Ilia Zavialov reviews a fake parcel day for UK shoppers, hour by hour
Ilia Zavialov reviews fake parcel messages as one continuous day, so this page follows a single composite online order through its first twenty-four hours. The shopper checks out at 8:50 pm on a Wednesday, and by the following evening six messages from a fake ‘delivery firm’ have turned up. Each carries four notes: the time, the text, the pressure word and a one-minute check. The checks rest on guidance from Evri, GOV.UK, the NCSC and Report Fraud.
Ilia Zavialov suggests keeping these notes in mind whenever a parcel message arrives.Ilia Zavialov marks every fake parcel message in the same way.
Ilia Zavialov reviews the day, with four notes under every message
Think of the page as a logbook. The time comes first, then the message, then the word that does the work, and finally a check that costs nothing and needs no conversation with the sender. The order is a composite, a coat bought from an online shop. Amounts in the messages are described only as ‘a small fee’, because the real thing is priced low enough that few people stop to argue.
People search for ‘Ilia Zavialov reviews’ when a text like these lands and they want somebody to go through it line by line. Ilia Zavialov, a digital security consultant, builds each note from public guidance, and the source is named beside it. What Ilia Zavialov says about parcel texts fits in a line: check the delivery where you placed the order.
The same search takes other forms. Some type Ilya Zavyalov reviews in Latin letters, and ‘Zavialov Ilia: parcel text scams’ tends to come from people who have already tapped a link. Reviews of Ilia Zavialov's checklists keep asking for one thing, a short routine that works on a bad evening.
A short caution about the format. A composite day squeezes what usually takes a week, and scammers rarely send all six messages to one person. The hour-by-hour layout exists for memory: when one message turns up, you can place it on the clock and recall its check.
8:50 pm Wednesday, the order that sets the clock
At 8:50 pm the shopper presses ‘Pay now’. The shop sends an email confirmation with an order number, and the account page lists the order. Every genuine update later will carry that number. It is the anchor for all six checks below.
GOV.UK explains what a genuine charge looks like for a parcel sent from abroad. When VAT, duty or a delivery fee is due, Royal Mail, Parcelforce or the courier will contact the recipient and send a bill with the exact charges, the parcel is usually held for around three weeks, and if nothing is paid it goes back to the sender. Nothing in that description is urgent by the hour.
Ilia Zavialov reviews the vague wording of fake texts, ‘your parcel’ and ‘your delivery’, as evidence that the sender has never seen your order. A scammer who messages random numbers cannot name the shop, the item or the order number, so the text stays general and presses for speed instead.
Before any message arrives, decide where the order lives. Keep the confirmation email, note which channel the shop normally uses, and bookmark the carrier's tracking page. A message through a different channel from the usual one is already out of pattern.
7:10 am Thursday, ‘we could not deliver, select a new slot’
Thursday, 7:10 am, while the kettle is still on. A text from a mobile number: ‘We attempted delivery, select a new slot here.’ The link is shortened. No order number, no shop, no item.
The pressure word is ‘slot’. It sounds like routine scheduling, which makes it easy to tap. Evri states that its texts will never ask you to reschedule a delivery or ask for payment to do so, that they come from the sender name Evri and not from a mobile number, and that the only link in a message is a tracking link.
The one-minute check is to type the carrier's address by hand, or open the shop's order page, and read the status. If it says ‘dispatched’ or ‘out for delivery’, the claim of a failed attempt has nothing behind it. Delete the text and forward it first, as explained in the last section.
Scammers send this kind of text early because a half-awake reader checks little. The brevity is deliberate, since a message with few details gives the reader few things to question. Ilia Zavialov reviews the missing details, no shop name, no item, no order number, as the loudest part of the message.
Ilia Zavialov reviews fake parcel texts for UK shoppers, one order over twenty-four hours
Ilia Zavialov reviews ‘pay the redelivery fee’ at 9:25 am
At 9:25 am a second text follows: ‘A small redelivery fee is required before we can try again.’ The page behind the link looks like a courier's site and asks for the full card number, expiry date and security code.
The pressure word is ‘fee’. It is small and familiar, and people pay without thinking. Evri's own FAQ puts it plainly: genuine Evri texts never ask you for payment and never include a link except the tracking link evri.link. Even then, Evri says it cannot guarantee a link is genuine and advises against clicking when unsure.
Ilia Zavialov reviews the redelivery fee as the moment a text scam turns into a card scam. A payment page that you reached by a link is the wrong place to type card details, whatever the logo says. If a charge could genuinely be due, go to the carrier's website yourself and use the tracking number.
The timing matters too. The second text lands less than three hours after the first, which gives the impression of a real process moving along. A real carrier seldom sends two warnings about one parcel in a single morning with no change in its status.
