Evri Text Message Scam: Fake Delivery Updates That Steal Your Card Details

A text says your parcel is stuck because the address is incomplete. One quick update, it suggests, will keep the delivery moving.

The Evri text message scam starts with that familiar inconvenience. The useful clues appear when you compare the requested action with a real delivery update.

Overview

A missing-address story creates a reason to follow a link

Fraudulent Evri texts claim a parcel could not be delivered, an address needs correction, or an item will be returned unless you respond.

They lead toward an imitation delivery page that may collect personal details and payment information. Some also ask you to reply before using the link.

The sender is impersonating Evri, not demonstrating that the genuine courier has mishandled your parcel. Confirm the underlying delivery through your original order.

Evri’s official digital-security guide distinguishes genuine tracking texts from requests for redelivery payments, installations, and unfamiliar destinations.

Real tracking and claim messages have important exceptions

Evri does send delivery updates by text and email. Its guidance says text tracking links lead to its own website.

The company also describes messages connected with an ongoing claim. Those can ask you to respond yes or use response buttons to confirm parcel status.

That is not the same as an unexpected demand to reply Y to activate a payment link. The context and requested action matter.

Evri says its texts do not ask you to reschedule, pay for redelivery, or install an application. Those instructions contradict its published process.

Look for the whole sequence rather than one suspicious word

Useful warning signs include:

• A delivery notice from an ordinary mobile number rather than Evri’s stated sender label.
• A missing-address claim that takes you to a non-Evri website.
• A demand to pay before a parcel can be released or rescheduled.
• A reply request framed as necessary to unlock an unfamiliar link.
• Instructions to install tracking software outside a trusted app store.

No checklist replaces checking your actual order. A familiar sender label or a well-written message still does not establish who controls the link.

The lead image is an illustrative text conversation using a deliberately fictional domain. It is not a captured Evri message or proof against a particular sender.

Why the Address Problem Sounds So Reasonable

Delivery logistics provide a believable explanation

Apartment numbers, access instructions, and unfamiliar locations can cause real delivery difficulties. An address-correction request therefore fits something a recipient can imagine happening.

The scam uses that plausibility to move you into a separate process. The text does not need to know which item you ordered to seem relevant.

Someone expecting several parcels may mentally supply the missing retailer and item. The sender benefits from the details the recipient fills in.

A return threat makes the deadline feel practical

Few shoppers want an item returned after waiting for it. A short deadline creates pressure to finish the form before checking the order.

That urgency is not delivery evidence. The status should be checked through the retailer or courier account rather than accepted because the wording sounds plausible.

A real tracking record may explain a delay without asking for a payment. Keep the logistical question separate from the text’s financial request.

A reply can feel less risky than a payment

Replying with a single letter may appear harmless. It can also make an unfamiliar conversation feel accepted before the sender asks for more.

Do not treat that first action as verification. A reply does not authenticate the website or prove that the message belongs to your delivery.

Equally, do not condemn every yes request. A claim you initiated through the real courier has a different context from a surprise link-activation story.

How the Evri Text Message Scam Works

Step 1: An unsolicited text introduces a parcel problem

The message alleges a failed delivery or incomplete address. It may threaten to return the parcel unless the recipient takes immediate action.

The text can arrive even when no delivery is expected. When one is expected, coincidence makes a broad message appear connected with a specific purchase.

Look for the retailer and original tracking reference in your own records. Do not supply those details to an unknown sender to help explain the claim.

Evri’s stated SMS sender is Evri rather than a mobile number. A mismatch is useful evidence, although a matching display label is not sufficient reassurance.

Receiving the text alone does not give its sender access to your financial accounts. The next actions determine the greater risk.

Step 2: A reply or link moves you into the sender’s process

Some texts ask for Y or YES before the link is used. Others send the recipient directly to an address-update or delivery page.

In the suspicious activation version, the reply is tied to accepting an unfamiliar sender and accessing their destination. It is not an independent courier check.

Evri’s current guidance also allows yes responses for an ongoing claim. Verify that a claim actually exists through the route you used to open it.

Do not rely on a blanket rule about a single letter. Ask whether the message matches your initiated claim and the company’s published action.

If there is no matching delivery or claim, stop. A second text explaining the first still comes from the same unverified conversation.

Step 3: A copied delivery page asks you to correct details

The destination may imitate the courier’s colors, navigation, and tracking layout. Its purpose is to make a new data request feel like finishing a delivery task.

Name, address, and telephone fields match the original story. Their apparent relevance encourages you to trust the rest of the form.

The domain needs checking before information is typed. A name containing Evri, or a browser showing HTTPS, does not establish courier ownership.

Open the real website separately rather than experimenting with an imitation page. You do not need to submit a false address to test it.

Data entered before a final confirmation may already be collected. Closing the page afterward does not reliably undo that disclosure.

Step 4: An address update turns into a payment or installation request

The form may introduce a redelivery or release charge and request card information. That changes a claimed address correction into financial exposure.

Evri states that its texts do not request redelivery payments. Paying through a linked imitation page is not an ordinary part of its tracking notification.

An alternative delivery-message threat pushes a supposed tracking application. Installing software is a separate risk from entering card details and needs a different response.

The NCSC explains malicious missed-parcel downloads. This does not mean every Evri phishing page installs malware or uses the same historical payload.

A banking authorization or application permission should never be accepted simply because the webpage says it is needed to complete delivery.

Step 5: The operator can reuse exposed information

Personal details may support more convincing messages later. Card information can support payment attempts, while a password may be tried against another service if reused.

