Three in five people have received fake delivery company texts over the last year as fraudsters exploit the pandemic, according to new research from Which?.
Text scams have boomed as Covid confined millions of people to their homes and consumers became increasingly reliant on deliveries, with fraudsters posing as couriers and delivery companies and attempting to trick people into handing over their bank details via text.
A Which? survey of over 2,000 people in May revealed that three in five people (61%) had received a fake delivery company text in the past year.
Of those who received the scam text messages claiming to be from a delivery company, four in five (79%) said they realised it was fake straight away but 3 per cent said they lost money to the scam.
For those caught out, the financial and emotional impact can be devastating.
Which? also conducted its own experiment, setting up four new SIM cards on the UK’s big four network providers – EE, O2, Three and Vodafone. The numbers were never shared with anyone but two out of the four received at least one scam text message in just a two-week period.
Scammers use computers to generate combinations of numbers and send messages in bulk using ‘SIM farms’ – devices that operate several SIM cards at a time. The equipment and software is available online, and anyone can pick up cheap pay-as-you-go SIMs with unlimited free texts.
Numbers are often masked or ‘spoofed’ to avoid detection – so your phone might say you have received a text from a delivery company, when it’s actually a scammer.
The scam most often reported to Which? in the past three months has been fake text messages – also known as ‘smishing’ (SMS phishing) – pretending to be from Royal Mail. Of those surveyed who said they received one or more scam texts, seven in ten (70%) received the Royal Mail scam text.
The message usually requests a small payment for a parcel to be delivered, with a link to a copycat Royal Mail website, and victims who fell for it told us they were then called by scammers to try to trick them into sending large sums of money.
DHL, DPD and Hermes were the other most commonly impersonated companies in our survey. Of those who received a scam text message claiming to be from a delivery company, roughly one in three said the scam text pretended to be from DHL, DPD or Hermes (32% for DHL and DPD and 31% for Hermes).
One in eight scam texts (12%) impersonated UPS over text.
Text messages claiming to be from couriers can also spread harmful malware. Spyware known as FluBot has been circulating through a message claiming to be from the delivery service DHL, which once downloaded could access sensitive information on your device.
Although companies being impersonated have no legal responsibility to deal with these scams, Which? believes they could find better ways to communicate with customers using text messages and do more to help raise awareness of scams.
Companies can register a recognisable sender ID to protect it against spoofing – although some spoofed messages can still slip through due to limitations of these protections and other weaknesses in SMS processes. Consumers would be better protected if it became standard practice for certain types of companies, such as banks, not to include links or payment requests in text messages – although this may not be possible in all cases.
While the telecoms industry is taking steps to address the explosion in text scams, there are clearly limits to how effective existing prevention measures are, as consumers continue to receive regular scam texts. The telecoms sector should continue to work to find solutions to protect consumers against scam texts.
Companies likely to be impersonated by scammers must be careful how they use SMS, and communicate clearly to their customers how and in what circumstances they will use SMS.
Consumers can sign up to Which?’s scam alert service in order to familiarise themselves with some of the latest tactics used by fraudsters.
The consumer champion has also launched a Scam Sharer tool to help it gather evidence in its work to protect consumers from fraud. More than 5,000 scams have been shared with Which? via the Scam Sharer tool since it went live on 17 March 2021.
Adam French, Which? Consumer Rights Expert, said: “Our research shows how fraudsters have bombarded Britain with scam delivery texts on an industrial scale as they try to exploit the unprecedented conditions of the pandemic.
“Couriers and the telecoms industry must take further steps to protect consumers, by making it harder for fraudsters to exploit systemic weaknesses to reach potential victims, and by making people more aware of how to spot such scams.
“In the meantime, people can sign up to Which?’s scam alert service to keep themselves, their friends and family informed about the latest tactics used by fraudsters.”
What to do if you fall victim to a text scam
Report the scam text by forwarding it to your network provider on 7726.
If you have fallen victim to a text scam, you should contact your bank to ensure the scammer cannot take any more money from your account and ask to be reimbursed.
Many banks have promised to reimburse blameless victims of this kind of fraud by signing up to the voluntary authorised payments code. However, banks might challenge customers if they think the customer didn’t take precautions.
If consumers don’t have any luck getting their money back from their bank, the last resort would be to complain to the Financial Ombudsman.
Link to Which?’s scam alert service: https://campaigns.which.co.uk/scam-alert-service/
Link to Which?’s Scam Sharer tool: https://act.which.co.uk/scam-sharer