Parcel delivery scam texts to spike this Christmas

The scam messages lead to a convincing website asking for bank details

More than a million scam texts will be sent in the UK this week, and more than half will use parcel deliveries to try to trick consumers.

Organisations monitoring "smishing" fraud are warning people to be extra vigilant this Christmas.

One cyber-security firm, Proofpoint, is seeing ten times more scam messages this year than last.

Vice president of operations Jacinta Tobin said a mix of Covid and Christmas makes the texts more tempting.

"We are totally susceptible, because we trust and we act quickly," she said, with 98% of people reading a text within three minutes.

"And up to only a few years ago texts were used by friends and families."

She said businesses have only recently moved to texts. "So have scammers and it's very effective for them," she added.

"Smishing" or "SMS phishing" is where fraudsters send texts to mobile phones in the hope that people will click on a link and download malicious software or give away private data.

Proofpoint works with regulators and retailers, collating and analysing smishing texts.

Ms Tobin said fraudsters use fear to manipulate us: "We don't want to miss that parcel or present. We are seeing more and more urgent messages warning packages will be returned unless action is taken."

It's easy to get depressed when it comes to scams and think we can never be a step ahead of the criminals.

Web links are rotated simply and cheaply, and scammers adapt their tactics to the season, looking for easy prey.

Although it's never going to be possible to stop scams, it is possible to get quicker at taking them down, and there's more than you might imagine being done to combat these crimes.

Mobile operators, the National Cyber Security Centre, banks, and the biggest online retailers and brands, are all working with the police to share information.

In fact, cyber-security firm Proofpoint told me that the UK has more industry collaboration than any other country they work in.

Each message we report provides a small piece of a jigsaw. It not only keeps other people safe by getting the links taken down, but gradually produces a picture of the criminals pulling the strings behind the scenes.

Criminal gangs

Deliveries are a good lure for now. But after Christmas Proofpoint expects a spike in Boxing Day sales, deals and discounts, and Omicron scam texts.

But the text is just the first half of the fraud.

Katy Worobec heads up the economic crime unit at UK Finance. Her team have been monitoring impersonation scams, which have more than doubled in 2021.

"This is where scammers use the information that they glean from these interactions, then pretend to be from your bank or police and get people to move significant funds between accounts," she said, adding that this money then goes on to be used by large criminal gangs in drugs and human trafficking.

In the first half of this year UK Finance's dedicated crime unit made arrests, taking down 24 criminal gangs and preventing £85m worth of fraud. But the scams keep evolving, and Katy and her team are expecting this Christmas to be particularly problematic.

It's the busiest time of year for deliveries with extra pressure from the coronavirus pandemic. Not only are more people shopping online to avoid crowded stores, but also coronavirus is disrupting delivery services, leading to staff shortages for sickness and isolation.

The Royal Mail said staff sickness was currently double what it would be in a typical year and it has severe staff shortages at the moment.

Hermes has also reported some delays due to staff illness. DPD and UPS said services are running as normal.

Advice

Adam Christie, privacy manager at the Royal Mail, said consumers will never receive just a text or email from them asking for money or more information.

"We love putting things through your letterbox. Do not make any payments until you also receive a card through the door," he said.

This year, the Royal Mail has been contacted by 60,000 members of the public concerned about texts or emails pretending to be them. As a result, 40,000 websites have been taken down or blocked within 24 hour that claim to be for Royal Mail parcel fees.

"The business is doing everything it can to deliver Christmas to people," Mr Christie added. "But we would urge people to be suspicious and not to click on any links they are sent unless they are 100% certain it's from us."

Likewise, a spokesperson for Hermes said: "We're aware of a phishing attempt claiming to be Hermes where individuals are receiving a text message including a link to pay for parcel delivery. We would never ask for payment in this way."

Royal Mail, UKFinance and Proofpoint are all urging consumers to forward dodgy texts so they can take action. Currently only about a quarter of us do so.

Consumers can forward any suspicious message to 7726 or via the Royal Mail website. The regulator Ofcom also has information about scams on its website.