Introduction

You are waiting for a delivery. A kettle, a birthday present, maybe a new pair of slippers. Then your phone buzzes. The message says something like “Your parcel has been held – please pay a small fee to release it.” In that moment, it feels real. It feels urgent.

This is smishing – a sneaky scam that arrives as a text message or a WhatsApp note, designed to steal your money or personal information. It matters because it works on trust, busyness and hope. Anyone can be caught off guard, even people who think they are careful. I nearly clicked once myself. Understanding how these tricks operate can keep your bank account safe and your peace of mind intact. Let’s break it down, simply and calmly.

The core idea, in the simplest terms

Smishing (a blend of SMS and phishing) is a fake message that pretends to be from someone you know or a company you use – often a delivery firm, a bank or a government service. The message pushes you to tap a link, call a number or share private details. The goal is always the same: to trick you.

Imagine a stranger knocking on your door, wearing a high-vis jacket and holding a clipboard. They say you owe £1.50 for a parcel and just need your card number. You might hesitate. Now imagine the same stranger sending that request straight to your pocket, with a logo that looks legitimate and a sense of urgency. That’s smishing.

A classic everyday example is the “held parcel” text. It might read:

“DPD: Your parcel could not be delivered. Please reschedule and pay the £1.50 redelivery fee here: https://dpd-reschedule.com”

It looks helpful. The £1.50 feels so small that it barely seems worth questioning. But that link leads to a convincing fake website that collects your card number, expiry date and security code. Within minutes, criminals can empty your account. The parcel never existed. The only thing that was real was the trick.

Why these messages work, and how to think about them

Smishing works because it feels personal and immediate. We carry our phones everywhere. We glance at notifications while cooking, watching television or juggling grandchildren. Scammers know this and send millions of messages, hoping to catch someone who is genuinely expecting a delivery.

Think of it like a phishing email, but more intimate. Many people have learned to be suspicious of strange emails on a laptop, yet they still trust a text message. Scammers exploit that trust. They can make the sender name appear as “RoyalMail” or “DPD” in your message list, blending in with real conversations. Even sneakier, a scam message sometimes lands inside an existing text thread from a company you genuinely use. That happens because criminals spoof the sender ID – they fake the name your phone sees – so your messaging app groups their message with past genuine alerts. A fraudulent request that sits right below a real delivery update feels incredibly convincing, which is why it catches so many people off guard.

The link they provide might use a tiny spelling error – dpd-deliveryy.com instead of dpd.com – something your eye can easily miss when you are in a hurry. The message almost always creates a sense of urgency. “Act now or your parcel will be returned.” “Pay within two hours.” That rush is deliberate. When we panic, we stop thinking clearly.

Here is a helpful analogy: imagine receiving an unexpected note through your letterbox. It says you owe a small amount to the council and must pay immediately via a website printed on the paper. You would probably check the council’s real number first. Text messages deserve exactly the same caution.

Real life: how ordinary people get caught

Barbara ordered garden lights online. The next morning, her phone lit up with a text claiming to be from a well-known courier: “Your parcel was not delivered. Reschedule and cover the £1.99 processing fee.” Barbara almost tapped the link. She was expecting a parcel, and the amount was tiny. But something felt off. She paused, opened the courier’s official app and saw that her real package was out for delivery with no fee. She dodged a bullet simply by checking.

David wasn’t so lucky. He wasn’t expecting anything, but a message said he had missed a delivery. Curious, he clicked the link and entered his card details on a site that looked exactly like a genuine payment page. Two days later, he noticed four unauthorised purchases totalling over £600. Recovery took weeks.

Scammers also use WhatsApp or Messenger. A message might appear to come from a friend whose account has been taken over: “Is this your parcel photo? I found it online.” Because it seems to be from someone you trust, the instinct to click is strong.

The key is to recognise the pattern, not memorise every variation. Real delivery companies rarely ask for payment by text link. Real banks never send a link to “verify” your details under threat. If a message makes you feel worried, rushed or vaguely uneasy, your body is telling you something useful. Listen to it.

Key Takeaways

• Always pause before clicking any link in a delivery text. The parcel can wait – your security cannot.
• Verify through official channels. Open the courier’s app or type their website address yourself. Never use the link sent to you.
• Legitimate delivery firms almost never ask for payment via SMS or WhatsApp. A small redelivery fee is a common smishing lure.
• Be suspicious of messages that create time pressure. “Act now or lose your parcel” is a red flag, not an emergency.
• If a suspicious message appears inside a genuine text thread, remember that sender IDs can be faked. Don’t trust it just because it sits next to real alerts.
• Forward suspicious texts to 7726 (spells SPAM on your keypad). This free service helps your mobile provider block future scams. In the UK, you can also report fraud to Action Fraud.
• If you do click or share details by mistake, contact your bank immediately. Quick action can limit the damage.
• Protect friends and family. Share what you’ve learned – older relatives are often targeted simply because scammers assume they are less tech-savvy.

Final Thoughts

Smishing is not about technology; it’s about human nature. The scammers don’t need to crack codes. They just need you to tap a link before you’ve had your morning coffee. The good news is that you now know how to spot the pattern. Pause, breathe, and check. That tiny moment of hesitation is your strongest protection.

If someone you know is waiting on a package right now, forward this article to them. A quick share could stop a costly mistake, and that’s a gift far better than any parcel.