Fake parcel delivery texts are the top smishing scam

Parcel and package delivery scams are the most prevalent type of 'smishing? text messages, according to new data provided to UK Finance by cybersecurity company Proofpoint.

Proofpoint operates the 7726 text message system on behalf of mobile phone operators, which allows customers to report suspicious texts. The numbers 7726 on a keypad spell out the word ?SPAM'.  

Smishing is a technique that criminals use to target consumers with texts impersonating trusted organisations. These text messages often contain a link to a fraudulent website that replicates a legitimate site, asking the victim to enter personal and financial information. 

Each year within the UK, Proofpoint receives millions of text messages reported as spam and the data shown in the table below covers those categorised as smishing for the 30 and 90-day periods to mid-July.

This shows that over the longer 90-day period, the number of scam texts pretending to be from a delivery firm represented more than half of all smishing attempts, with those pretending to be from a bank or other financial institution representing around a third.  

During the recent 30-day period however, the proportion of delivery scam texts has increased significantly and represents three times the number of those pretending to be from a bank.

  30 days 90 days
Parcel and Package Delivery 67.4% 53.2%
Financial Institutions and Banks 22.6% 36.8%
Other smishing attacks 9.6% 8.9%
Government Entities 0.4% 1.1%

Source: Proofpoint data'showing the top?identified UK-based'smishing?campaigns by group as of?14 July 2021? 

Malicious texts are often part of a wider scam. If someone clicks on a link and provides information, they may then get a phone call from someone claiming to be from their bank. Exploiting the personal and financial information provided in the text message, the person offers to help safeguard  funds by trying to convince someone to transfer money into a 'safe account?, which is in fact an account run by the same criminal that sent the original text message. 

Reports to the 7726 system are being used by the National Cyber Security Centre (NCSC) to take down fraudulent website URLs and prevent further fraud losses.

Katy Worobec, Managing Director of Economic Crime at UK Finance, said:

Criminals are experts at impersonating a range of organisations and have capitalised on the pandemic, knowing that many of us will be ordering goods online and awaiting parcel deliveries at home.?

?We are urging people to follow the advice of the Take Five to Stop Fraud campaign and to always stop and think?whenever you get a text message out of the blue?before parting with your information or money. Always avoid clicking on links in a text message in case it's a scam and forward any suspected scam text messages to 7726, which spells SPAM on your telephone keypad, so that the criminals responsible can be brought to justice.

Sarah Lyons, NCSC Deputy Director for Economy & Society, said:  

Scammers and cyber criminals regularly exploit well-known, trusted brands for their own personal gain, and sadly these latest findings bear that out.

?We would encourage people to be vigilant to any suspicious-looking text messages, which should be forwarded to 7726.

?However, these scam messages can be very hard to spot, so if you think you've already responded to a scam, don't panic. Whether you were contacted by text message, email or phone, there's lots you can do to limit any harm. Visit www.cyberaware.gov.uk for more information on how to protect your online accounts and devices.

Lindsey Fussell, Network and Communications Group Director at Ofcom, said:

Criminals who defraud people using scam texts can cause huge distress and financial harm. These scams are becoming more sophisticated and can be very convincing. So if you receive a suspicious text or something doesn't look right, do not click on any links and report it to 7726.

Take Five to Stop Fraud?urges people to remember the Stop, Challenge,?Protect?behaviours and to recognise that criminals are experts at impersonating people, organisations and the police. 

?The advice is to: 

  • Remember that criminals will send out smishing text messages with links leading to fake websites used to steal personal and financial information. These text messages may appear to be from trusted organisations and may use official branding to convince you they?re genuine. Always access websites by typing them into the web browser and avoid clicking on links in texts.?
  • Remain vigilant and check delivery notifications very carefully to ensure they are genuine. Text messages may look very similar to those that are genuine but may use generic greetings, such as Dear Sir/Madam, or include spelling errors.?
  • Always question claims that you are due goods or services that you haven't ordered or are unaware of, especially if you?have to?pay any fees upfront.
  • Customers can report suspected scam texts to their mobile network provider by forwarding them to 7726 which spells ?SPAM? on your telephone keypad. 

Contact Information

UK Finance Press Office
020 7416 6750

Area of expertise:

Notes to editor

<ol><li><span style="tab-stops:list 36.0pt">UK Finance is the collective voice for the banking and finance industry. Representing around 300 firms across the industry, we act to enhance competitiveness, support customers and facilitate innovation.?<br />
<li><span style="tab-stops:list 36.0pt">Proofpoint is a provider of omnichannel cybersecurity and compliance solutions. Proofpoint?s Cloudmark division is focused on messaging security, offering solutions for mobile messaging (SMS, MMS, RCS) and email. Cloudmark?s solutions are the most widely integrated platform in carriers? messaging infrastructures and are used by over 150 of the world?s leading service providers. These Cloudmark solutions process tens of billions of messages with reputation and content filtering of over four billion messages per day. <br />
 <br />
The Cloudmark division offers the industry's fastest and most accurate anti-spam, anti-phishing, anti-smishing, and anti-virus messaging security solutions for Mobile Network Operators (MNOs), messaging providers such as CPaaS (Communications Platform as a Service), MaaP (Messaging as a Platform) providers, and Internet Service Providers (ISPs).  Cloudmark also provides mobile smishing protection for major brands. Cloudmark threat data feeds and insight are instrumental tools in identifying smishing attack campaigns and providing intelligence to brands to protect and notify their customers while also enabling the preservation of their brand reputation.   </span></li>
</ol><ol start="3"><li><span style="tab-stops:list 36.0pt">The banking and finance industry is committed to tackling fraud and scam texts including through:  </span></li>
</ol><ul><li><span style="tab-stops:list 36.0pt">Fully funding a specialist police unit, the Dedicated Card and Payment Crime Unit (DCPCU), which tackles the organised criminal groups responsible for financial fraud and scams. In 2020, the unit prevented almost £20 million of fraud, disrupted 26 organised crime groups (OCGs), arrested 122 suspected criminals, and secured 54 convictions, including a man who was jailed for sending scam text messages exploiting the Covid-19 pandemic.?</span></li>
<li><span style="tab-stops:list 36.0pt">Working with text message providers and law enforcement to?<a href="https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.u… text messages including those exploiting the Covid-19 crisis. 1087 unauthorised sender IDs are currently being blocked to prevent them being used to send scam text messages mimicking trusted organisations, including over 70 related to Covid-19.?</span></li>
<li><span style="tab-stops:list 36.0pt">Working with?<a href="https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.o… crack down on number spoofing, which has prevented criminals from spoofing the phone numbers of trusted organisations, including HMRC.?</span></li>
</ul><ol start="4"><li><span style="tab-stops:list 36.0pt"><a href="https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftakef… Five to Stop Fraud</a> is a national campaign that offers straight-forward and impartial advice to help everyone protect themselves from preventable financial fraud. Take Five urges the public to remember that criminals are experts at impersonating people, organisations and the police, and to stop and consider whether the situation is genuine before parting with any personal or financial information.</span></li>
</ol><ul><li><span style="tab-stops:list 36.0pt"><strong>STOP:</strong> Taking a moment to stop and think before parting with your money or information could keep you safe.</span></li>
<li><span style="tab-stops:list 36.0pt"><strong>CHALLENGE:</strong> Could it be fake? It?s ok to reject, refuse or ignore any requests. Only criminals will try to rush or panic you.</span></li>
<li><strong>PROTECT:</strong> Contact your bank immediately if you think you?ve fallen for a scam and report it to Action Fraud.</li>