Suspicious Package Procedures for Commercial Security Teams

A suspicious delivery is not the moment for guesswork, curiosity or a quick inspection at the reception desk. The first objective is life safety and workplace safety: create distance, prevent further contact and bring in the right support.

Clear suspicious package procedures give security officers, facilities teams and front-of-house staff a shared response when pressure is high. The item may prove harmless, but moving it, opening it or trying to identify it can turn an ordinary concern into a more serious incident.

The right response is calm, controlled and based on the site’s emergency plan.

Suspicious package procedures: the first 60 seconds

A staff member who spots a suspect item should stop where they are, avoid touching anything further and alert security or the appointed incident lead. There is no benefit in confirming a suspicion by handling the parcel again.

Stop handling, then create distance

Do not touch, move, open, shake, smell or photograph the item. Do not take it outside, put it in a bin or carry it to a security office. A parcel is easier for police to assess if it remains in its original position.

If somebody is already holding an item, they should place it carefully on a clear, flat surface and step away. They should not pass it to another colleague or return it to a mail trolley.

Clear the immediate area, then consider adjacent rooms, including rooms above and below where the building layout requires it. Use calm, simple instructions. “Please leave this area by this route” is better than announcing an unconfirmed threat across a busy office.

Keep phones and radios away

ProtectUK and the NPSA state that mobile phones and two-way radios must not be used within 15 metres of a suspect package or in the cleared area. This is a precaution, not a test for staff to conduct. Move to a safe location before making calls.

Call 999 and ask for police. Tell the call handler that the item is suspicious, whether it has been opened and whether there are signs of a substance or anyone feeling unwell. Follow the ProtectUK mail-handling guidance and any instruction from police, bomb technicians or other emergency services.

At the same time, notify the internal chain of command: the control room, chief warden, facilities manager, property manager or security director, according to the site’s plan.

The first sixty seconds should reduce contact and confusion, not produce more information about the item.

Recognising suspicious mail without jumping to conclusions

Most suspicious mail does not look like a television prop. A missing return address alone does not make a package dangerous. The concern comes from a combination of visual indicators, sensory indicators, delivery context and what is normal for that recipient or site. Staff should record indicators already noticed, but must not handle or examine the item for more information.

Visual and packaging indicators

Treat the suspect item seriously when several features do not add up. These might include excessive tape or sealing, a bulky or oddly shaped envelope, a completely stuck-down flap, poor addressing, an unfamiliar postmark or unexplained postage.

Other warning signs include oily marks, stains, leakage, powder, residue or an unusual odour. An unexpected hand-delivered parcel should receive the same attention as postal mail, particularly if the courier cannot verify the sender, recipient or delivery route.

A receptionist should never feel obliged to accept an item simply because the person delivering it is impatient. Verification is part of proper access control.

Weight, shape and context matter

Unexpected weight, an uneven balance, a lopsided shape or small holes in wrapping can be relevant explosive or incendiary indicators. They are not confirmation of a device.

Contextual indicators can matter more than appearance. Is the recipient unknown to the organisation? Is the package unrelated to normal business activity? Has it arrived after a threat, dispute or concerning contact? Has a delivery been left in a public area with no attempt to obtain a signature?

Record the concern, but do not spend time compiling a theory at the scene. Police need facts: what was seen, who found it, where it is and whether anyone handled it.

Mailroom and reception desk controls that work

A strong procedure begins before an incident. Reception and mailroom teams need clear mail handling procedures, with screening mail assigned as a defined responsibility. They need authority to pause a delivery, refuse an unverified item and call security. Vague instructions such as “use your judgement” leave staff exposed when a visitor is demanding an answer.

Separate the item without moving it

When a suspect item is identified, isolate the surrounding area and establish an exclusion zone. Do not move it to an empty room, loading bay or car park. Close nearby doors if that can be done without approaching the item, direct people away and place staff at safe access points.

Keep emergency routes open. Officers should prevent re-entry, but they must not form a crowd around the location or obstruct responding police. Delivery drivers, contractors and visitors should be accounted for through normal sign-in records where possible.

Build the record from safe information

The mailroom lead or security control room should preserve available information without returning to the item. That may include the sender, return address, delivery manifests, courier booking data, visitor logs, access-control records and relevant CCTV footage.

Use a simple incident log:

The record should be factual. Avoid terms such as “bomb” unless police use them. A good log separates observation from assumption.

Explosive indicators and CBR indicators are not the same

Security teams should recognise the difference between a suspected explosive or incendiary item and possible chemical biological radiological (CBR) release. The first response still begins with distance, isolation and a police call. Containment priorities can differ.