A follow-up caller might claim the payment revealed fraud and offer to secure your bank account. Correct details do not establish that caller’s authority.

These are possible consequences of exposure, not events proved to occur after every suspicious text. Response should match the data and permissions actually provided.

Tell your bank what the original page requested and what any subsequent bank notification said. That distinction helps identify unauthorized changes.

Do not stay in contact with the sender to obtain a refund, tracking confirmation, or security fix. Their next explanation is still unverified.

Check a Delivery Update Without Trusting the Text

Begin with the retailer’s order record

Find the parcel reference in your retailer account or original dispatch message. Confirm which courier was actually assigned and whether the item has shipped.

Use Evri’s genuine website to access tracking independently. The status should correspond to your purchase rather than merely resemble a plausible delivery story.

If the retailer provides no matching shipment, ask it through its normal support channel. A mystery text does not fill that gap.

Distinguish a tracking update from a claim response

A tracking notification helps you view a parcel’s progress. An ongoing claim may ask you to confirm whether delivery occurred.

Neither context automatically authorizes a redelivery payment or application installation. Evaluate each extra request separately instead of accepting the whole conversation as one trusted workflow.

If you did open a claim, check the reference and status with Evri directly. Avoid contact numbers introduced only by the uncertain text.

Use current reporting information, not copied historical advice

Evri’s current security page lists phishing@hermes-europe.co.uk for suspicious email and text screenshots. The older brand in that address is not itself a warning sign.

It also lists several authorized email domains. Therefore, claiming that every genuine Evri email must end in one single domain would be misleading.

Sender information is a clue to compare with current guidance. It cannot authenticate a payment link or replace your independently accessed tracking record.

What to Do if You Have Fallen Victim to This Scam

1. Work out exactly how far you went.

   Record whether you replied, opened a page, typed personal details, entered a card, shared a code, or installed anything.

   Do not combine all those actions into one assumed outcome. They require different containment steps and help support teams assess the incident.

2. Tell your card provider about an unsafe payment form.

   If card information was entered, reach the issuer through your usual banking app or the contact printed on the card.

   Ask about replacement, temporary restrictions, pending activity, and monitoring. Explain that the page claimed to collect a delivery fee, even if no charge appeared.

3. Flag codes and banking approvals as separate exposure.

   A code may authorize a transaction or account change, depending on its wording. Preserve the original notification and tell the issuer what you approved.

   Cancel further interaction with the webpage. Do not approve a second request because it promises to undo or verify the first.

4. Replace any password submitted to the imitation site.

   Visit the genuine account on a trusted device, update the password, and check recovery information. Address any reuse on email or financial services.

   If the form collected only an address, password changes alone will not address that disclosure. Remain alert to personalized follow-up contact instead.

5. Get help if an application or permission was added.

   Stop sensitive activity on the affected device until it has been assessed. Tell a trusted technician or workplace IT team what you installed.

   Malwarebytes may help check suspected malware on supported systems. AdGuard can limit unwanted ads or known risky sites, but it does not repair an account takeover.

   Use the relevant NCSC recovery guidance when malicious software is suspected. Do not reset a device casually without considering data loss and trusted support.

6. Save evidence and report the text safely.

   Keep a screenshot, sender information, visible destination, and approximate receipt time. Do not return to a phishing site just to gather a better picture.

   Forward the suspicious text to 7726. Follow Evri’s current security-page instructions if sending a screenshot to its reporting mailbox.

7. Report financial loss through the proper official service.

   GOV.UK’s reporting page directs users to the relevant fraud and police channels. Include transaction information and your bank’s case reference.

   Separately contact the real retailer about the actual order. A scam report does not open a legitimate parcel inquiry automatically.

8. Prepare for convincing follow-up messages.

   Someone may reuse your address, the alleged parcel issue, or payment details to claim they are helping with fraud. Treat incoming assistance as unverified.

   Discuss new requests with a trusted person and use established provider contacts. Do not pay recovery fees or allow surprise remote sessions.

Frequently Asked Questions

Does Evri send genuine delivery texts?

Yes. Its published guidance describes tracking updates and some ongoing-claim messages. A text is not fraudulent merely because it mentions Evri.

Check the shipment and requested action through the real courier service.

Is a request to reply YES always a scam?

No. Evri says an ongoing claim can request a yes reply or response-button confirmation.

An unexpected instruction to activate an unfamiliar delivery or payment link is a different situation and should be checked independently.

Should an Evri text ask me to pay for redelivery?

Evri’s security guidance says its texts do not request rescheduling or payment for redelivery.

A payment demand inside an unexpected address-correction flow contradicts that process. Verify the parcel outside the message.

Does a Hermes email address automatically mean fraud?

No. Evri currently lists authorized legacy Hermes domains and a Hermes-domain phishing-report mailbox.

Compare the exact address with current official guidance rather than judging it solely by the older brand name.

What if I only replied with Y?

A reply alone does not normally reveal banking credentials or authorize payment. It may confirm that your number is active.

Stop the conversation and avoid the link. Escalate your response if you also entered details or installed software.

Can I trust the text because I am expecting a parcel?

No. The timing may be coincidental, and a broad delivery claim can fit many orders.

Use your retailer’s original shipment reference to confirm the parcel through Evri independently.

The Bottom Line

The Evri text message scam turns a believable delivery inconvenience into an unsafe form, payment, or installation request.

Check your actual shipment, distinguish real claim responses from activation lures, and react to the information or permissions you exposed rather than the text’s reassuring branding.