Fake DPD messages lead to over £200,000 in losses since June

In November alone, the Suspicious Email Reporting Service (SERS), a tool launched by the National Cyber Security Centre (NCSC) and the City of London Police earlier this year, received 5,478 reports of suspicious DPD emails. This is an increase of 655% when compared to the previous month.

Action Fraud has also received 166 reports of suspicious DPD text messages between June and November this year, with victims reporting a total loss of £139,000. A further 35 reports were made in the first week of December, with victims reporting a total loss of £103,000.

The messages purporting to be from DPD claims that the delivery driver was “unable to deliver your parcel today” as “you weren’t in or there was no safe place to leave it”. The message provides instructions on how arrange another delivery. The links in the messages lead to fraudulent websites that request a small payment to rearrange the delivery.

If the victim makes this payment, they’ll receive a phone call within a few days from someone purporting to be from their bank to inform them about suspicious transactions on their account. Criminals carrying out this scam are able to use a tactic called ‘spoofing’ to make the call or text appear genuine by cloning the phone number, or sender ID, used by the bank.

The victim is informed that their bank account may be compromised and is instructed to transfer their money to what they believe is an alternative secure account to prevent further losses. In reality, their money is being transferred into an account under the criminal’s control.

In other cases, suspects have gained enough personal details and security information during the phone call with the unsuspecting victim, to enable them to take out a loan in the victim’s name. The criminals then transfer the loan to an account under their control.

Always remember:

• Your bank, or other official organisations, will never ask you to share personal or financial information over the phone, or via text or email. If you need to check that it’s a genuine message, contact them directly.
• You can report suspicious emails you have received but not acted upon, by forwarding the original message to report@phishing.gov.uk.
• You can report suspicious texts you have received but not acted upon, by forwarding the original message to 7726, which spells SPAM on your keypad.
• For DPD, only emails sent from one of three DPD email addresses are genuine. These are dpd.co.uk, dpdlocal.co.uk or dpdgroup.co.uk.

If you have acted upon a message you have received, and you think you may be a victim of a fraud, contact your bank immediately and report it to Action Fraud online at actionfraud.police.uk or by calling 0300 123 2040 as soon as possible.

https://www.actionfraud.police.uk/alert/fake-dpd-messages-lead-to-over-200000-in-losses-since-june