Malware alert: beware of fake delivery company text messages

23 April 2021

A text-message scam that infects Android mobile phones with malicious software (malware) is targeting people in the UK.

The text message, which pretends to be from a delivery company, includes a link that claims to allow you to track a parcel.

However, this is an attempt to infect your phone with malware, which occurs if the link is clicked on. The scam text has been received by customers on all major UK networks. One example of this text, shown below, claims to be from DHL.

Screenshot of a text message which claims to be from DHL. In fact it is a scam text. The text reads: "DHL: Your parcel is arriving, track here:", followed by a link.A screenshot of the 'Flubot' scam text

The malware, called Flubot, can allow criminals to access personal information on your phone, including online banking details.

If you receive one of these text messages, take the following steps:

  1. DO NOT press the link.
  2. Report the text by forwarding it to 7726.
  3. Delete the text from your phone.

If you think you have fallen victim to this scam, contact your provider as soon as possible, as well as Action Fraud, the reporting centre for fraud and cybercrime in England, Wales and Northern Ireland. Reports of fraud and any other financial crime in Scotland should be reported to the police via 101.

The UK’s National Cyber Security Centre (NCSC) has also published advice for people who may have been affected by this scam.