Last Updated:16.10.2026
A DPD scam email is a phishing message that impersonates the delivery company to steal personal information, payment-card details, passwords or money.

These messages commonly claim that a parcel cannot be delivered until the recipient:

• Updates an address.
• Rearranges delivery.
• Pays a small fee.
• Confirms personal details.
• Opens an attached delivery document.
• Acts before a parcel is supposedly returned.

Current DPD UK security guidance gives consumers one particularly useful rule: DPD says it will never ask customers to pay a redelivery fee through a link in an email, text or iMessage.

A genuine-looking logo or parcel reference is not enough to establish authenticity. The safest approach is to verify the shipment independently using the order information you already have.

What Is a DPD Scam Email?

A DPD scam email is a form of courier impersonation.

Fraudsters create messages that resemble genuine delivery notifications because parcel communications are familiar and time-sensitive.

A typical fake might claim:

“We were unable to deliver your parcel. Please update your details and pay a small redelivery charge.”

The payment amount may be deliberately low.

A recipient who would hesitate over a £100 payment may enter card details without much thought for a £1 or £2 charge.

However, the small fee is often only the lure.

A fraudulent page may attempt to collect:

• Full name.
• Home address.
• Mobile number.
• Email address.
• Card number.
• Card expiry date.
• Security code.
• Account password.
• One-time banking codes.

That information can potentially be used for further fraud after the original fake delivery page disappears.

People receiving regular parcels should also understand the wider warning signs found in fake delivery messages, because the same fraud technique can be adapted to different courier brands.

Which Types of DPD Scam Emails Are Most Common?

DPD impersonation does not follow one fixed template.

Several formats appear repeatedly because each creates a plausible reason for the recipient to act.

Scam format	Typical claim	Likely objective
Missed delivery	Driver could not deliver	Send victim to phishing page
Redelivery fee	Small payment required	Capture card details
Address problem	Delivery details are incomplete	Collect personal information
Parcel return	Package will be sent back	Create urgency
Customs charge	Import payment outstanding	Obtain payment or card information
Fake invoice	Delivery document attached	Deliver malware
Account verification	Identity must be confirmed	Steal login credentials

The strongest scams combine several tactics.

For example, the message may say an address is incomplete, a £1.49 charge is due and the parcel will be returned within six hours.

That combination creates uncertainty + urgency + a low payment amount, which can make recipients act before checking.

How Can You Identify a Fake DPD Email?

Do not judge an email from one characteristic alone.

Modern phishing messages can have accurate spelling, convincing branding and professional layouts.

Instead, check several elements together.

Sender and Message Details

DPD publishes its recognised email and web addresses on its official cyber-security page.

Rather than relying on the visible sender name, expand the email details and examine the underlying address.

A display name such as:

DPD Delivery

can be chosen by almost anyone sending an email.

Other warning signs include:

• Generic greetings.
• An order you do not recognise.
• An unexplained deadline.
• Requests for confidential information.
• Unexpected attachments.
• Payment demands connected to redelivery.
• Links pointing somewhere unrelated to DPD.

DPD’s current guidance also says its notification emails do not use generic greetings such as “Dear Customer” or “Dear Sir/Madam”.

Link Destination

A fraudulent web address may contain the word dpd while still being controlled by somebody else.

For example:

dpd.delivery-check.example.com

The important part is the actual registered domain, not the familiar words placed before it.

Likewise, HTTPS and a padlock are not proof that a website belongs to DPD.

They only show that the connection between your browser and that particular site is encrypted.

The page itself could still be fraudulent.

Does DPD Charge for Redelivery?

A standard missed-delivery message should not direct you to a link demanding a special redelivery payment.

DPD’s current UK fraud guidance states that it does not request a redelivery fee through links sent by email, text or iMessage.

That makes messages such as these strong warning signs:

• “Pay £1.49 for another delivery attempt.”
• “Your £2 delivery balance is outstanding.”
• “Pay now or your parcel will be returned.”
• “Rebook delivery by entering your card details.”

A more detailed explanation of whether DPD charges for redelivery can help when the parcel itself is genuine but the payment request looks unusual.

If you really missed a delivery, do not test the link in the questionable email.

Use the parcel reference from your genuine retailer confirmation and verify it separately.

Can a Genuine DPD Parcel Have a Customs Charge?

Yes. This is different from a fake redelivery fee.

International parcels can legitimately attract:

• Import VAT.
• Customs duty.
• Other applicable import or clearance charges.

Therefore, “DPD never asks for any money under any circumstances” would be too broad.

The important question is whether the request corresponds to a genuine international shipment.

Use this process:

1. Find the original retailer order.
2. Locate the parcel or consignment reference independently.
3. Open the official DPD tracking service yourself.
4. Check whether that parcel actually exists.
5. Compare its genuine status with the payment request.
6. Seek confirmation separately if anything remains unclear.