Possible explosive or incendiary signs

Unusual weight, uneven distribution, an odd shape or small holes in packaging may raise concern about an explosive or incendiary threat. So can a parcel that is heavily sealed, unexpectedly rigid or plainly inconsistent with its stated contents.

Do not investigate these features. Do not use an X-ray machine, even if one is available. If the item is already in an X-ray facility, leave it there and clear the area as directed by the emergency plan.

Possible CBR signs

Suspicious substances, residue, leakage, odd odours or sudden irritation to the eyes, skin or nose may indicate hazardous material. Staff shouldn’t wipe down surfaces or begin informal cleaning.

Move affected people to a safe location near the incident, where they can remain separate from unaffected people. Clear adjacent rooms, restrict access and tell police exactly what was observed. If anyone becomes unwell, state that during the 999 call so emergency services can coordinate the appropriate response.

If there is an opened package, don’t close it, reseal it, clean it or try to collect spilled material. Preserve the scene and follow instructions from emergency responders.

Police response and internal coordination

Local police are the first emergency contact for a suspicious package. They will assess the report and coordinate other emergency services or specialist teams. Site staff shouldn’t decide evacuation is unnecessary because the parcel looks small or familiar.

Give the call handler usable facts

The person calling 999 should be ready to state:

• The full site address, floor, room and safest access point.
• Whether the item is unopened, partly opened or leaking.
• A clear description of the suspect item and its indicators, without speculation.
• Whether the area has been cleared and access controlled.
• Whether anyone has touched the item or reported symptoms.

The ProtectUK 4Cs approach is a useful operational structure: Confirm the concern, Clear people away, Communicate with police and relevant managers, then Control access, prevent re-entry and maintain an exclusion zone until responders arrive.

Keep witnesses available, not involved

Witnesses should remain available in a safe location. Ask each person to write down their own observations promptly: what they saw, heard, handled or were told, together with times where known.

They shouldn’t compare accounts or discuss theories. That can blur recollection and complicate a police response. A designated manager should give staff and tenants short updates that describe actions, not rumours.

After the immediate risk has passed

After the police response, the incident isn’t finished when responders leave. Commercial security teams need a proper handover, a record of decisions and welfare checks for people directly involved.

Secure evidence and records

Retain the incident log, communications record, CCTV, visitor data and delivery information in line with the organisation’s data-protection and retention arrangements. Record who authorised closures, evacuations, re-entry, the lifting of the exclusion zone and changes to normal operations, supporting business continuity controls.

Do not circulate photographs or CCTV clips internally as informal updates. Police may need the original material and a clear record of access.

Debrief the people and the procedure

Hold a structured debrief once the site is safe. Include reception, mailroom staff, security officers, facilities, tenant representatives and the duty manager. Discuss what staff noticed, whether escalation routes worked and where access control or communications caused delay.

Check on staff welfare as well. A receptionist who found the item may appear composed during the incident, then feel unsettled afterwards. A short, practical follow-up is better than treating the event as routine paperwork.

Local law, site risk assessments and emergency plans should shape every procedure. Review them after an incident, or after a drill, before the next delivery tests them for real.

Key takeaways

• Do not touch, move, open or examine a suspicious item.
• Clear the area and prevent people from returning.
• Do not use mobile phones or two-way radios within 15 metres of the item.
• Call 999 from a safe location and ask for police.
• Tell the internal incident lead what has happened, then follow police instructions.
• Preserve CCTV, delivery records and witness accounts without turning staff into investigators.
• Treat potential CBR contamination differently from an unopened parcel, but begin with the same priorities: distance, isolation and clear reporting.

Frequently asked questions

Why mustn’t staff move a suspicious package?

Moving a suspect item can increase risk, disturb evidence and make it harder for police to understand where it was found. It may also expose more people during the move. Leave it where it is and control the surrounding area.

Why are phones and two-way radios restricted nearby?

Mobile phones and radios are restricted within 15 metres as a safety precaution. Staff should not try to judge whether a particular item could be affected. Move away first, then use a phone or radio from a safe location.

What should a receptionist do with an unexpected delivery?

Ask for verifiable sender, recipient and courier details before accepting it. If the details remain unclear or the package appears suspicious, do not handle it further. Notify security, keep people away and follow the site’s suspicious package procedures.

A controlled response protects people first

The best suspicious package procedure is not dramatic. It is a clear sequence that staff can remember: stop handling, create distance, isolate access, call police and preserve the scene.

A calm response protects colleagues, visitors and responders alike. Distance and discipline matter more than a quick answer.