Identify fake DPD redelivery, customs and signature-required smishing texts targeting UK customers
Last reviewed: 11 May 2026 · ScamSupport research
Why DPD is heavily targeted by smishing campaigns
DPD is the UK’s largest premium parcel courier and serves the bulk of high-value e-commerce deliveries (Apple, John Lewis, Currys, ASOS Premier). Its customer base skews towards exactly the demographic criminals want: shoppers who pay with cards, have recent online purchases pending, and recognise DPD as a trusted brand. The DPD scam-text pattern is a near-identical clone of the genuine DPD notification flow, which makes it disproportionately effective.
Three current DPD scam variants
From: +44 7000 000000 (or a UK landline format)
Body: “DPD: Your parcel cannot be delivered. Please confirm your details and pay the redelivery fee of £1.45: dpd-redelivery[dot]uk/track”
Red flags:
Redelivery fees don’t exist. DPD reattempts delivery automatically on the next working day at no cost to the recipient. There is no fee to schedule a redelivery.
Wrong domain. DPD tracking lives at track.dpd.co.uk. dpd-redelivery.uk is a typosquat registered specifically for the campaign.
Sub-£2 amount. The criminal capture is the card details, not the £1.45. Expect follow-up unauthorised transactions of £200–£800 within 14 days.
From: DPD-UK (text sender ID)
Body: “DPD: Your parcel from ORDER #SH-2891 has been held for customs clearance. To release, pay the £3.99 customs charge: dpd-customs-uk[dot]com”
Red flags:
Customs is HMRC’s job, not DPD’s. When a parcel does incur a customs charge, the consumer receives a written card or letter (not an SMS) explaining the duty, VAT and DPD’s handling fee. Customs is never collected via an SMS link.
Fake order reference. “ORDER #SH-2891” isn’t a DPD format — DPD parcel numbers are 14 digits.
Plausible round number. £3.99 is designed to look like a real handling fee. Real DPD customs charges are itemised (duty + VAT + £8 brokerage fee) and depend on the parcel value.
From: a normal UK mobile number
Body: “Hi, this is Tom from DPD. We have a signature-required parcel for you but your address looks unclear. Can you confirm via this secure link? dpd-signature-uk[dot]net”
Red flags:
DPD drivers don’t text from personal phones. Real DPD drivers communicate exclusively through the DPD app push-notification system, not personalised SMS messages.
“Signature required” without a tracking number. Genuine signature-required parcels reference the specific parcel number and link to track.dpd.co.uk — never a third-party domain.
Generic personal address phrasing. “Your address looks unclear” is engineered to pressure the recipient into providing personal information without thinking.
What genuine DPD messages look like
DPD’s legitimate notifications follow a tight pattern:
Sender ID: “DPD” (configurable as “DPDgroup”) — never a UK mobile number.
Tracking link: always track.dpd.co.uk followed by your 14-digit parcel number.
No payment requests. DPD does not collect any payment via SMS — not customs, not redelivery, not signatures.
Time-window phrasing: “Your parcel will arrive between 13:00–14:00”, not vague deadlines.
Driver tracking: live map link from the app, never an SMS to a third-party domain.
What to do if you’ve received a DPD scam text
Don’t click any link in the text — even just visiting a page identifies your number as active.
Forward to 7726. The free UK spam-reporting service routes it to your mobile network’s fraud team for blocking.
Verify any genuine delivery at track.dpd.co.uk by typing the URL into your browser, not from any link. If you have the DPD app installed, that’s the safest channel.
If you clicked, run an antivirus scan, change any password you typed, and watch your bank statements for unauthorised transactions for the next 30 days.
What to do if you paid the “fee”
Call your bank’s fraud line within 24 hours using the number on the back of your card. Card transactions to merchant impostors are typically chargebackable under Visa / Mastercard scheme rules. Speed matters — recovery rates drop sharply after 72 hours.
Cancel the card immediately. Captured card data is sold on criminal forums and re-used 2-8 weeks later.
Report to Report Fraud at reportfraud.police.uk. You’ll receive a crime reference number needed for the chargeback claim.
Read our UK Recovery Guide for the full chargeback / Section 75 / PSR APP framework.