Fake Royal Mail Carrier SMS Phishing Campaign
Mass SMS campaigns impersonate Royal Mail to send delivery alerts, address-verification requests, and parcel-fee notices that link to credential-harvesting phishing sites. Royal Mail's legitimate SMS notifications are tied to tracked services you have registered — unsolicited payment-request texts are not part of Royal Mail's standard communication.
Part of: Fake Carrier SMS Phishing Scams
Last reviewed: 7 June 2026
Royal Mail does send tracked-item notifications to recipients by SMS and email, but only for items sent through specific tracked services where the sender has provided the recipient's contact details. This means genuine Royal Mail texts are always linked to a specific, real tracked item.
Bulk smishing campaigns impersonating Royal Mail are designed to blend into this expected pattern by using Royal Mail's name, the 'RM' abbreviation, and language that mimics genuine notification formats. The difference is always in what is asked: real notifications give you status updates, fake ones ask for money or credentials.
The NCSC, Action Fraud, and Royal Mail itself have all published warnings about Royal Mail smishing, noting it as one of the most consistently active phishing brands in the UK.
How this scam works on the Royal Mail brand
Messages include variations like: 'RoyalMail: Your parcel is awaiting delivery. Confirm your address: [link]' or 'Royal Mail: Your tracked item requires a signature fee of £1.49 for release: [link].' Both lead to phishing pages collecting personal and card details.
Real Royal Mail tracked notifications do not ask for address confirmation or payment via a text link. Any change to a delivery — such as redirecting to a neighbour or a local delivery office — is done through your Royal Mail account or by responding to a genuine Royal Mail prompt at royalmail.com.
Variants using the 'RM' abbreviation instead of the full 'Royal Mail' name have been particularly common, mimicking the sender ID used in genuine Royal Mail texts while slightly modifying it to bypass filters.
Common red flags
- Text about a Royal Mail parcel requiring payment or address confirmation via a link
- Sender is 'RM' but links to a non-royalmail.com domain
- Signature fee or storage fee demanded via a text link
- No corresponding tracked item in your Royal Mail account
- Text arrives from a random mobile number rather than a Royal Mail short code
- Urgency: 'parcel returned if not confirmed by tomorrow'
- Link URL contains 'royalmail' or 'royal-mail' but is on a different domain
How to protect yourself
- Verify any claimed Royal Mail parcel by entering the tracking reference at royalmail.com/track-your-item
- Never pay a fee or confirm an address via a link in an unsolicited text
- Sign up for Royal Mail Delivery Preferences at royalmail.com for legitimate delivery management
- Forward suspicious texts to 7726
- Report phishing to the NCSC at report.ncsc.gov.uk
How to report it
- Forward smishing texts to 7726
- Report to the NCSC at report.ncsc.gov.uk
- Report to Action Fraud at actionfraud.police.uk
- Alert Royal Mail at royalmail.com/help/scam-mail
- If financial details were submitted, contact your bank immediately
Frequently asked questions
What does a legitimate Royal Mail SMS notification look like?
A genuine Royal Mail tracked notification gives a status update (e.g. 'Your tracked item XXXXXXX is out for delivery') with a tracking reference you can verify at royalmail.com. It does not ask for payment or address confirmation via a link.
Why does the fake text use 'RM' as the sender?
Scammers use sender IDs like 'RM' or 'Royal-Mail' because some SMS systems display these as the sender name rather than a phone number, making the text appear to come from a legitimate source. Always verify the tracking reference independently.