Fake DPD messages lead to over £200,000 in losses since June

17 Dec 2020 12:04 PM

Action Fraud is warning the public to remain vigilant as victims report losing £242,000 to criminals purporting to be from parcel delivery company DPD since June.

In November alone, the Suspicious Email Reporting Service (SERS), a tool launched by the National Cyber Security Centre (NCSC) and the City of London Police earlier this year, received 5,478 reports of suspicious DPD emails. This is an increase of 655% when compared to the previous month.

Action Fraud has also received 166 reports of suspicious DPD text messages between June and November this year, with victims reporting a total loss of £139,000. A further 35 reports were made in the first week of December, with victims reporting a total loss of £103,000.

The messages purporting to be from DPD claims that the delivery driver was “unable to deliver your parcel today” as “you weren’t in or there was no safe place to leave it”. The message provides instructions on how arrange another delivery. The links in the messages lead to fraudulent websites that request a small payment to rearrange the delivery.

If the victim makes this payment, they’ll receive a phone call within a few days from someone purporting to be from their bank to inform them about suspicious transactions on their account. Criminals carrying out this scam are able to use a tactic called ‘spoofing’ to make the call or text appear genuine by cloning the phone number, or sender ID, used by the bank.

The victim is informed that their bank account may be compromised and is instructed to transfer their money to what they believe is an alternative secure account to prevent further losses. In reality, their money is being transferred into an account under the criminal’s control.

In other cases, suspects have gained enough personal details and security information during the phone call with the unsuspecting victim, to enable them to take out a loan in the victim’s name. The criminals then transfer the loan to an account under their control.

Pauline Smith, Head of Action Fraud, said:

“Phishing messages are commonly used by criminals to gain access to our personal and financial details, leaving them free to commit fraud and take your money.

“At this time of year people are often sending parcels and gifts to friends and family, especially this year with people not being able to meet up in the same way for Christmas. Criminals are relying on the fact that we may need to reschedule a delivery to make their communication seem genuine. This is why we’re urging the public to follow some simple steps to ensure they have a #FraudFreeXmas this year. Remember, if something feels wrong then always question it.”

A spokesperson for DPD, said:

“We are aware that there have been a number of fake DPD emails trying to get consumers to send money for parcels to be re-directed. We would never do this nor would we ask consumers to give us their bank details.

“There is an easy way to check the email is safe, only emails sent from one of three DPD email addresses are genuine. These are dpd.co.uk, dpdlocal.co.uk or dpdgroup.co.uk. Fake or scam emails are nearly always sent from a private email address and certainly not from an official DPD one. Any other sender email address, especially if the email is asking for money is highly likely to be a scam email.

“We would encourage anyone who has received a fake email to report it to report@phishing.gov.uk.”

Always remember:

• Your bank, or other official organisations, will never ask you to share personal or financial information over the phone, or via text or email. If you need to check that it’s a genuine message, contact them directly.
• You can report suspicious emails you have received but not acted upon, by forwarding the original message to report@phishing.gov.uk.
• You can report suspicious texts you have received but not acted upon, by forwarding the original message to 7726, which spells SPAM on your keypad.

If you have acted upon a message you have received, and you think you may be a victim of a fraud, contact your bank immediately and report it to Action Fraud online at actionfraud.police.uk or by calling 0300 123 2040 as soon as possible.