Going back to DPD, I had a delivery for Monday just gone. I was in all day and my front door was open, then I had a text message to say that "I" have deferred the delivery to Tuesday. I rang DPD and told them that I didn't change the delivery day, and the lady I spoke to said that someone did change it to Tuesday. I said once again it wasn't me that changed it but there was nothing DPD could do now.
I then realised that the tracking info is a simple
www.dpd.co.uk URL with the tracking number at the end, and anyone with the URL can freely change the day without any kind of security input. Later, I gave the URL to a trustworthy friend and he confirmed that he can also see the option to defer the delivery (to Wednesday and onwards). He didn't defer the day though and thankfully, my Samsung S20 Ultra did arrive on Tuesday in the end. He was able to track it in his DPD app and when it arrived, the driver took a photo of the parcel (and my trainers / tracksuit bottoms) and that photo showed up on his app too.
I can't believe how insecure DPD is!