Christmas scams 2026: fake parcel texts, fake shops and gift cards, and how to check

The five scams, and the one check for each

1. The ‘missed delivery’ text or email. It says a parcel could not be delivered and asks you to pay a small fee or ‘reschedule’ through a link. The check: don’t use the link. Go to the carrier’s own website or app and enter your tracking number there.

2. The fake shop or social media advert. A sought-after toy or console at a price well below everywhere else. The check: before you pay, find out who runs the site: a company name, a full postal address, terms and conditions, and a card payment option.

3. Tickets and marketplace bargains. Sold-out tickets, or a second-hand console on a marketplace, from someone you don’t know. The check: buy tickets from the venue, the official promoter or a well-known ticket site, and never pay a stranger by bank transfer.

4. A request to pay in gift cards. A caller, a ‘company’ or a ‘friend’ asks you to buy gift cards and read out the numbers on the back. The check: stop there. No genuine bill, tax or fee is paid in gift cards, and Citizens Advice lists being asked to pay in vouchers as a sign of a scam.

5. The fake charity collection or appeal. A collector at the door, a bucket in the street, or an online appeal. The check: look the charity up by name and registered number on the official charity register before you give.

Whatever the scam, the next step is the same if you clicked or paid. Call your bank on the number on the back of your card, or dial 159, which reaches most major UK banks. Then report it, as set out at the end of this guide.

Fake ‘missed delivery’ and ‘redelivery fee’ texts

What it looks like. Royal Mail lists the common lines: “We couldn’t deliver your package — please pay a fee”, or “Your parcel is waiting for collection — click this link”, often with a shortened link or an unfamiliar web address. Emails may claim Royal Mail could not deliver, pretend to be HMRC or customs, ask you to ‘reschedule’ through a link, or ask for logins or payment details. Which? says to treat all texts about deliveries with caution, even if you’re expecting a package.

What the real ones do. Royal Mail only texts or emails you if the sender asked for tracking updates when posting the item. It says it will never ask for your bank details, passwords or personal data, or ask you to enter information on a website that is not part of Royal Mail. It does not ask for payment for an underpaid item by text or email: it leaves a grey ‘Fee to Pay’ card. The one exception is customs charges, where it may send a text or email as well as the grey card, if the sender gave your contact details.

Evri says it will never ask you to reschedule a delivery or ask for payment to do so, and will never prompt you to install an app. Its genuine texts come from the sender name ‘Evri’ and any link in them is only a tracking link to Evri’s tracking page. DPD says it will never ask you to pay a ‘redelivery fee’ through a link in an email, text or iMessage, and that its links only use www.dpd.co.uk, www.dpdlocal.co.uk or www.dpdgroup.co.uk.

How to check. Ask yourself Royal Mail’s questions: did you or the sender ask for tracking updates? Does the message ask for money or personal information? Is the link shortened or unusual? Are you being rushed? Then check the parcel by typing the carrier’s address into your browser yourself, or in its app, never through the message.

How to report it. Forward the text free to 7726. Forward scam emails to report@phishing.gov.uk. Royal Mail also takes forwarded messages and screenshots at reportascam@royalmail.com, and Evri at phishing@hermes-europe.co.uk. If you entered card details or paid, call your bank straight away.

Fake shops and too-cheap adverts on social media

What it looks like. An advert in your feed for this year’s most-wanted toy or a console at a price well below the big retailers, or a website that copies a well-known shop’s look and name. Which? reported on 12 November 2026 that one fake site copying Marks & Spencer used a business name and address that also appeared on 22 other sites. Its May 2026 investigation into ‘bogus boutiques’ found one shop that had posted more than 2,500 sponsored ads on Facebook and Instagram since July 2025. Action Fraud figures (the service Report Fraud has since replaced), published by the NCSC on 18 November 2024, show that 43% of online shopping fraud reports between November 2023 and January 2024 mentioned a social media platform.

How to check who runs a site. Citizens Advice suggests looking the company up on GOV.UK to see if it is registered, finding the terms and conditions, and reading reviews on several independent sites. Look for a company name and a full postal address with a street name, not just a PO box, and terms that say who you are buying from and how returns work. A padlock in the address bar shows the connection is secure; Citizens Advice says it doesn’t guarantee you’re buying from a real company. The NCSC’s advice for Christmas shopping: check reviews on trusted websites before you buy, check out as a guest if you can, and don’t let the site store your card details.

