SMS & EMAIL PHISHING

Evri delivery fee text and email scam: is that "redelivery fee" real?

A fake Evri message about a missed delivery, an address that needs confirming, or a small redelivery fee is one of the most reported courier scams in the UK right now. Evri itself has warned about the surge and says it has taken down more than 12,000 malicious sites impersonating the brand.

SB

SafeBrowz Threat Research Security ResearchJuly 1, 20268 min read

What the scam looks like

The message arrives looking routine. A short delivery-issue note, a tracking-style reference, and a link. The text claims your parcel could not be delivered because nobody was home, or that it is held until you confirm your address or pay a small fee, and it pushes you to act before the parcel is "returned to sender." That deadline is the trap. It exists to make you tap before you think.

The link leads to a page styled to look like the real Evri site. First it asks you to confirm your name and address, which feels harmless and builds trust. Then it asks for a small payment, usually a "redelivery fee" or "customs charge" of a pound or two, by card. The fee is not the point. The card number, expiry, CVV, and billing address you type into that form are the point. Within hours the card is tested with small charges and then used for larger fraud. Some variants skip the fee entirely and instead push a malicious app download or a link that drops malware on your phone.

The text (smishing) version

"Evri: We were unable to deliver your parcel today as no one was available. Reschedule here: [link]"

"Evri: A redelivery fee of £1.45 is required to arrange your parcel's next attempt. Pay here: [link]"

The email version

The email carries an Evri-style logo, a fake tracking number, and a "Confirm your address" or "Pay outstanding shipping fee" button. The from-address is usually a random webmail or an unrelated domain, not evri.com, though it may show "Evri" as the display name to hide that.

The fake Evri addresses to watch for

The real site is evri.com. The scam links use lookalikes that put the Evri name on a domain Evri does not own, often on a cheap or unusual ending, such as:

• evri-redelivery[.]com
• evri-fee-pay[.]net
• evri-parcel-uk[.]top
• evri-track[.]info

They may also hide the real destination behind a link shortener. The tell is always the same: the Evri name sitting on a domain that is not evri.com. Look at the part right before the first single slash. If it does not end in evri.com, do not trust it.

How Evri really contacts you

Evri does send genuine delivery updates, so the goal is to tell the real ones apart from the fakes. Here is what Evri actually does, and what it never does.

• No fees by link. Evri will never ask for a redelivery, customs, or clearance fee, and never asks for your card details, through an SMS or email link.
• Three attempts, no charge. Evri attempts delivery up to three times at no extra cost. There is no "pay to redeliver" step.
• Branded sender and one domain. Genuine Evri texts come from a branded "Evri" sender and link only to evri.com.
• Verify at the source. If a parcel genuinely needs action, check it by going to evri.com directly or opening the Evri app, never through the link in the message.

How SafeBrowz blocks this threat

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI.

• Layer 1 - Local detection: 60+ URL patterns plus 550+ brand-specific signatures run inside the extension before the page renders. When "Evri" appears on a domain that is not Evri's own, the lookalike-domain check flags it. A page on evri-redelivery[.]com carrying the Evri name is exactly the brand-on-non-official-domain signal this layer is built to catch, instantly, without any per-user browsing data.
• Layer 2 - API checks: cross-references Google Safe Browsing, PhishTank, URLhaus, and known-bad domain feeds, plus a list of cheap and abused TLDs that delivery-scam pages favour.
• Layer 3 - AI content analysis (Premium): through our proxy, the page text is read for impersonation and credential-harvest patterns, so a brand-new lookalike with a domain nobody has reported yet still gets caught.

Honest scope: SafeBrowz flags the fake Evri page before you type your card number into it. It cannot un-send details you have already submitted, which is why the recovery steps below still matter. Detection signatures come from threat-intelligence research and our internal brand database, not from user browsing data. SafeBrowz does not store per-user browsing history.

