Fake Order Alerts Sent Through Staples and Dell Systems Push Victims to Call Scammers

Cisco Talos analysed two campaigns that abused the legitimate order notification systems of Staples and Dell, covering roughly 1,400 messages. The sender was not forged and no lookalike domain was used. Instead, the attacker placed suspicious content inside fields in the genuine notification that would normally hold shipping information, aiming to create urgency around an expensive purchase and push the recipient to call a phone number.

In the Staples example, the email appeared to come from [email protected] and described an Apple iPad order, with order number, delivery timing, pricing, billing details and the usual footer. Within the order details sat a "Helpline" phone number and an "Order Confirmed" line. The message did not rely on a crude link. It implied a costly order had already been placed and that calling was the fastest way to sort it out. Once a victim is on the phone, Talos notes the attacker can continue through social engineering, payment manipulation, credential theft or remote assistance fraud.

The email also passed standard checks. It showed DKIM alignment for orders.staples.com and passed DMARC for the visible Staples domain, even after travelling through forwarding paths including Proton Mail and Microsoft 365. Talos stresses that authentication helped show the outer message was credible, but gave no assurance that the phone number or transaction details were legitimate.