Fake delivery texts and order emails: the Black Friday scams to expect
Published 2026-10-04 by Woodruff Training
Between now and Christmas, nearly everyone in your business is waiting for something to arrive. Stock for the shop, a gift, a part for the van. Criminals know this, and they send out messages that look like the boring admin of a parcel on its way.
None of these scams is clever. They work because the message turns up while someone is expecting a delivery.
The two messages to recognise
The missed-delivery text. It says a courier could not deliver your parcel and asks you to tap a link to rearrange. Often there is a small fee to pay, a pound or two, which is the real point: the page collects your card details.
The order confirmation for something you never bought. An email says your order is confirmed, often for something expensive, and gives a phone number to ring "if this wasn't you". There is no malicious link to avoid, which is what makes it work. The person who answers the phone is the scammer, and they will happily talk you into handing over card details or installing "remote support" software to sort out the refund.
If you buy stock for a business, a third version is worth knowing about. A supplier you trust emails a genuine-looking invoice with new bank details, because their account has supposedly changed. We covered how that one works in invoice and QR-code scams.
Why this time of year
Fake shops also multiply in the weeks around Black Friday, because a huge discount on a popular item is a reason to skip the usual checks. A site you have never heard of selling something at half the normal price is a warning in itself. So is a payment page that only accepts bank transfer.
What to do instead of clicking
- Go to the source yourself. If a text says a parcel is waiting, open the retailer's app or type their address into your browser, then check the order there. Do not use the link or the number in the message.
- Be wary of fees. A small charge to rearrange a delivery is a common scam hook. If a payment is genuinely due, it will show in your account with the retailer.
- Never ring the number in an order email you did not expect. Look up the company's real number independently.
- Pay by credit card or a payment service where you can. Both usually give you more recourse than a bank transfer, which is hard to get back.
- Confirm bank detail changes by phone. Use a number you already hold for the supplier, not one in the email.
- Report what you spot. Forward suspicious texts to 7726, which is free and reaches the mobile networks, and send suspicious emails to report@phishing.gov.uk. Then delete them.
It also helps to say something to your team this week. A two-minute mention that fake delivery messages are about to get more common does more than any policy document. Our post on five phishing red flags is a handy thing to pass round.
If someone does tap a link or enter card details, the quickest useful step is to ring the card issuer and have the card stopped, then change the password for any account they typed in. Tell the person you are not cross with them. The faster someone owns up, the less it costs.
The takeaway is simple: a message that arrives because you are expecting a parcel is still just a message. Check the order from your own side, not from theirs.
If you'd like a hand preparing your team for the busy season, get in touch.