What Are Order Confirmation Phishing Scams?
Order confirmation phishing scams typically involve fake emails, text messages, or phone calls claiming to be from well-known retailers or delivery services. These messages inform recipients of a purchase they did not make or of a problem with their order, prompting them to click a link, download an attachment, or provide personal information.
Common Examples of Order Confirmation Scams
Where these scams really catch victims is when they attempt to cancel the fake order. To cancel, you may be instructed to click a link or call a number. Either method ultimately leads to scammers trying to extract personal information under the guise of "confirming your identity."
They'll ask for your name, address, phone number, and, often, your credit card or banking details. If you hesitate or protest, they’ll insist that providing this information is essential to complete the cancellation. However, their real aim is to use your information to charge your credit card, drain your bank account, or steal your identity to open other accounts.
Don't be fooled. They want that information so they can actually charge your credit card, steal money from your bank account, or use your identity to open other accounts.
Many scams include an additional layer of deception. The scammers might ask you to download a file, often a Microsoft Word or Excel document, claiming you need to fill it out and send it back to cancel the order. These files almost always include malware.
When you open the file, you’ll likely see a notification at the top of the screen asking you to Enable Content.
If you're on the phone with the scammer, they’ll assure you this step is safe and necessary. It’s neither. Enabling the embedded content activates a malicious macro designed to steal your personal data, install ransomware, or grant the attacker access to your device.
Important: Never enable content on an Office file unless you are certain of its source and purpose. If you've downloaded one of these files, close it immediately and delete it. If you’ve already enabled active content, run a full antimalware scan on your computer to remove any malicious programs.
How to Recognize an Order Confirmation Scam
How to Avoid Falling Victim
Report Suspicious Activity
If you suspect a scam, report it to the retailer and relevant authorities. Forward phishing emails to reportphishing@apwg.org (an address used by the Anti-Phishing Working Group, which includes Internet Service Providers (ISPs), security vendors, financial institutions, and law enforcement agencies), or use similar services in your region. You can also report phishing to the Federal Trade Commission (FTC) at FTC.gov/complaint.
For more information, you can check out the FTC’s tips for online security at ftc.gov/onlinesecurity.