DPD itself says its official website and app provide the safest way to track a parcel.

The logic is similar to checking a genuine Royal Mail fee to pay rather than assuming every parcel-payment message must be either automatically genuine or automatically fraudulent.

Why Are Current DPD Text and iMessage Scams Important?

Courier phishing increasingly extends beyond conventional email.

DPD’s current UK security information says the most recent campaigns it has observed have been primarily iMessage scams, although fraudulent messages can also arrive by ordinary text.

Typical examples claim:

• Your address is incomplete.
• Delivery failed.
• Your parcel is being held.
• A fee must be paid.
• The package will soon be returned.

Current DPD automated alerts are sent through SMS rather than iMessage.

DPD also advises recipients to be cautious when the sender appears as an email address or random number rather than an expected DPD sender identity.

Another suspicious technique tells the recipient to:

1. Reply with “Y” or another character.
2. Close the conversation.
3. Reopen it.
4. Click the newly activated link.

There is no legitimate need to perform this unusual sequence merely to track a parcel.

Why Are Parcel Scams So Convincing?

Courier impersonation benefits from probability.

Fraudsters do not necessarily know that you are expecting a DPD parcel.

They can send thousands of messages knowing that a proportion of recipients will happen to be waiting for an online order.

That coincidence creates credibility.

If you ordered trainers yesterday and receive a delivery warning today, your first thought may be that the two events are connected.

Sarah Lyons, a former senior cyber-security official, explained the underlying tactic:

“Scammers and cyber criminals regularly exploit well-known, trusted brands for their own personal gain.”

Fraud specialist Katy Worobec has similarly warned:

“Criminals are experts at impersonating a range of organisations.”

The important behavioural lesson is that recognising a brand should not replace verification.

How Can You Verify a DPD Parcel Without Using the Email Link?

Start outside the suspicious message.

A reliable verification path is:

1. Check your retailer account. Confirm that an order is actually being delivered by DPD.
2. Find the genuine parcel reference. Use the merchant’s website or original order confirmation.
3. Open DPD tracking independently. Do not use the questionable email button.
4. Enter the genuine reference.
5. Compare the tracking status.
6. Contact support independently if the information conflicts.

This approach works even when the phishing email is visually convincing.

It also prevents a scammer from controlling the entire verification process.

For example, if you receive an unfamiliar delivery linked to an unexpected eTarget parcel, checking the original retailer and tracking history can reveal whether the parcel genuinely belongs to one of your purchases.

If further confirmation is required, use an independently verified contact route rather than a telephone number supplied in the suspicious message.

Information on contacting DPD by phone can help when tracking alone does not resolve the issue.

What Security Measures Has DPD Added Against Impersonation?

DPD has introduced several technical measures intended to make genuine communications easier to distinguish from fraudulent ones.

BIMI Email Verification

DPD says it uses Brand Indicators for Message Identification, or BIMI.

On compatible email services, authenticated messages can display:

• The official brand logo.
• A blue verification indicator.

This gives recipients another signal when evaluating a message.

It should still be treated as one signal rather than a reason to ignore an unusual payment request.

Protected SMS Sender Identification

DPD has also joined the Mobile Ecosystem Forum SMS SenderID Protection Registry.

The system is intended to help mobile networks recognise registered sender identities and identify attempts to impersonate them.

DPD has additionally standardised the sender identification displayed on genuine automated SMS notifications.

These measures make some types of spoofing more difficult, but they cannot prevent a criminal from sending a completely separate message from an unrelated number or domain.

What Should You Do With a Suspicious DPD Message?

If you have received the message but have not clicked or entered any information, the response is straightforward.

• Do not follow the link.
• Do not open unexpected attachments.
• Do not reply.
• Verify the parcel independently.
• Report the message.
• Delete it after reporting.

Current official UK phishing reporting guidance says suspicious emails should be forwarded to:

report@phishing.gov.uk

Suspicious text messages can be forwarded free of charge to:

7726

These reports can help security teams investigate malicious infrastructure and remove scam websites.

What Should You Do If You Already Clicked the Link?

The right response depends on what information was exposed.

What happened	What to do next
Page opened but nothing entered	Close the page and avoid returning
Name/address entered	Expect possible follow-up scams
Password entered	Change it immediately wherever reused
Card details entered	Contact card provider immediately
Banking details entered	Contact bank immediately
Security code shared	Tell bank/account provider immediately
File downloaded	Run security checks and seek technical assistance
Work device involved	Inform the organisation’s IT/security team

DPD’s security guidance specifically advises customers who have entered bank details or passwords into a suspicious site to contact their bank and change affected passwords.

If money has already left your account, contact the bank first.

For victims in England, Wales and Northern Ireland, fraud and cyber-crime reports now go to Report Fraud; Scotland uses Police Scotland.

