do not trust a message simply because it includes a parcel number or references an international shipment. Confirm the number through the official tracking route and review the original order documentation. If you are sending a parcel yourself, use the official postage information you selected at the time of posting; our parcel sizes and services guide and postage calculator guide can help you review the expected service details.
Red-flag comparison table
| Message feature | Why it needs checking | Safer response |
|---|---|---|
| Unexpected link to arrange delivery | The link may lead to a lookalike login or payment page. | Open the official site independently and track the parcel there. |
| Request for a small redelivery fee | The payment page may capture card or identity details. | Verify the delivery status and fee through an official route before paying. |
| Urgent deadline or threat of return | Pressure reduces the time available for careful checking. | Pause and verify with the retailer, sender, or carrier directly. |
| Sender name looks familiar | Display names and branding can be copied. | Check the full sender address and avoid embedded links. |
| Parcel number included | Real-looking details do not establish that the message is genuine. | Enter the reference manually on the official tracking page. |
| Attachment or form to complete | It may contain malware or request unnecessary information. | Do not open it; confirm the shipment through a separate channel. |
What to double-check
- The web address: Check the actual domain, spelling, and path. Fraudsters may place a legitimate-looking word in a longer, unrelated address.
- The request: Ask whether the message is requesting information that a delivery service genuinely needs. Never provide a password, one-time security code, or full payment credentials to an unexpected contact.
- The context: Compare the message with your orders, delivery dates, shipping address, and tracking references. A message that arrives when you are not expecting anything still requires verification.
- The payment page: Do not assume that a professional design, security symbol, or familiar logo makes a page safe. The address and route you used to reach it matter.
- The contact route: Use contact details from an official website, retailer account, order confirmation, or card statement—not from the suspicious message.
If you have clicked but did not enter information, close the page and run the security checks available on your device. Update your browser and security software if updates are pending. If you entered a password, change it immediately from the genuine website and change it anywhere else you reused it. If you entered card or bank details, contact your bank or card provider using the number on the card or an official statement, explain what happened, and follow its instructions. Keep screenshots, the original message, transaction records, and dates.
Report the message using the current reporting route listed by Royal Mail and the relevant official fraud-reporting service for your country. Reporting guidance can change, so reach it by typing the official organisation's address yourself. If money has been taken or an account has been compromised, report that to your financial provider promptly as well.
Common mistakes
- Clicking to “check” the message: A link does not become safe because you have not yet entered details. Start from an independent official route.
- Relying on the sender name: The visible name is not the same as the verified email address or phone source.
- Calling the number in the text: A fraudster can keep the conversation going and create more pressure. Find the number independently.
- Paying first and investigating later: Contact your bank immediately if you have paid. Do not wait for the parcel status to change.
- Deleting evidence too soon: Save the message, link, screenshots, payment record, and relevant account alerts before removing it.
- Assuming a real order proves the message is real: Scammers can use current purchases or leaked information to make a message more believable.
When to revisit
Use this checklist whenever a delivery message asks you to click, pay, sign in, download, or provide personal information. Revisit it during busy shopping periods, after moving home, when using international delivery, or whenever you receive a message that does not match your order records. Delivery workflows, official reporting routes, website addresses, and common scam patterns can change, so check the current Royal Mail guidance before relying on an older screenshot or saved contact detail.
Before acting, use this short routine: pause, inspect, verify independently, then respond. If the message fails any part of that routine, do not interact with it. Use the official tracking or customer-support route, preserve evidence, and contact your bank promptly if financial information was involved. For questions about returning a parcel, consult our Royal Mail parcel returns guide rather than following an unsolicited return link.
