The message is short and boring, which is the point. “Your parcel is being held. A fee of £1.99 is required for redelivery.” There is a link, the link looks close enough to a courier's real address, and the page it opens is a competent copy of a payment form.

The £1.99 is not the fraud. It is the qualifying step: anyone willing to type card details into that page has proved the card is live and the person is responsive. The real loss arrives days later, either as a larger transaction or as a follow-up phone call from “the bank” about the suspicious £1.99 you have just noticed.

What makes this wave more effective than previous ones is timing. Two of the three reports we had this week landed within an hour of a genuine delivery notification from a different retailer. That is not coincidence - parcel volumes are predictable, and so is the window in which a delivery text feels plausible.

The follow-up call is the part worth preparing for. It uses the same script every time: we have spotted fraud, we need to move your money to a safe account, do not tell the branch. No bank does this. If you have already tapped a link and given details, the call is more likely, not less.