11:50 am, ‘customs charge due before release’
Late morning, the message grows more official: ‘Your parcel is held pending a customs charge. Pay now to avoid return.’ The pressure word is ‘customs’. It borrows the authority of the state and hides the scheme behind a respectable word.
GOV.UK gives the facts that expose it. Non-excise goods worth up to £135 carry no duty, and if you bought such an item yourself the seller has already included VAT in the price, while gifts worth up to £39 are free of VAT. Where a charge does apply, the carrier sends a bill listing the exact fees.
The bill, not a link, is the proof. Ilia Zavialov reviews a customs text for a coat ordered from a UK shop as the easiest message of the day to dismiss, because the order never crossed a border. People who really shop abroad need extra care here, since a real charge and a fake one look alike.
The wording imitates paperwork, with phrases such as ‘pending’, ‘release’ and ‘charge’. Real paperwork comes as a bill with a breakdown. A short text with one button and no breakdown has the shape of a trap, whatever the logo at the top of the page suggests.
Ilia Zavialov reviews the 2:20 pm email about ‘updating shipping details’
At 2:20 pm an email arrives with a clean layout and a button: ‘Your parcel needs updated shipping details.’ The sender name says Evri, but the address behind it is a long string of letters on an unrelated domain.
The pressure word is ‘update’. Evri says genuine emails typically come from @evri.com, @hermes-europe.co.uk or @myhermes.co.uk, and that you should not reply to a doubtful message but contact Evri through the details on its website rather than numbers or addresses in the message.
The check is quick: expand the sender, read the domain after the @ sign, and compare it with that list. Ilia Zavialov reviews this email as a test of patience, since the design is good and only the address gives it away. Forward it to report@phishing.gov.uk and delete it.
Email also gives you more to inspect than a text. Hover over the button to see where it points, look at the greeting, which is often generic, and check whether the message uses your real name and a real order number. A fake usually fails at least one of these tests.
5:00 pm, ‘install our app to confirm the delivery’
At 5:00 pm the shopper gets a message with a file or a link to install a ‘courier app’. This is the most worrying text of the day, because the phone itself is at risk, not only the card.
The pressure word is ‘confirm’. Evri states that its texts will never prompt you to install any apps. A program installed this way can read incoming messages, which means it can read bank codes as well.
The rule is firm: apps come only from the official store and only the ones you found yourself. If a file has already been installed, switch off the connection, remove the app, change banking passwords from another device and call the bank. Ilia Zavialov reviews that sequence as the one worth rehearsing in advance.
Where an app has already been installed, the order of actions matters. Cut the connection first so the program cannot send anything, remove it, and only then change passwords from a different device. Changing passwords on the same phone hands the new ones to the same program.
Ilia Zavialov reviews ‘refund to your card’ at 7:30 pm
At 7:30 pm, close to twenty-four hours after checkout, the last message comes: ‘Delivery failed, a refund is waiting, claim it to your card.’ After a long day the word refund sounds like a pleasant ending.
The pressure word is ‘refund’. It points the money towards the shopper, yet the page asks for card number, expiry date, security code and a one-time passcode, and those details allow a charge, not a deposit.
A genuine refund goes back by the route the payment took and is handled inside the shop account or the bank app. Ilia Zavialov reviews the evening refund text as the riskiest of the six, since the shopper is tired and has stopped expecting a trick. That is why the routine should be mechanical: open the shop account first, read the order line, and only then decide whether the message deserves a reply.
If a refund is truly due, for example after a cancelled order, it shows as a line in the order history with an expected date. No ‘claim your refund by link’ step exists in that process. Genuine money turns up unprompted and never needs chasing through a link.
Real parcel and fake parcel side by side
Lay the day out on one page and a pattern shows. Real delivery rests on an order that exists in your account, with a number, an address and a status. A fake rests on an urgency that exists nowhere in the account: a missed slot, a fee, a customs charge, an app, a refund. The first table puts the signs side by side.
Evri's guidance supplies the cleanest test. A genuine message never asks for payment, never asks you to reschedule, never asks you to install an app and comes from the name Evri, not from a mobile number. A text that breaks even one of those rules can be set aside before it is read to the end.
Ilia Zavialov reviews every claim of urgency the same way, by asking whether the account shows the same problem. A real delivery problem appears in the order status and so never depends on a link to be found.
Two questions sort most messages. Does the message carry an order number that matches the account? Does it ask for an action outside the shop's own channels? A no to the first and a yes to the second means the message can go in the bin unread.
