/ Scams

How the fake Hermes parcel delivery texts are evolving

There’s been a resurgence in fake Hermes texts trying to lure you into bank transfer scams. Here’s how fraudsters have been changing their tactics to try to catch you out.

Text message scammers ultimately want to get hold of your details, including who you bank with, so they can later call you pretending to be that bank. They usually warn victims that their account has been compromised, persuading them to send their money to a new ‘safe account.’ But this is all a lie.

Scam texts claiming to be from delivery company Hermes have been circulating for a long time, but recently the scammers behind them have been trying to make their attempts to con you more convincing – here’s how:

Fake Hermes text tactics

These scams start out as a text message saying you’ve either missed a delivery or there’s a fee to pay for a parcel. They include a link that takes you through to enter details or make a small payment.

But Hermes never asks for payments via text – it only sends links that let you view parcel tracking.

Customers have wised up to this, so scammers are now including other details in the message to mimic real Hermes texts, and offer links to ‘track’ a parcel.

Some now include an estimated time of delivery and the names of big retailers, sometimes followed up shortly after with a fake missed delivery notification from the same number.

The links included take you through to copycat Hermes websites.

The masked SenderID

Scam texts can often be spotted because they’re usually sent by an unknown mobile number, rather than a named SenderID (such as ‘Hermes’).

In theory, these names should be protected by the phone network so they can’t be used fraudulently, but fraudsters have found a way to mask or ‘spoof’ Hermes’ name. We’ve seen fake texts drop into the same conversation thread as real text alerts from Hermes, making them more believable.

The first and third texts are genuinely from Hermes. The middle one (highlighted) is fake.

The cloned websites

Fake messages are linking to increasingly sophisticated copycat websites that look just like the real thing. Instead of asking for payment upfront, this clone site cleverly takes details from you, piece by piece, to ‘locate’ your parcel:

Only after you’ve handed over your address, number, and other personal information, the site warns there’s an outstanding fee to pay. By this time, a lot of victims have told us they’ve realised something’s not right, but have already given away sensitive details.

Scammers can still use these details to target people with more scams, possibly with phone spoofing scams where they pretend to be calling from your bank.

If you think you’ve given away your bank details, contact your bank immediately via its official channels and tell it what’s happened.

Staying safe from evolving scams

The number one piece of advice for avoiding being scammed: avoid following any links you’re sent in text messages. Even if:

🔹 The SenderID appears to be real

🔹 It’s asking you to update payment information urgently

🔹 It threatens a service or order will be cancelled

🔹 You’re curious about having had something delivered

Contact the organisation or company the message claims to be from directly to check the details if you’re not sure.

Hermes says it’s keen to protect customers from these scams. It’s put warnings across its website and offers advice on avoiding phishing attempts using its brand.  Its Chief Information Security Officer said:

“We take this very seriously and want to play our part in protecting the UK public as well as our customers, as we’ve seen that this issue has increased significantly since the start of the COVID-19 pandemic. Hermes has implemented and invested in multiple detect and response measures that we continuously monitor”

Forward scam texts you receive to 7726

You can share suspicious texts with your network provider by forwarding them to 7726 (spells SPAM on the keyboard). Cloned sites should be reported to the National Cyber Security Centre on report@phishing.gov.uk

You can also report these sites to the domain host, who can take steps to shut it down. You can find out which company hosts a website by putting the site’s URL into a Whois search.

Guide: how to spot a scam

Guide: how to get your money back after a scam

Have you received these fake Hermes text messages? Were you sent on to a cloned website? Let us know in the comments, and do help warn your friends and family.


Comments
Mike Corry says:
17 June 2021

I’ve had loads of these usually when I’m not expecting a parcel so I just block the number (no point really they just keep changing) and delete the text.
If I happen to be waiting for something I ignore the text and go to the courier’s app or direct to their website and don’t touch the link.

Mark Raynbird says:
17 June 2021

I have recently received a number of scam texts purporting to be from Hermes. I blocked the numbers. You can spot they’re fake because they use bad English ( the use of ‘was’ instead of ‘were’ ) eg. “we was unable to deliver your parcel” . Also, it was sent at 2am!

Trouble with bad spelling and grammar is that many people have no idea that “we was” isn’t correct English!

I am hoping that scammers’ ignorance prevails. It protects us from incompetent criminals – but only if we know right from wrong and that is far from widespread these days.

Sue Desmond says:
17 June 2021

I have had loads of these, some to my work phone which is really weird. Like Millie I delete and block but they still come through

Peter Swales says:
17 June 2021

What makes it worse is you don’t have a hope in hell of contacting Hermes as there customer service is non existent

A Rawson says:
17 June 2021

Had the Hermes one saying they had tried to deliver my parcel this week. I knew it was a scam and ignored it but curiously I did have a Hermes delivery later that day. Could they possibly have got the information that a delivery was actually due?
Wonder if others have had the email the same day as a delivery.

Jean Kitchen says:
17 June 2021

I have had several for Hermes. I know my Hermes delivery people and they know what to do if I am out. I ignore these texts and block them, although as other have said they still come through on another day.

Alison Derrick says:
17 June 2021

After a text message which I suspected was a scam I attempted to contact Hermes for about 3 hours – even posted on their social media. No response at all. Very unsatisfactory even if they knew this was an issue. I remembered they said there was no charge for re-delivery but I had details of the spam caller, a phone number etc but they were clearly not interested

I second that.

Janet says:
18 June 2021

I also spent a lot of time trying to contact Hermes, after a the scam text but they really do NOT wish to speak to you. I pressed option after option then back to the beginning. Really wish sellers would stop using them, it might shake them up a bit.

