Cisco Talos found scam emails sent through real Dell and Staples systems, with fake cancellation phone numbers tucked into the order details.
Some fake order emails now come straight from Dell and Staples. Cisco Talos, a security research group, found scammers who did not forge the messages. They typed scam text into order detail fields, and the retailers' own systems delivered it. The goal is to make you call a fake support number to cancel a purchase you never made.
Talos found two campaigns involving roughly 1,400 messages, according to an October 21 report by Diana Brown. One Staples email showed an Apple iPad order with an order number, delivery details, pricing and the usual footer. A Dell email listed a Microsoft Project Standard 2024 order for $736.09.
In both, the scam text sat in fields normally used for shipping or billing. That made the phone number look like part of a normal sales process.
The emails came through the retailers' notification systems, so the sender and design can look genuine. The Staples message passed two standard sender checks, called DKIM and DMARC. Dell-related systems passed DKIM, and its order domain passed DMARC. These checks confirm an email came from expected systems.
They do not confirm the order is real, or that the phone number belongs to the retailer. Talos calls this platform-as-a-proxy abuse: the attacker writes the content and a trusted service delivers it.
Anyone who gets an unexpected order email from Dell, Staples or another big retailer could see this. That includes business owners and staff, who may be more likely to assume a pricey software order is a mistake worth fixing fast.
The same trick shows up elsewhere. Talos saw abuse of more than 25 legitimate platforms over the past year. It also described scammers entering text into name or company fields on sign-up forms, so automated welcome emails repeat their message. A WeTransfer-themed lure turned up inside a delivery failure notice.
The findings describe phishing and phone fraud, not a confirmed malware infection. Neither example relied on an obvious link. The next step was a phone call. Talos did not establish what happened on those calls in these two campaigns. Once a conversation leaves email, though, scammers can try payment fraud, password theft or remote access scams.
The alert box above lists the steps. The main point is simple: treat a surprise order email as a question, not a fact, and check it through your own account, not through the email.
Talos advises companies to check user-entered fields before storing them and again before sending emails. It also says security tools should inspect whole messages, not just the outer sender. Until that becomes common, a genuine-looking email is not proof of anything.
Never call a phone number inside a surprise order email, even a real-looking one. Check the order by logging in to your account directly.
Scammers are emailing Humboldt County well permit applicants and demanding $5,960 before a permit is issued. The county says the fee is fake.
Read more: Fake County Emails Demand $5,960 Fee for Well PermitsCallers posing as the Sheriff's Office told a Sarasota County woman she missed jury duty. She lost over $40,000, and the same scam is hitting others.
Read more: Fake jury duty calls cost one Florida woman over $40,000Europol warns that scam callers can fake the number on your screen, so the safest move is to hang up and call back using a number you found yourself.
Read more: Got a suspicious call? Hang up and look up the number yourself
