UK Phishing Scams Surge 140%: Royal Mail and PayPal Top List of Most Impersonated Brands

Phishing attempts in the United Kingdom have surged by 140% in 2025, creating a high-stakes environment for financial institutions and payment providers. With nearly one in three British adults unable to confidently identify genuine bank communications, the rising sophistication of brand impersonation poses a direct threat to consumer trust and digital payment security.

What was announced

New data from BrokerChooser has identified the most frequently spoofed brands in the UK by analysing search volume for phishing-related queries. The findings highlight a significant vulnerability in the logistics and financial sectors, where scammers leverage the routine nature of parcel deliveries and account alerts to bypass consumer vigilance.

Royal Mail emerged as the most targeted brand, linked to approximately 6,650 monthly UK searches regarding scams. This equates to nearly 79,800 annual searches, a figure that is almost double that of PayPal, which sits in second place. The primary tactic used against Royal Mail customers involves fraudulent messages requesting small fees, typically between £1 and £3, for customs clearance or redelivery.

PayPal follows with 3,960 average monthly searches related to phishing. Scammers targeting the payment giant often deploy "account restriction" notices or fake security alerts, using high-pressure language such as "this link will expire in 24 hours" to force immediate action. The top five most spoofed brands are rounded out by delivery firm Evri (3,000 monthly searches), HMRC (1,890 monthly searches), and DPD (1,850 monthly searches).

The scale of the problem is underscored by the frequency of contact; the average UK adult now receives two scam calls every week. This persistent barrage of fraudulent activity is increasingly difficult for the public to navigate, as 28% of Brits admit they lack confidence in distinguishing a legitimate call from their bank from a criminal impersonation.

"Phishing works by impersonating organisations you regularly exchange money with - a courier, your bank, or the tax authority - so your guard drops before you have even read the message properly. That is what makes it convincing: the organisation is real, but the message is not."

Adam Nasli, Head Broker Analyst at BrokerChooser.

The companies involved

BrokerChooser is an online broker comparison platform and expert service that provides data-driven insights into trading platforms and financial services. The firm operates the website brokerchooser.com, focusing on helping users navigate the complexities of the brokerage market through analytical research.

PayPal is a global leader in digital payments, providing a platform for online money transfers and merchant services. In the UK, it has significantly expanded its footprint in the Buy Now, Pay Later (BNPL) sector and remains a primary target for fraudsters due to its massive user base and role as a central hub for consumer spending.

Royal Mail is the UK’s designated universal postal service provider, while Evri and DPD represent major players in the private courier and logistics market. These companies have become central to the phishing landscape due to the explosion of e-commerce. HMRC (His Majesty's Revenue and Customs) is the UK’s tax, payments, and customs authority, frequently impersonated during tax return seasons or when government rebates are announced.

What FF News has reported before

FF News has tracked the evolution of the UK’s major payment players and the shifting leadership within the sector. We previously reported on significant personnel moves in Jiko Appoints Goldman Sachs and PayPal Veterans to Lead Next Phase of T-Bill Banking Growth, highlighting the movement of expertise from established giants like PayPal into emerging fintech sectors. Additionally, we covered the expansion of credit products in PayPal Expands UK BNPL Portfolio with Launch of Interest-Free Pay in 30 Days, a move that increased the brand's touchpoints with UK consumers and, subsequently, its profile as a target for impersonation.

What this means

The 140% surge in phishing attempts suggests that current automated fraud detection is failing to keep pace with social engineering tactics. For fintechs and banks, the "confidence gap"—where 28% of users cannot verify their own bank—is a liability that could lead to increased churn if customers begin to view official communications with the same suspicion as scams. The heavy targeting of logistics brands like Royal Mail and Evri indicates that the "delivery fee" scam is now the primary gateway for harvesting financial credentials. Financial institutions should expect a continued rise in Authorised Push Payment (APP) fraud as these low-friction logistics scams successfully bait victims into larger financial compromises.