Pennie says:
17 June 2021

I tried to forward the text to 7726 but it said I would be charged. I have an all inclusive package so why is there a charge for doing this. It seems to defeat the object of alerting about scams

I forwarded a scam text to 7726 two days ago and was not charged. You could ask your service provider.

I have sent scam texts to 7726 myself, but have never been charged for this service.

Maria Sale says:
22 June 2021

I don’t have a forwarding option at all.

How to do this will depend on the operating system your phone uses. I had never forwarded a text on my iPhone but it was easy to find information online.

Barbara Ann Towers says:
17 June 2021

I had a text on 16 June saying missed delivery. No card was left and I was home all day. You cannot complain their website does not allow it and on Trust Pilot the hermes comment page is in permanent error. How did they get my text number to start with? If you dont submit to their text and fill in info they will not deliver. Its quite aggressive and also they want date of birth and full address …..they already have the address and why the full date of birth just a bloody scam.

I’ve had the fake Hermes notification. As I was expecting a delivery, I tried to check with Hermes but, unless you have a tracking number, THERE IS NO WAY YOU CAN GET THROUGH TO HERMES. These companies are not helping by being impossible to communicate with.

Robert Ward says:
17 June 2021

Had two in the last two days supposedly from ParcelForce. Sorry we missed you etc etc. address given as “parcelforce-gb.co/deliver?tracking” and a different tracking number for each one. Of course going to the real ParcelForce site and entering the given tracking details you get “tracking number not recognised”. Now there’s a surprise!

Chris Phillips says:
17 June 2021

Mine was a text from DPD on 6 Jun.
This is wording:
This is the text I received. I notice the website 3 dot menu does NOT work!

DPD: Sorry we missed you, please arrange your redelivery here: https://dpd.redelivery-date.com

I was expecting parcel so clicked to website. Very convincing but for one thing. The 3 dot Menu on RHS does nothing!

[Moderator: this website appears to be a scam website. We’ve retained the URL to help you identify it, but we’ve redirected the link to our guidance on how to spot fraudulent website. ]

Pat Jeffery says:
17 June 2021

Just had a suspicious text from hermes saying my parcel was being returned. I’m not expecting any parcels.

P J B says:
17 June 2021

I was sent this text message today. I was expecting a parcel, but was unsure of the Delivery Company. I foolishly filled in my sensitive details, but fortunately not my account or security number. I realized it was a scam when they requested £1.45 for the re-delivery. I have always been very careful, but this message appeared genuine. I have sent the text message to 7726 and contacted my Bank. I never thought this would have happened to me. I wish I had seen this e-mail before the text message, thank you Which.

People need two procedural changes to be put in place to help disrupt this particular form of scam –

a. Suppliers must inform the customer which carrier will be used when confirming an order or notifying the dispatch date.

b. Carriers must state the name of the consignor when notifying an expected date of delivery.

This would not be fool-proof and not guaranteed to prevent a scam attempt but it would remove some of the lack of knowledge of the situation on the part of recipients that provides the space in which the scam operates.

If the senders of fake e-mails had to guess who was sending a parcel the chances are they would get it wrong but there is a residual risk they would get it right in a tiny number of cases [e.g. M&S, John Lewis or Boots might be a good bet since they are popular distance sellers]. However, I think the scam would soon collapse as the criminals’ yields were not worth while.

LF says:
17 June 2021

My order from H&M was due to arrive on that day. Received scam Hermes email as above. As very coincidental I wrote to Hermes and H&M requesting they check there was not a leak of my info. Are scammers monitoring these web sites, if so how. Are they not as secure as they claim???

Had the Hermes £1.45 missed delivery scam by text, ignored and deleted it immediately.

Had quite a few of these TXTs. Tried to send them to 7726, they never go through.

I was sent a fake text supposed to be from Hermes that they tried to deliver my parcel but nobody was home I knew it was fake because there is always some one at home as I live with my mum so I reported it and deleted it

Linda says:
18 June 2021

I almost fell for this scam too, text seemed genuine and even had a link to contact the ‘Hermes’ customer services. Luckily I decided to check it out before I filled in anything and that’s when I found out my eBay order was sent by Royal Mail not Hermes.
This is awful and I bet many many people fall for it.

More Bright Ideas says:
18 June 2021

I read the article and decided that if I followed all the advice about contacting FOS, FSA, HMRC, M&S, YHA, the Tony (T.S.) McPhee fan club, the GPO, and the Boy Scouts, thus spending about an hour of my time reporting each scam, I’d have no time left to do anything else such as buy food, take my tablets, do a Cov-19 test, mow the lawn, or spend any money on-line. That last one could be deemed a satisfactory result as far as avoiding scams goes.
And then I read all these comments about lack of co-operation from most of the companies concerned. I’ve also read Which? articles about the same sort of thing being experienced by victims when trying to deal with banks.
The scam situation is not getting any better. It is getting a lot worse, and it seems that only Which? are seriously interested in doing anything about it. To me it looks as if the rest (including the ISP’s) are just paying lip-service to a load of toothless ‘policies’. When ‘punishment’ is applied it just means that a web site is taken down, only to spring up again after a few days. Nobody gets fined or imprisoned.
There are solutions but most are pretty radical so would probably not go down too well with company accountants. I like the one that has Amazon (and the rest) opening shops in High Streets, shopping malls, supermarkets, etc. Customers would order in the shops and return to collect when they arrived. When that happened, the goods would be inspected to ensure they were what had been ordered and were of the quality expected, and only then would money change hands. If the goods either failed to arrive or were incorrect then the shopkeeper would not get paid. The shopkeeper would be out of pocket until the refund from Amazon arrived. The customer might be slightly inconvenienced but would not have been scammed out of thousands of pounds.
I am sure that refinements would be necessary, but we are half-way there already with Click And Collect.