Scam Texts in the UK: A Senior's Guide to Parcel, Parking, DWP and Bank Texts

Here is the sentence that protects you from almost every scam text in Britain: no genuine organisation — not your council, not DPD, not the DWP, not your bank — will ever ask you to pay money, or hand over card details, through a link in a text message. That is not our opinion; it is the published position of every one of those organisations, repeated on their own official pages. Keep that one sentence and you are already ahead of most of the traps being sent to UK phones this week.

Scam texts work because they arrive at the worst moments. The parcel text lands while you really are waiting for a delivery. The parking text lands the day after you really did park in town. The Winter Fuel text lands when the payment honestly is due. The scammers are not guessing wildly — they send out millions of these messages because the timing feels personal even when it is pure luck. And because a scammer can fake the name a text appears to come from, the fake can sit inside the very thread where your genuine bank or courier messages live, wearing a name you trust.

This guide answers the worry properly. You will learn the 60-second check that comes first, the five signs almost every scam text shares, how to spot the four impersonations people in the UK meet most — parcel couriers, parking fines, the DWP and HMRC, and your own bank — exactly what to do in the first 10 minutes if you have already tapped a link, and how to forward a scam text to 7726 and block the number on both iPhone and Android. Every reporting number you could need is gathered in one table near the end, and there is a one-page checklist to print and keep on the fridge. Family in Australia? Our companion guide to scam texts in Australia covers the same traps on the other side of the world.

The 60-Second Check, Explained: Why It Never Fails

The check works because it refuses to play the scammer's game on the scammer's field. A scam text controls everything inside itself: the name at the top, the wording, the link, the phone number, even the thread it appears in. What it cannot control is the real DPD app on your phone, the grey card through your letterbox, the letter in your drawer, or the number printed on the back of your bank card. So the entire defence is one habit: leave the message, and check the claim somewhere the message cannot reach.

Notice what the check never asks you to do. It never asks you to judge spelling, or spot a dodgy web address, or decide whether a logo looks right — the fakes are now far too good for that, and plenty of genuine messages are badly written. It asks only about behaviour: is this message asking for money through a link, rushing you, or steering you to a number it supplied? Behaviour is the one thing a scammer cannot disguise, because the behaviour is the scam. A text can wear any name it likes; it cannot collect your card details without asking for them, and the asking is the tell.

One more comfort: checking costs you nothing. If the claim turns out to be real — a genuine fee, a genuine fine — it will still be there in ten minutes, in the app, on the official website, or on the paper card, and you can deal with it calmly through the front door. Nothing genuine is ever lost by pausing. The only thing that punishes a pause is a scam, which is precisely why every scam text begs you not to take one.

The Five Signs Almost Every Scam Text Shares

Scam texts change their wording weekly, but underneath, they are built from the same five parts. Learn these and you will recognise versions that have not been invented yet. Each sign below passes the test on its own: any single one is reason enough to stop.

1. It asks for money through a link. A redelivery fee, a parking fine, an underpaid-postage charge, a small "verification" payment — the amount is always small enough to feel harmless. The money is not the point; your card details are. No UK council, courier, government department or bank takes payment through a link in a text.

2. It rushes you. Deadlines measured in hours, threats of bigger fines, court costs, a returned parcel, a stopped payment. Real organisations work in letters and weeks. The hurry exists for one reason: to stop you doing the 60-second check.

3. It arrived out of the blue. You were not expecting a parcel from that courier, you hold no ticket you're aware of, you have already received your Winter Fuel letter. Scammers send millions of messages precisely because some will land on the right doorstep by chance — an unexpected message about money is a suspicious message about money.

4. It wants you to use its link or its phone number. Everything the message supplies is part of the message. The link leads to a copycat page; the number is answered by the scammer, calmly and professionally. Genuine contact details live on your card, your bills and the official websites you type yourself.

5. It asks for details no text should ever carry. Card numbers, PINs, passwords, one-time codes, your date of birth "to verify". Your bank will never ask for your PIN or a code by text, and no courier needs your bank details to leave a parcel on a doorstep.

