A Royal Mail scam text claims your parcel is being held because of an unpaid postage or customs fee, usually £1 to £3, and links to a fake Royal Mail website that steals your card details. Royal Mail does not request payment by text message with a link. When a genuine fee is due — for example, underpaid postage or a customs charge — Royal Mail leaves a grey "Fee to Pay" card at your address, and you pay through the official royalmail.com website or at a delivery office.
How the Scam Works
The scam follows a well-worn three-stage pattern:
- The text. You receive a message such as "Royal Mail: Your package has a £1.99 unpaid shipping fee. To pay this now visit [link]. Your parcel will be returned to sender if unpaid." The sender is typically an ordinary mobile number, though scammers can also spoof the "Royal Mail" sender name so the message appears in the same thread as genuine ones.
- The clone site. The link opens a near-perfect copy of the Royal Mail website. It asks for your full name, address, date of birth, phone number, and complete card details to "settle the fee."
- The follow-up fraud. The £1.99 is not the point. With your card details and personal information, criminals make larger purchases, attempt account takeovers, or — most damagingly — call you posing as your bank's fraud team. Because they can quote your card number and recent activity, the call sounds legitimate, and victims are talked into "moving money to a safe account." This second-stage bank impersonation is where the serious losses happen.
Got a suspicious email?
Paste it here for an instant analysis.
No signup · 6 detection layers · Results in seconds · Cmd+Enter
How Royal Mail Actually Handles Fees
The genuine process is deliberately low-tech, which makes the scam easy to disprove:
- The grey card. If an item has a surcharge (underpaid postage) or a customs charge, Royal Mail leaves a physical grey "Fee to Pay" card through your door. You do not get a text out of the blue.
- Payment happens on royalmail.com or in person. You pay using the reference number printed on the card, either on the official website you type in yourself, by phone, or at your local Customer Service Point.
- Royal Mail texts are informational. Genuine Royal Mail tracking texts (if you have opted in via a retailer) tell you a delivery window. They do not ask for payment, personal details, or passwords.
- Customs charges show in tracking. For international items, the official tracking page on royalmail.com will show if a fee is due — verify there, never through a texted link.
Red Flags in the Message Itself
- A payment link in a text. This alone is disqualifying — Royal Mail does not do this.
- Lookalike domains. The link will use domains like royalmail-fee, royal-mail-redelivery, or random strings — anything except royalmail.com. Check the root domain carefully; a URL like royalmail.com.parcel-fee.net actually belongs to parcel-fee.net.
- Deadline pressure. "Within 24 hours," "will be returned to sender today" — artificial urgency is the engine of every phishing message.
- Requests for excessive data. No postage fee requires your date of birth or your mother's maiden name.
What to Do
- Forward the text to 7726. This free reporting shortcode works on all UK networks and helps get the sending numbers blocked.
- Report phishing emails to [email protected] if the scam arrives by email instead of text. You can also report to Action Fraud.
- If you paid or entered card details, call your bank immediately on the number on the back of your card. Ask for the card to be blocked and flag the transaction as fraud. Report promptly — unauthorised payments are generally refundable under UK payment regulations when reported quickly.
- Treat any follow-up "bank fraud team" call as hostile. Hang up and call your bank yourself. Genuine banks never ask you to move money to a safe account.
Why This Scam Keeps Returning
Royal Mail impersonation surges around predictable moments: the Christmas parcel season, major online sale events, and any period when customs rules change and the public expects fees on overseas orders. The infrastructure — SMS blasting tools and website clone kits — is sold cheaply on criminal forums, so new waves appear as fast as old domains are taken down. The same kits power the parallel Evri scam texts and DPD variants; only the logo changes. Our delivery scam hub tracks the full category.
Verify Before You Pay Anything
The rule that defeats every version of this scam: never pay a delivery fee through a link that arrived by text. If you think a fee might genuinely be due, go to royalmail.com directly and use your tracking number, or wait for the grey card.
And when a message leaves you unsure, paste it into IsThisAScam.to. The free checker analyzes the link, the domain's registration history, and the message wording against known Royal Mail phishing templates, and gives you a clear verdict in seconds.