Fake Royal Mail Cards: Phishing Through the Letterbox

Most phishing arrives on a screen. This kind comes through the letterbox. Royal Mail has warned that fraudsters are posting fake versions of its red "Something For You" delivery cards, the slips a postie leaves when a parcel cannot be delivered. The counterfeits look almost identical to the real thing and carry a QR code or link asking for a small "redelivery" or "customs" charge. Anyone who scans and pays lands on a convincing copy of the Royal Mail website built to collect their card details.

The timing is no accident. In the run-up to Christmas, most households and plenty of workplaces are expecting parcels, and a missed-delivery card is about as ordinary as post gets. That is exactly what makes it useful to a criminal.

What has Royal Mail said?

In a social media video, Royal Mail asked whether people had recently received one of its redesigned "Something For You" cards and warned that some are being misused. Its message was: "Scam texts, emails, websites and cards can look convincing. They often claim there's an issue with your parcel and pressure you to act fast. Before you click a link, scan a QR code or make a payment, take a moment to check for the warning signs."

Royal Mail has also explained how the genuine process works, which is the most useful part of the warning:

• Genuine red "Something For You" cards are left after a failed delivery attempt, and they always include a QR code to help you manage the next steps.
• In Royal Mail's words, "A standard red slip will never request payment."
• Where a fee is genuinely due, for example because of insufficient postage, Royal Mail leaves a separate grey "Fee to Pay" card. Royal Mail says these cards direct people to pay in person at a Post Office branch, not by card through a text, an email link or a QR code.
• Royal Mail's scam protection guidance says it will not ask for bank details, passwords or personal data, will not ask for underpaid postage by email or text, and will not ask you to enter information on a website that is not part of Royal Mail. The one exception it lists is customs fees: if the sender supplied your contact details, you may also get a text or email about them, but a grey card is still left.

Why does a fake delivery card work?

It borrows trust from the real thing. Because genuine red cards really do carry a QR code, a QR code on a fake card does not look out of place. The usual advice to be wary of QR codes from unknown sources is much harder to apply when the source appears to be Royal Mail.

It also arrives on paper. Many people have grown sceptical of unexpected texts and emails, but a card on the doormat feels physical and official. There is no sender address to inspect and no email filter in the way. The only checks are the ones the reader makes.

The amount asked for is small, too. A modest redelivery or customs charge does not set off the alarm that a large demand would. The fee is the bait, not the prize. What the criminal wants is the full card number, expiry date and security code typed into the fake site, often along with a name, address and phone number. Details like these can be used for fraudulent payments and to make follow-up scams more believable.

What might it look like in practice?

This is an illustration based on the pattern Royal Mail describes, not a specific reported case. Someone working from home has three parcels on the way. A red card lands on the mat saying a delivery was missed and a small fee is due before it can be redelivered. They scan the QR code with their phone, reach a page in Royal Mail colours with a tracking-style layout, enter their postcode and then type in their card details to pay. The page thanks them. No parcel turns up, because there never was one. Each step looked ordinary on its own, and nothing about the process felt like "being phished".

Why should businesses care?

It is tempting to file this under consumer scams. But the people receiving these cards are your staff, and the phone they scan with is very often the same phone they use for work email, Microsoft 365 or Google Workspace sign-ins and authenticator apps. A QR code moves the interaction off the managed laptop, where web filtering and browser protections sit, and onto a phone where those controls may not exist.

The tactic also transfers easily. A fake delivery card asking for payment at home today could be a fake "parcel held at reception" notice in an office tomorrow, sending people to a counterfeit sign-in page instead of a payment page. The ingredients are the same: a trusted physical format, a QR code and a small, urgent task.

That is why security awareness needs to cover the channels people actually use, including post, text messages and QR codes, and not email alone. People who know how a genuine process works are far better placed to notice when something does not match it. For organisations, that means including delivery and QR code lures in training and simulations, and making it easy and blame-free for staff to report anything suspicious, even when it arrived at home.

How to spot and handle a fake card

• Remember the colour rule. A red "Something For You" card should never ask you to pay. Requests for underpaid postage come on a separate grey "Fee to Pay" card.
• Go direct. Royal Mail's advice is: "If you're unsure, don't click any links or scan any QR codes." Type the Royal Mail web address yourself or use the official app, and enter the reference number from the card to check on the item.
• Check where a QR code leads before acting. Most phone cameras show the web address before opening it. If it is not an address on royalmail.com, stop.
• Treat urgency as a warning sign. Pressure to pay quickly is a hallmark of scams, as Royal Mail's own warning points out.
• Report it. Royal Mail asks people to photograph a suspicious card and email it to reportascam@royalmail.com. Suspicious texts can be forwarded free to 7726.
• If you have paid or shared details, act quickly. Call your bank on the number on the back of your card, then report it to Report Fraud, which replaced Action Fraud in England, Wales and Northern Ireland, online at reportfraud.police.uk or on 0300 123 2040. In Scotland, contact Police Scotland on 101.

The bottom line

Fake delivery cards are a reminder that phishing can arrive without an inbox in sight. The best defence is knowing what normal looks like: a red card never asks for money, and when in doubt you go to Royal Mail directly instead of following whatever is printed in front of you. And if you are caught out, say so. As Citizens Advice puts it, "Do not feel embarrassed about reporting a scam." Every report makes it harder for the same trick to work on the next person.

Phishing Tackle offers the tools businesses need to strengthen their human risk strategies, with multi-platform testing, real-time behavioural insights, and actionable data to keep your organisation ahead of modern cyber threats.

Contact us today to learn how Phishing Tackle can help safeguard your organisation from the growing array of cyber risks.