Our wider senior scam checklist covers the same five signs for scam calls and emails as well as texts — worth ten minutes of any quiet afternoon, because the tricks travel between all three.

Parcel Texts: DPD, Royal Mail and Evri — the Redelivery-Fee Trick

The parcel text is the most common scam text in Britain, and it is easy to see why: most households are waiting for something, most of the time. The message claims a delivery failed — nobody home, an incomplete address, a small fee outstanding — and offers a link to "reschedule" or "release" the parcel. The link opens a page that copies the courier's colours and logo faithfully, asks for your name, address and card details to pay a fee of a pound or two, and then owns everything it needs to spend from your account properly, days later, when you have forgotten all about it.

The facts, from the couriers themselves, could not be simpler. DPD never charges for redelivery, and never asks for payment or bank details by text. Genuine DPD links only ever point to dpd.co.uk or dpdlocal.co.uk — anything else wearing the name is a copy. Royal Mail will not ask for payment for an underpaid item by email or text, and never asks for your bank details that way; when a genuine fee is due — underpaid postage, a customs charge — a grey "Fee to Pay" card comes through your letterbox, and you pay at royalmail.com or at a delivery office. Royal Mail only sends texts at all when the sender asked for tracking updates. Evri and the other couriers work the same way: tracking information travels by text; money never does.

So the parcel rule is absolute: a text can tell you a parcel is coming; it can never ask you to pay for one. If you are expecting a delivery and a text worries you, close it and check the front-door way — open the courier's app, or type the official address into your browser and enter the tracking number from your order email. Our step-by-step guide to recognising fake delivery texts walks through more examples, including the ones that arrive with no fee at all and simply harvest your details "to confirm the address". If the text claims to be Royal Mail, you can also send a screenshot of it to [email protected] — that is Royal Mail's own reporting address.

Parking Fine and PCN Texts: the Fine That Never Arrives by Text

The parking version wears a uniform instead of a courier's jacket. The text announces a Penalty Charge Notice — a PCN — "issued by a local council", warns that the charge rises by half if you miss the deadline and that court costs follow, and offers a link to pay on a page dressed up to look like GOV.UK. Some versions even enter your car registration and solemnly "find" a fine of £20 waiting. It frightens drivers who really did park somewhere yesterday — which is exactly the mathematics the scammers rely on.

Here is the fact that ends the worry, confirmed by council after council in their own warnings: councils never send parking fines by text message. A real PCN is fixed to your windscreen by an enforcement officer, handed to the driver, or arrives afterwards by post — paper first, always. And the giveaway version of this text, the one claiming to come from the "Department for Transport", can be deleted on sight: GOV.UK itself states that the Department for Transport does not issue parking fines. Private car parks are no different in the way that matters — a genuine parking charge from a private firm also arrives by letter, with the firm's name and an appeals route, not by an anonymous text with a payment link.

If a parking text lands and doubt lingers — perhaps you really were in that car park, perhaps a genuine ticket really is possible — settle it on paper. Look for the yellow envelope on the windscreen or the letter in the post; a real charge exists in one of those places. Or go to your council's official website by typing its address yourself and check there. Then forward the text free to 7726 and delete it. Never enter your registration number on a page a text sent you to: on the fake sites, the registration is how the page personalises the trap, finding a "fine" for any number typed in.

DWP and HMRC Texts: Winter Fuel, Rebates and 'Apply Now' Traps

The government versions aim squarely at pensioners, and the biggest of them arrives every autumn: the Winter Fuel Payment text. It claims your application is incomplete, or that you must "apply" or "confirm your bank details" by a deadline or lose the payment. Variants promise a cost-of-living payment, an energy subsidy, or — wearing HMRC's name instead — a tax rebate "waiting to be claimed", or a tax debt that must be settled today to avoid penalties. The government's own warnings about these texts are unusually blunt, because the trap is aimed at the people least likely to suspect it.