How you pay matters most. If the only options are bank transfer or an unusual payment method, don’t buy. The NCSC says never pay by direct bank transfer and use a credit card if you have one.

If you have paid. Call your bank or card provider at once and ask about a chargeback or a Section 75 claim (see paying safely). If the site sent you a ‘partial refund’ offer or asked you to pay to post an item back abroad, Which? says to ignore it. Report the site to the NCSC through GOV.UK’s suspicious website form, and report the crime to Report Fraud or Police Scotland.

Tickets and marketplace purchases

What it looks like. Report Fraud describes the ticket version: websites, advertised by email or on social media, offering tickets to popular events that have sold out or are not on sale yet, sometimes for events that don’t exist. The tickets never arrive, turn out to be fake, or a ‘representative’ who was going to meet you at the venue never comes. On marketplaces, it is a console, phone or gift for sale from a seller who asks you to pay before you have seen it, often outside the platform.

Purchase scams are the most common kind of bank-transfer scam. UK Finance’s Annual Fraud Report 2026, published in June, found purchase scams were 71% of all authorised push payment scam cases in 2025, with losses of £118.1 million, up 20%. It said purchase fraud often starts on marketplace sites.

How to check. Report Fraud says to buy tickets only from the venue’s box office, the official promoter or agent, or a well-known ticketing website, and to ask whether the seller is a member of the Society of Ticket Agents and Retailers (STAR), which offers an approved dispute service. It says to avoid paying by bank transfer, especially to someone you don’t know, because a credit card or a payment service such as PayPal gives you a better chance of getting your money back. For marketplaces, Police Scotland says to avoid paying for anything you haven’t seen, check the seller’s profile, and screenshot the listing before you buy. Which? lists a seller asking you to pay outside the platform as a red flag.

If you have paid. Tell your bank as soon as possible, then report it. If you paid by bank transfer, the reimbursement rules below may apply.

Gift card payment requests

What it looks like. A call, text, email or message, often urgent, saying you owe tax, a bill or a fee, or a ‘friend’ or ‘relative’ who needs help, asking you to buy gift cards and send or read out the codes on the back. Apple describes the pattern: contact by call, text, email or social media, a sense of panic and urgency, a request for payment in gift cards, precise instructions on buying them, then a demand for the redemption codes.

How to check. You don’t need to. A request to be paid in gift cards is the sign. Citizens Advice lists being asked to pay in an unusual way, such as by vouchers, as a sign of a scam. Apple, for example, says its gift cards can only be used to buy from Apple, and can’t be used for bills or government fees such as taxes. If the message claims to be from someone you know, ring them on a number you already have. A family safe word settles it in seconds.

If you have already sent the codes. Contact the company that issued the card straight away (for Apple gift cards, Apple Support), using the contact details on its own website, because the money can be spent quickly. Report it to Report Fraud or Police Scotland. Be ready for a hard answer: Citizens Advice says it is unlikely you will get your money back if you paid a scammer with vouchers or gift cards. Its advice for the future is never to give the numbers on the back of a gift card or voucher to anyone you don’t know.

Fake charity collections and appeals

What it looks like. A collector at the door or in the street, or an appeal online or by text, using a charity’s name, or a name that sounds like one. City of London Police received 561 reports of charity fraud, with £2,160,169 lost, between November 2024 and October 2025, the Charity Commission said on 2 December 2025.

How to check. The Charity Commission’s advice: check the charity’s name and registration number on the charity register (most charities in England and Wales with an income of £5,000 or more must register), look out for the Fundraising Badge, and never feel under pressure to give immediately. In Scotland, check the Scottish Charity Register run by OSCR; in Northern Ireland, the Charity Commission for Northern Ireland register. In England and Wales, a street collector should have a licence from the local authority, or from the Metropolitan Police in Greater London.

The safest way to give. If you aren’t sure about a collector or an appeal, give through the charity’s own website, which you type in yourself.

If you have paid. Tell your bank, and report it to Report Fraud or Police Scotland. You can also tell the charity whose name was used.

Messages and sites claiming to be from Santa

Around Christmas, families may see adverts or messages offering a personalised letter or call ‘from Santa’. Some come from real businesses. Before you type in a child’s name, age, address or photo, or pay, check who runs the site in the same way as any shop: a company name you can look up on GOV.UK, a full postal address, terms and conditions and a privacy notice that say who holds your child’s details, and a card payment option. If you can’t find out who is behind it, don’t give the details.

