As millions of Britons snap up Black Friday bargains for Christmas, a sophisticated parcel delivery scam is sweeping across the UK, putting shoppers' personal and financial information at risk.
The 'Spray and Pay' Fraud Explained
Criminal gangs are capitalising on the post-Black Friday delivery chaos by sending thousands of fraudulent text messages to mobile phones nationwide. The scam, known as 'spray and pay', involves texts claiming that a delivery attempt has failed and requesting a small redelivery fee, typically around £2.
Lee Howard, head of information security at delivery company Evri, reveals the scale of the problem: 'We had 10,000 cases of delivery fraud reported to us between November 2024 and January 2025.' He emphasises that legitimate couriers like Evri will never charge redelivery fees, making any such request immediately suspicious.
How the Scam Operates
The fraudulent messages often read: 'Sorry! for the inconvenience but there seem's to be a problem with your parcel' or 'When our driver attempted to deliver today, nobody was present.' They include links to fake websites that closely mimic genuine courier services.
Murray Mackenzie, Virgin Media O2's director of fraud prevention, explains the criminals' strategy: 'The best-case scenario from a fraudster is you share payment information. Their goal here is to monetise what you provide to them.'
Victims who click these links may be asked to provide not just payment details but also email addresses and passwords, which criminals can use to redirect future parcels or launch additional scams.
Protecting Yourself from Delivery Fraud
Security experts recommend several precautions during the busy Christmas shopping period. Mackenzie advises: 'If you're expecting five parcels and you get 27 text messages, then 22 of them are not going to be legitimate.'
Key warning signs include messages that don't use your name, come from random numbers, or create unnecessary urgency. The National Cyber Security Centre has also warned that some links may attempt to install malware on devices.
If you receive a suspicious message, forward it to 7726 and then delete it. This allows phone companies to block the scam from reaching other potential victims. If you've accidentally provided bank details, contact your financial institution immediately.