Do not wait for the fraud-reporting process before securing your bank account or card.

Can a Fake DPD Email Install Malware?

Yes.

A phishing campaign does not always ask for card details.

DPD currently warns that criminals may disguise malicious downloads as files needed to create or change a delivery label. Those downloads can contain malware, viruses or ransomware.

Be particularly cautious with unexpected:

• ZIP archives.
• Executable files.
• Installation packages.
• Office documents requesting macros.
• Compressed invoice files.
• Downloads described as delivery software.

Receiving a parcel does not normally require installing unfamiliar software.

If an attachment was opened on a company computer, disconnecting or isolating the device may be appropriate under your organisation’s security policy while the IT team investigates.

Why Are Businesses Particularly Exposed to DPD Phishing?

Businesses receive legitimate delivery communications constantly.

That gives fraudulent courier emails somewhere to hide.

A receptionist, warehouse employee, accounts assistant or office manager may process dozens of parcel notifications in a normal week.

One fake message can therefore look routine.

The possible consequences go beyond losing a £1.99 fake redelivery fee.

A compromised business account could expose:

• Corporate email.
• Customer information.
• Supplier invoices.
• Payment instructions.
• Cloud accounts.
• Delivery histories.
• Employee information.

Courier phishing can also become the first stage of a larger business-email compromise.

For that reason, companies should have a simple rule:

Unexpected courier payments should be checked against the underlying purchase or shipment before anybody follows a payment link.

Businesses should also make it normal for employees to challenge unusual requests rather than rewarding speed at the expense of verification.

How Should a Business Handle DPD Delivery Emails Safely?

A basic internal workflow can reduce risk without slowing genuine deliveries significantly.

Stage	Recommended control
Email received	Check it against a real purchase/order
Delivery problem claimed	Confirm through independent tracking
Payment requested	Verify with purchasing/accounts team
Link supplied	Avoid it until independently confirmed
Attachment supplied	Do not open unexpectedly
Credentials requested	Reject and escalate
Suspicious email	Report internally and externally
Employee clicked	Notify IT/security immediately

Where possible, organisations should also separate purchasing, payment authorisation and cyber-security responsibilities.

The employee waiting for the parcel should not necessarily be the person authorised to enter corporate card information into an unfamiliar payment page.

What Are the Most Reliable DPD Scam Email Checks?

Rather than memorising every scam format, focus on a small number of high-value questions.

Question	Why it helps
Am I genuinely expecting this parcel?	Many scams are sent randomly
Does the merchant confirm DPD is delivering it?	Connects message to a real purchase
Can the parcel be found independently?	Removes reliance on the scammer’s link
Is a redelivery fee being demanded?	Conflicts with current DPD UK scam guidance
Is the message creating artificial urgency?	Common phishing tactic
Is sensitive information requested?	Strong reason to stop and verify
Is an unexpected file attached?	Could indicate malware
Can the claim be confirmed through a known channel?	Provides independent evidence

This is more reliable than focusing only on spelling.

Professional phishing messages may contain perfect grammar and high-quality branding.

What Is the Final Advice on DPD Scam Emails?

A DPD scam email attempts to turn an ordinary parcel notification into an opportunity to steal information, credentials or money.

The strongest defence is independent verification.

Do not let the email itself decide:

• Which website you visit.
• Which phone number you call.
• Which payment page you use.
• Which file you download.

Check the underlying order and parcel through a route you know is genuine.

If the shipment exists, you can deal with the genuine delivery issue.

If it does not, you have avoided allowing the suspicious message to control the next step.

Frequently Asked Questions

How do I know if a DPD email is fake?

Check whether you genuinely have a DPD parcel, inspect the sender and link destination, and verify the shipment through independently opened DPD tracking. Do not rely on branding alone.

Will DPD ask me to pay for redelivery through an email?

DPD’s current UK security guidance says it will not request a redelivery fee through a link sent by email, text or iMessage.

Can DPD legitimately request customs charges?

International parcels can have genuine customs or import liabilities. Verify the shipment independently before making any payment.

Does DPD send iMessages?

Current DPD guidance says genuine automated delivery alerts are sent through SMS and notes that recent fraudulent campaigns have frequently used iMessage.

What should I do with a suspicious DPD email?

Do not click it. Forward suspicious emails to report@phishing.gov.uk and verify your parcel separately.

Where should I report a suspicious DPD text?

Suspicious SMS messages can be forwarded free to 7726.

What if I gave scammers my card details?

Contact your bank or card provider immediately. Explain what information was entered and follow its instructions for securing the account.

What if I entered my password on the fake website?

Change the password immediately, including on any other accounts where it was reused, and enable stronger authentication where available.

Can a DPD scam email contain malware?

Yes. DPD specifically warns that fraudulent delivery messages may contain malicious downloads capable of installing malware or ransomware.