Scammers use a verified WhatsApp account to carry out new delivery scam

A WhatsApp message from a compromised verified business account tells you that your delivery has ‘failed’ and includes a link to a copycat Evri website.

Scammers have long taken advantage of potential victims awaiting online orders by posing as delivery companies and leading them to dodgy websites. Some scams can be easy to spot, others can be more challenging. 

Read on to find out what this new delivery scam looks like and how to spot and avoid scams like these.

Sign up for scam alerts

Our emails will alert you to scams doing the rounds, and provide practical advice to keep you one step ahead of fraudsters.

Sign up for scam alerts

Scam delivery message

This WhatsApp message tells you that a courier failed to deliver your parcel because nobody answered the door. It then provides a link to follow ‘in order to reschedule a new delivery’.

One of the first signs that this is a scam message is the poor grammar, and that it includes a link that isn’t Evri’s official website: evri.com.

The message is labelled as being sent from a ‘verified’ account owned by a compromised business. Meta, which owns WhatsApp, provides these accounts to users who pay a monthly subscription to Meta Verified or to notable brands.

Users with this status have been verified by Meta based on their activity on WhatsApp and the documents they provide. 

Which? contacted WhatsApp about this message and it confirmed that the account belongs to a legitimate business that has been compromised. 

It said that the account has been banned and it's working with the legitimate account owners to restore their access. 

WhatsApp accounts can be compromised in a variety of ways. Scammers may first carry out a sim swap attack or create phishing websites, which spread malware to your device or gather your personal details, such as your phone number.

• Read more: What is sim-swap fraud and why do scammers want your number?

Evri copycat website

Recent research carried out by Which? and the DNS Research Federation (DNSRF) found that Evri was one of the top five delivery brands most impersonated by fraudsters.

The scam website looks the real deal. It convincingly copies Evri’s official website through accurate and up-to-date logos and branding.

It asks for your personal information including your name, phone number, date of birth and home address as well as your bank card information.

This provides a wealth of information for scammers that they could use to target you in another scam at a later date. So even if you don’t notice any unusual activity on your bank account, you may be scammed in the future by fraudsters who’ve bought your information.

Spotting scam websites and texts

If you receive an unexpected text, you should always be cautious. Links in text messages are also a red flag and you should verify the information in the text message through other means, such as visiting the brand’s official website or logging into your account with that brand.

If you come across a website that you’re suspicious of, make sure you:

• Type it into who.is to see when it was created because newly formed websites should be a red flag. Which? checked the site impersonating Evri and found that it was created under a week ago.
• Check the web address – brands typically have one official website so anything else should be treated with caution.
• Check the links on the website. On the scam Evri site, all of the links were dead links, meaning they didn’t lead anywhere, showing that the website is just a front to get your data.

You can report scam websites to the National Cyber Security Centre (NCSC) on its website.

To report a WhatsApp user, open up the chat, tap on the sender's contact details and select 'block and report'.

If you lose any money to a scam, call your bank immediately using the number on the back of your bank card and report it to Action Fraud, or call the police on 101 if you’re in Scotland.