The text at 14:07

You're in the queue at the checkout. Your phone buzzes.

"Royal Mail: your parcel couldn't be delivered. Please pay the £1.99 handling fee: bit.ly/rm-parcel-uk"

You really are waiting for a parcel. You don't know the number, but couriers sometimes text like this. £1.99 — barely worth noticing. You tap.

A page opens, looks like Royal Mail. Red branding, the crown, everything in place. You enter your card details. Done.

Two days later: £840 gone. Not £1.99. Eight hundred and forty. Your bank rings and asks whether you really just bought £840 of electronics in Warsaw.

The text was never from Royal Mail. The site was never Royal Mail. And the parcel you were waiting for? It arrived the next day, completely normally. No fee.

This scam is called smishing. It hits tens of thousands of people every day — in the UK, the US, everywhere. Not because they're foolish, but because they're in a hurry. That's exactly what the scam is designed for.