Red flags checklist

• Were you expecting an Evri delivery? If not, ignore the message. If yes, do not use the link in it to check.
• Any fee at all. Evri does not charge a redelivery, customs, or clearance fee by text or email. Any "£1.45 to release your parcel" message is fake. The tiny amount is deliberate, calibrated to feel too small to question.
• The link. Real Evri links end in evri.com. A lookalike such as evri-fee-pay[.]net, or a shortened URL that hides the destination, is the giveaway.
• It asks for card or login details. A genuine tracking page shows you status. It does not demand your full card number and CVV to "release" a parcel.
• Pressure and a deadline. "Returned to sender in 24 hours" exists to rush you. Evri makes up to three attempts at no charge and holds parcels rather than bouncing them instantly.
• The sender. An out-of-country number, a random webmail email address, or a "Confirm your address" button pointing away from evri.com are all strong scam signals.

What to do if you got one

1. Do not tap the link. Treat the whole message as untrusted until you confirm it independently at evri.com or in the Evri app.
2. Report a scam text. Forward it free to 7726, the UK spam-report shortcode. Your mobile network uses these reports to block the sender.
3. Report a scam email. Forward it to [email protected], the National Cyber Security Centre's Suspicious Email Reporting Service.
4. If you lost money, report it to Action Fraud at actionfraud.police.uk or by phone on 0300 123 2040.
5. If you entered your card, lock the card in your bank app, call your bank's fraud line, and order a replacement. Watch for small test charges over the next day.
6. If you entered a reused password, change it everywhere and turn on two-factor authentication.

Why couriers like Evri are such a common target

The same template runs against Royal Mail, DHL, DPD, and Amazon deliveries. Only the logo and the domain change. The mechanic, a tiny fake fee or an address-confirmation in front of a card-capture form, is interchangeable. It shares its DNA with the DHL package tracking text scam and the Canadian Purolator delivery text scam, and with fee-bait smishing like the unpaid toll text scam. If you want a general method for checking any suspicious link, our guide on how to tell if a website is a scam walks through it.

Frequently asked questions

Is this Evri text genuine?

If it asks you to pay a fee, confirm your address through a link, or hand over card details, it is not genuine. Evri does send delivery updates, but it never charges a redelivery, customs, or clearance fee by text or email, and never collects card details through a link. Genuine Evri texts come from a branded "Evri" sender and link only to evri.com. When in doubt, ignore the message and check your parcel at evri.com or in the Evri app.

Does Evri ever charge a redelivery fee?

No. Evri attempts delivery up to three times at no extra charge, so there is no "pay to redeliver" step. Any text or email asking for a small fee to release or reschedule your parcel is a scam, regardless of how small the amount is.

The link looks almost exactly like evri.com. Is it safe?

Look at the part right before the first single slash. The real site ends in evri.com. Scam links add words or use a different ending, such as evri-redelivery on a .com, .net, or .top domain that Evri does not own, or hide everything behind a link shortener. The brand name on an unfamiliar domain is the tell. When in doubt, do not tap it, and paste it into the checker on this page first.

I got the Evri message by email, not text. Is that different?

The trick is the same. A phishing email carries an Evri-style logo, a fake tracking number, and a "confirm your address" or "pay a fee" button that leads to a lookalike page. The from-address is usually a random webmail or an unrelated domain, even if the display name says Evri. Forward scam emails to [email protected] and verify your parcel only at evri.com.

I paid the small fee with my card. What now?

The few pounds is not the real loss. The scammer now has your card details and will try larger fraud. Lock the card in your bank app right away, call your bank's fraud line, order a replacement card, and watch for tiny test charges over the next day. Dispute any unauthorized charge and, if you lost money, report it to Action Fraud on 0300 123 2040.

Where do I report a fake Evri text or email in the UK?

Forward a scam text free to 7726, and forward a scam email to [email protected] (the NCSC Suspicious Email Reporting Service). If you lost money, report it to Action Fraud at actionfraud.police.uk or on 0300 123 2040. You can also delete the message and block the sender.

Bottom line: The Evri redelivery fee text and email is the UK cousin of the DHL and Royal Mail delivery scams. Same trick, different logo. Evri does send delivery updates, but it never charges a fee by text or email and makes up to three attempts for free. Never tap the link. Verify at evri.com or in the app yourself, and put SafeBrowz on your browser so the fake Evri page never loads in the first place.

Install SafeBrowz free

Add the browser extension, or the SafeBrowz Android app, that runs every check in this article automatically, on every page, before it renders. Free forever.

Add to Chrome Add to Firefox Add to Edge Get on Android