We’ve seen a surge in a particularly sneaky phishing scam impersonating DPD. If you’ve received a text message claiming your package couldn't be delivered because a "signature was required," hold your horses before you click.
Here is a breakdown of how this scam works and why it’s more dangerous than it looks.
🚩 The Anatomy of the Scam
The text usually looks professional at first glance, but once you pull back the curtain, the red flags start flying.
The International Origin: The text often originates from a +63 country code (the Philippines). Unless your local DPD driver is taking a very long detour through Southeast Asia to deliver a parcel in the UK, this is an immediate giveaway.
The "Reply A" Trick: This is a clever technical bypass. Many modern smartphones automatically disable links from unknown numbers to protect users. By asking you to "Simply reply with 'A'," the scammers are tricking your phone into thinking you’ve engaged in a conversation, which often "unlocks" the clickable link.
The URL Sleight of Hand: The link provided is https://dpdlocal.coc-uk.sbs/pay.
The Fake Out: They use "dpdlocal" and "uk" to make it look official.
The Reality: The actual domain is .sbs. Major corporations like DPD use .co.uk or .com. A .sbs (Side by Side) domain is a cheap, common choice for short-lived phishing sites.
🕵️ Why are they doing this?
This isn't just about a "re-delivery fee." While the site might ask for a small payment (like £1.50) to reschedule, that’s just the tip of the iceberg. Their real goals are:
Harvesting Card Details: Once you enter your CVV and card number for that "small fee," they have everything they need to go on a shopping spree.
Identity Theft: They often ask for your full name, address, and date of birth "for verification," which can be sold on the dark web.
🛡️ How to Stay Safe
If you get a message like this, here is the protocol:
Don't Reply: Replying (even with "A") confirms your number is active, which will lead to more scam texts.
Check the App: If you are actually expecting a DPD parcel, use the official DPD app or go directly to dpd.co.uk and type in your tracking number manually. Never use the link in an SMS.
Report It: Forward the text to 7726. This is a free UK-wide service that allows your network provider to investigate and block the sender.
Pro-Tip: No legitimate delivery service will ask you to "copy and paste a link into Safari" because their own security protocols aren't working. If the link feels like a chore to open, it's because your phone is trying to save you.
Stay vigilant! These scams are getting more sophisticated, but a quick check of the URL and the sender's number is usually all you need to stay one step ahead.