The truth, from GOV.UK and the DWP themselves: for almost everyone, the Winter Fuel Payment is paid automatically — you do not apply, and the government will never ask for your bank details by text message. If you are eligible, the payment arrives in your account in the usual way, with a letter telling you the amount. Any text inviting you to apply, claim, confirm or repay is a scam, however official its sender name looks. The same discipline covers HMRC: rebates are never claimed through a link in a text, and HMRC will never contact you by text to demand a payment or request bank details. Real tax business happens through your GOV.UK account, your tax calculation letter, or the post — slowly, on paper, without deadlines measured in hours.

These texts have their own reporting shortcut: a suspected HMRC text can also be forwarded to 60599 (HMRC's own number; your normal text charge applies), and HMRC scam emails go to [email protected]. The general route works for all of them, though: forward free to 7726, delete, and carry on with your day. If the message has genuinely shaken you — benefit payments are the ground under many households, and the scammers know it — ring the number on an official letter you already hold, or ask a family member to sit with you while you check. That is not weakness; it is exactly the pause the 60-second check is built from.

Bank Texts: 'Account Locked' and the Number You Must Never Call

The bank text is the most dangerous of the four, because it rarely asks for a small fee — it asks for your trust, and then for everything. The opening move is fear: your account has been locked, a suspicious payment is pending, your card has been used abroad. The closing move is a phone number, presented as the bank's fraud department. Call it, and a calm, plausible voice — the scammer, in a room built for this — walks you through "protecting" your money by moving it, sharing a code, or confirming details that hand over the account. A follow-up call a day later, claiming to be the police or a second bank, is part of the same script; scam texts and scam calls are usually two halves of one trap.

Britain has a built answer to this exact moment, and it deserves to be as famous as 999 for this one job: dial 159. The service is run by Stop Scams UK, a collaboration of the banks, phone companies and technology firms. You hang up on whatever frightened you, dial 159, and you are connected securely to your own bank's fraud team — it covers customers of more than 99% of UK current accounts, the number cannot be faked by scammers, and it works from mobiles and landlines. The bank can then tell you, in about a minute, whether anything is actually wrong. Remember two things about it: 159 will never call you — a call claiming to be from 159 is itself a scam — and calls to 159 are charged by your provider, usually at the standard national rate.

The rules that surround it are just as simple. Your bank will never ask you to move money to a "safe account", never ask for your full PIN or a one-time code by text, and never mind you hanging up to check — checking is what they beg customers to do. If a text about your account arrives, the safe doors are always the same three: dial 159, call the number printed on the back of your card, or open your banking app yourself. Everything a text offers instead — its link, its number, its deadline — is the trap wearing the bank's coat.

A Message Just Arrived? The 4 Steps

Everything in this guide folds down into four steps. Whatever the text claims — parcel, fine, payment, account — the steps do not change, and they take less time than making tea.

1. STOP. Read it twice and touch nothing — not the link, not the number, not even "reply STOP". Replying tells the scammer your number is live and read by a person.
2. CHECK somewhere the text cannot touch: the official app opened by your own finger, the website address typed by you, the grey card, the paper letter, or 159 for anything about your bank.
3. FORWARD the text free to 7726. It takes under a minute, and your report helps your phone company block the sender for everyone — the steps are in the next section.
4. BLOCK the number, delete the text, and tell someone in the family. Every time. It is how households become scam-proof.

That is the whole routine. The sections around it exist so you can see why it works — but on the day a frightening text lands at breakfast, these four steps are all you need to remember.

Forward It to 7726, Then Block the Number (Step by Step)

Forwarding a scam text to 7726 — it spells SPAM on an old phone keypad — is free on UK networks, and it is the single most useful thing you can do with a scam text. Your phone company investigates the sender and can block or ban the number, so your one-minute report protects strangers as well as you. Afterwards your provider may send a reply asking you to send the number the text came from; that reply is genuine, and sending the number is safe. Here is the tap-by-tap route on both kinds of phone.

Forwarding a text on iPhone

1. Open the conversation in Messages, but do not tap anything inside the message itself.
2. Press and hold on the message bubble until a menu appears, then tap More.
3. The message gains a tick. Tap the curved arrow at the bottom right of the screen.
4. A new message opens with the scam text inside. In the "To" field, type 7726 and press send.