Royal Mail runs its own letters to Santa. You write the letter, put a stamp on it and post it to Santa’s address on Royal Mail’s page, with your full name and address on the back of the envelope for the reply. Royal Mail’s 2026 page says to post letters by Wednesday 9 December 2026 (Royal Mail, Letters to Santa, read 12 November 2026).

Paying safely: cards and bank transfers

Credit cards: Section 75. If you pay by credit card (or buy now, pay later) for an item costing more than £100 and no more than £30,000, Section 75 of the Consumer Credit Act lets you claim from the card provider if things go wrong. Citizens Advice says the limits are for a single item, not the whole order, and that you can’t usually use Section 75 if you bought through a third party rather than directly from the trader, such as through a marketplace like Amazon or eBay, or a wallet like PayPal.

Debit cards and smaller amounts: chargeback. For debit cards, items under £100, or where Section 75 doesn’t apply, ask your card provider for a chargeback. Citizens Advice says your card provider might call it a ‘disputed transaction’, and that it’s best to ask in writing. PayPal disputes have their own window: 180 days from when you paid, says Citizens Advice.

Bank transfers: the reimbursement rules. If you were tricked into making a bank transfer from one UK account to another, by Faster Payments or CHAPS, on or after 7 October 2024, the Payment Systems Regulator’s rules say your bank must normally refund you. The maximum you can claim is £85,000. Report it to your bank as soon as possible, and within 13 months of the payment. The refund should come within 5 business days of your claim; if the bank needs more information it can pause the clock, but it must decide within 35 business days. Banks can apply an optional excess of up to £100, but not to vulnerable customers. A bank can refuse if you were complicit or grossly negligent; gross negligence does not apply to vulnerable customers. A bill now going through Parliament would abolish the Payment Systems Regulator and move its work to the Financial Conduct Authority. Until then, the rules above, from the regulator’s consumer page, still apply.

The rules don’t cover card, cash or cheque payments (cards have their own protections, above), money sent abroad or by other methods such as Bacs or SWIFT, or gift cards, which are not a bank transfer. Nor do they cover a dispute with a genuine seller who sends faulty goods. For a stranger online, the advice is a card, not a transfer.

More on refunds, complaints and the Financial Ombudsman is in what to do if you’ve been scammed.

If you clicked or paid: what to do now

1. Your bank first. If you paid or shared card or bank details, call your bank on the number on the back of your card, or dial 159, which connects you to most major UK banks. Tell it exactly what you sent and where.

2. Report it. In England, Wales and Northern Ireland, report fraud to Report Fraud at reportfraud.police.uk or on 0300 123 2040 (Report Fraud says its phone line is staffed 24 hours a day, 7 days a week), or online at any time. Report Fraud replaced Action Fraud in December 2025; the phone number is the same. In Scotland, report it to Police Scotland on 101. If you are in danger, call 999.

3. Report the message. Forward scam texts free to 7726. Forward scam emails to report@phishing.gov.uk. Fake shop websites can be reported through GOV.UK’s suspicious website form.

4. Change passwords if you typed one into a fake page, and turn on 2-step verification, as the NCSC advises.

5. Expect a second approach. Report Fraud warns that fraudsters sometimes contact victims again, claiming they can help recover the money. Hang up on them.

Seen a scam headline being shared and want to know if it’s real? Our headline checker has the ones we’ve looked at. For scams using cloned voices, see voice cloning scams, and for the wider picture, our AI scams guide.

The honest scale

The festive figures are rising slowly rather than soaring: £10.6 million, then over £11.5 million, then about £11.8 million over the last three seasons. The NCSC said on 17 November 2025 that some £11.8 million was lost to online shopping fraud over the 2024–25 festive shopping season, from City of London Police data. Its release a year earlier gave over £11.5 million for 2023–24, from more than 16,000 Action Fraud reports, an average of £695 per victim, up from £10.6 million the year before. Report Fraud has not published a figure for the 2025–26 season that we could find (checked 12 November 2026).

Behind each figure are people who were caught by something built to look real. A few habits cover almost all of it: use the carrier’s own app, not the link; know who you are buying from; pay by card; never pay in gift cards; and check a charity before you give.