Royal Mail Scam Email (2021)

Royal Mail Scam Email: How It Works

If you live in the United Kingdom, you might target the Royal Mail scam perpetrators. There are three fraudulent variations: email from the HM Courts & Tribunals Service, penalty letter, and parcel collection. The last two are looking into downloading CryptoLocker ransomware into your computer.

Let’s take a look at all the variations.

Scam Detectors Most Trusted Websites in Online Security

Guard.io (100): Protect your digital world on any device – Guardio stops scams and phishing in their tracks.
Incogni.com (100): Delete your personal data from the internet and protect against scams and identity theft.
ExpressVPN (100) Stay secure and anonymous online - Best VPN Out There

1.HM Courts & Tribunal Service Variation

In the first variation of the Royal Mail scam email, the HM Courts & Tribunals Service email, the content of the message reads:

“Unsuccessful delivery attempt
Package from: HM Courts & Tribunals Service
Package type: Large letter
Delivery date & time: Friday, 27 November 2020 12:05
We attempted to deliver your package at 12:05 on Friday, 27 November 2020, but no one was available.
Your parcel was returned to our depot, and you need to reschedule your package delivery.
Please reschedule your package delivery by pressing ‘Reschedule Now’, and one of our drivers will attempt to deliver your package.
Reschedule Now (fake email)
Thank you,
The Royal Mail Team”

2. Penalty Letter Variation

There are two variations of the scam. According to The National Fraud Intelligence Bureau (NFIB) cited by Action Fraud, “one of two email types have been received by the victims, both stating that the Royal Mail are holding an item for the victim and that a response to the email is required to arrange for the item to be resent/collected:

The email states that they are holding a letter, and there will be a £5 per day charge if the letter is not collected. It then instructs the victim to click on a link to get the letter resent. From here, the ransomware infects the victims’ system.

3. Parcel Waiting For Collection Variation

The email states that a parcel could not be delivered and that it is waiting for collection. A link in the email is provided for further information. The link takes the victim to a page that appears to be part of the Royal Mail website, where victims are requested to enter a code (believed to have been in the original email). Once the code has been entered, the victim is instructed to download an application; this application downloads the ransomware.”

The email address that these scams are coming from is [email protected].

“The ransomware encrypts files on the victim’s computer, and a window appears requesting a payment, to be made in Bitcoins, to decrypt the files. There is further incentive for early payment as the ransom states that the cost of decrypting the files will increase the longer the fine is outstanding.

The victim is asked to pay around £300-£360 initially, rising to £600-£660 if not paid within a period of time. “The victims of the Royal Mail scam, although primarily individuals, does also include several businesses.”, informs Action Fraud, which is the National Fraud& Cyber Crime Reporting Centre in the United Kingdom.

Royal Mail Scam Email: How To Avoid

NFIB recommends that you look at who the email is addressed to see if is it generic or specifically addressed. “Look at the quality of the images included in the email. Are they of sufficiently high quality that they could come from Royal Mail? Do not open attachments from unsolicited emails regardless of who they are from.

Do not click on the link supplied. Instead, go to the relevant website and log in from there. Check the address of any email received to see if it appears legitimate”.

How To Report a Scammer

To report the Royal Mail scam and receive a police crime reference number, call Action Fraud on 0300 123 2040 or use their online fraud reporting tool HERE.

Verify Another website

Are you just about to make a purchase online? See if the website is legit with our validator:

vldtr^®