Forwarding a text on Android (Samsung and most others)

1. Open the conversation in your Messages app, without tapping the link.
2. Press and hold on the message bubble, then tap the three dots (⋮) at the top right.
3. Tap Forward.
4. Type 7726 as the recipient and press send.

Blocking the number afterwards

Blocking takes half a minute and means that particular number never reaches you again. On iPhone, open the conversation, tap the number or name at the very top, tap Info, then Block this Caller. On Android, open the conversation, tap the three dots, then Block (on Samsung it may say "Block number"). Scammers rotate numbers, so blocking is housekeeping rather than a cure — the cure is the 60-second check. For the wider settings that quietly filter much of this traffic before it rings, our guides to blocking spam texts on Android and stopping spam texts on iPhone walk through them screen by screen.

Already Tapped the Link? Your First 10 Minutes

If you have already tapped, typed, or paid — read this section in order and do not waste a minute on embarrassment. These texts are built by professionals to fool careful people, and the banks see them every day. Speed is what protects you now, and the order matters.

1. Bank first — now. If you entered card or bank details anywhere, or paid anything, call your bank before you do anything else: dial 159, or use the number on the back of your card. Tell them exactly what happened. They can block the card and watch the account — people who call within the hour protect themselves best.
2. If you typed a password — for email, banking, shopping, anything — change it from the official app or website (typed by you, never through the text's link), starting with your email and bank. If the same password protects other accounts, change those too.
3. Report it. In England, Wales and Northern Ireland, report to Report Fraud on 0300 123 2040 or at reportfraud.police.uk. In Scotland, call Police Scotland on 101. Reporting is how the national picture gets built and other people get warned.
4. Forward the original text to 7726, block the number, and delete it.
5. Tell a family member today. Not for blame — for backup. Scammers often follow a success with a second approach days later, sometimes pretending to be the bank or even a voice that sounds like someone you love; our guide to the family safe word covers that second wave. A household that knows is a household that cannot be rushed.

Every UK Reporting Number in One Place

Keep this table. Every entry was checked against the official source named beside it on 20 October 2026, and our official safety resources directory keeps the trusted starting points for other countries in one list as well.

The Fridge Checklist: Stop. Check. Forward. Block.

Print this page (your browser's print menu keeps this section together on one sheet) and keep it by the phone or on the fridge. Six lines are all most scam texts ever meet:

Who This Guide Is For — and Who Can Skip It

This guide is for you if you use a mobile phone in the UK and have ever felt your stomach drop at a text about a parcel, a fine, a payment or your bank — which is to say, nearly every phone owner in the country, and older readers most of all, because the DWP and bank versions are aimed at you deliberately. You can skim it if you already run the 60-second check without thinking and know 7726 and 159 by heart — though the numbers table is still worth printing for the fridge, and for the relative who has not learned the routine yet. Nobody is too experienced for the parcel text that arrives on the one day they really are waiting for a parcel.

For Family Members: Helping Mum or Dad From Another City

If you are the daughter in London whose dad forwards her every suspicious text "just to check", or the son in Leeds setting up Mum's phone on a Sunday visit — this section is yours. You cannot stand between your parent and every message, but on one visit you can set up three things that do most of the guarding for you. First, the settings: turn on the phone's spam filtering and, on iPhone, "Filter Unknown Senders", so the worst of it lands quietly in a separate list — the two guides linked in the blocking section walk through it brand by brand. Second, the route: put the genuine banking app and courier apps on their home screen, and practise the only move they will ever need — "if a text worries you, close it and open the app with your own finger; if it's about the bank, dial 159 first". A route practised twice, together, sticks.

Third, the agreement: make it a family rule that no money question is ever settled by a text — not a locked account, not a fine, not a grandchild in trouble. Agree that any frightening message gets forwarded to you before anything is paid, and print the fridge checklist from this page while you are there. You may also find our guide to protecting personal information online a useful companion read for the same visit — it covers the details a text like this is usually fishing for.

The golden rule: never do what a text tells you. Do what you decide, through doors you open — the official app, the address you type, the number on your card, 7726 to report, 159 for your bank.