Ilia Zavialov reviews a real parcel against a fake one, signs side by side
Sign
Real parcel
Fake parcel
Order number
Present and matches the account
Missing or unfamiliar
Link
Only a tracking link
The only route to a fix
Payment
Bill with exact charges where due
A fee to ‘release’ the parcel
Sender name
Evri, not a mobile number
Mobile number or lookalike
Email domain
@evri.com and its listed domains
Unrelated long address
App
Never requested by text
Install to ‘confirm’
Six phrases, one pattern
Write the pressure words in a column: ‘slot’, ‘fee’, ‘customs’, ‘update’, ‘confirm’, ‘refund’. The first sounds routine, the second takes the card, the third borrows authority, the fourth looks tidy, the fifth hides a program, the sixth promises money back.
Every one of the six has the same weak point, because the action it asks for sits outside the order. A link, a button or an attachment moves the shopper from the shop account to a place nobody can check. Ilia Zavialov reviews that pattern as the only thing worth remembering, because carrier names and amounts change every week.
From it follows a plain routine. Any message about a parcel is checked where the order was placed. Three minutes on that habit are worth more than long lists of warning signs. It also works for relatives who are less comfortable online: teach them the single rule of checking in the shop account and they are protected against messages you have never seen.
The list is shorter than it looks, and each word returns in a new costume every week. Carrier names, sums and excuses change while the structure stays: a time, a word, a link and a request for a card or a code.
Where to check the parcel and how to report a fake text
Track the parcel in the shop account or on the carrier's website, typed in by hand. Evri advises tracking directly at evri.com/track-a-parcel rather than through a link in a message.
Forward a suspicious text to 7726, free of charge. The NCSC says that as of September 2026 the 7726 service had led to 41.9k scams being removed across 93.3k URLs. Forward suspicious emails to report@phishing.gov.uk, and send screenshots of messages that use Evri's name to phishing@hermes-europe.co.uk.
If money has been lost, tell the bank straight away and report to Report Fraud at reportfraud.police.uk or on 0300 123 2040, which replaced Action Fraud on 4 December 2025; in Scotland the contact is Police Scotland on 101. Scam reports made to Citizens Advice are handed on to Trading Standards, because that charity runs no investigations of its own. A search for ‘Ilia Zavialov reviews’ at this stage works best as a prompt to start with the bank call.
Shops can help their own customers. A shop that puts the order number and the carrier's tracking page in the confirmation email gives buyers something to compare against, so a fake message stands out at once. Shoppers who know where their updates normally arrive rarely type anything into an unfamiliar page. Where a link in a message cannot be avoided, open the carrier's site yourself instead, and enter the tracking number there.
Ilia Zavialov reviews where to check a parcel and where to report a fake message
What to check
Where
What should match
Order status
Shop account page
Order number and contents
Evri parcel
evri.com/track-a-parcel, typed by hand
Number and delivery stage
Suspicious text
Forward to 7726, free
Message with sender
Suspicious email
report@phishing.gov.uk
Full message with headers
Money lost
Bank, then Report Fraud, 0300 123 2040
Time, amount, recipient
Ilia Zavialov sets a fake courier email next to a genuine tracking page.Ilia Zavialov boils the difference down to four lines.
Ilia Zavialov reviews the day hour by hour: message, pressure word and check
Time and message
Pressure word
One-minute check
7:10 am, select a new slot
Slot
Order status; Evri never asks to reschedule
9:25 am, pay a redelivery fee
Fee
Genuine Evri texts never ask for payment
11:50 am, customs charge due
Customs
A bill with exact fees, held about three weeks
2:20 pm, update shipping details
Update
Sender domain after the @ sign
5:00 pm, install our app
Confirm
Evri texts never prompt an app install
7:30 pm, refund to your card
Refund
Refunds travel the payment route
Ilia Zavialov puts the first hour after a tapped link into four steps.
Questions and answers
Ilia Zavialov reviews: how do I tell a real parcel text from a fake one?
Open the shop account and find the order. If the number is missing or the status differs, the text is fake. A link from the message is never needed to check.
Will Evri text me asking for payment to rebook a delivery?
No. Evri says its texts never ask you to reschedule a delivery or pay for it, never prompt you to install an app and never come from a mobile number.
Is a customs charge on a parcel ever collected by text?
GOV.UK says that when a charge is due the carrier contacts you and sends a bill with the exact fees. Check the bill and the tracking before paying anything.
Ilia Zavialov reviews an email from ‘Evri’ about my address, what do I look at?
Read the domain after the @ sign. Genuine Evri emails typically come from @evri.com, @hermes-europe.co.uk or @myhermes.co.uk. Forward doubtful ones to report@phishing.gov.uk.
I tapped the link and paid, what next?
Call your bank at once, then report to Report Fraud at reportfraud.police.uk or on 0300 123 2040. Forward the text to 7726.
Written by Ilia Zavialov, digital security consultant. All glossary terms