Fake Order Confirmation Emails: Real or Scam? How to Tell

An email lands in your inbox: "Your order has shipped!" — except you don't remember ordering anything. Or you did order something, and now a message asks you to "confirm payment details" before it can be delivered. Fake order confirmations are one of the most common phishing tricks because they hijack two strong reactions: the worry that someone charged your card, and the excitement of a package on the way.

The good news: these emails almost always give themselves away if you know where to look. Here's how to tell a real receipt from a scam — without clicking anything dangerous.

Why fake order confirmations work

Scammers send these emails for a few different reasons:

• Phishing: the "View order" or "Cancel order" button leads to a fake login page that steals your Amazon, PayPal, or bank credentials.
• Callback scams: the email lists a big charge and a phone number to "dispute" it. The person who answers talks you into remote access to your computer or a "refund" that drains your account.
• Malware: the "invoice" or "shipping label" attachment installs malicious software when opened.
• Fee scams: a fake courier message says your parcel is held until you pay a small "customs" or "redelivery" fee — the real goal is your card number.

In every case, the email itself is the trap. The order doesn't exist, or the message isn't from the store you actually bought from.

Six checks that expose a fake receipt

1. Inspect the sender's real address

Tap or click the sender's name to reveal the full email address. Real stores send from their own domain — amazon.com, apple.com, ups.com. Scammers use lookalikes (amazon-orders-support.net), free mailboxes (@gmail.com, @outlook.com), or random domains that have nothing to do with the brand. The display name means nothing; only the part after the @ counts.

2. Look for your name and real order details

A genuine confirmation greets you by name and lists exactly what you bought, the price, and the shipping address you entered. Fakes say "Dear Customer," show vague items ("Order #8837-XZ, 1 item"), or list a product you never touched. Missing or generic details are a strong red flag.

3. Hover over every link before clicking

On a computer, hover your mouse over the button or link and read the destination in the corner of your screen; on a phone, press and hold the link to preview it. If "Track your package" points to a shortened URL or an unfamiliar domain instead of the store's website, it's phishing. When in doubt, don't click at all — the next section shows a safer way.

4. Check the tracking number yourself

A real shipping email includes a tracking number you can verify. Type it manually into the carrier's own site — ups.com, fedex.com, usps.com, dhl.com — never via the email's link. If the number doesn't exist, isn't in the format that carrier uses, or the email names no carrier at all, treat it as fake.

5. Match it against your own records

Cross-check the charge with your card or bank statement and your account's order history on the store's site. A scary "you were charged $499" email with no matching transaction anywhere is a bluff designed to make you call their number or click their link.

6. Watch for pressure and payment weirdness

Real order emails don't demand urgent action. Be suspicious of countdown timers, threats to cancel your account, requests to "re-enter" card details, or fees payable only by gift card, wire transfer, or crypto. No legitimate courier collects fees in gift cards — ever.

The safest way to verify: go direct

Never verify an order through the email itself. Instead:

1. Open a new browser tab and type the store's address yourself, or use its official app.
2. Log in and open Your Orders (or the equivalent). If the order isn't there, the email is fake — delete it.
3. If you need to contact support, use the phone number or chat on the official website, never the one printed in the email.

If the email claims to be from a store you've never heard of, look the shop up on HasTrust before engaging — you'll see whether the site is established and how other shoppers rate it. Impersonation emails most often spoof big names like Amazon, PayPal, and major couriers, precisely because so many people are genuinely expecting a package from them. And if you're unsure about the message itself, paste it into the HasTrust scam checker for a quick read on whether it looks like a known scam pattern.

What to do if you already clicked or paid

Act quickly — speed limits the damage:

• Entered a password? Change it immediately on the real site, plus anywhere you reused it, and turn on two-factor authentication.
• Entered card details? Call your bank or card issuer, report the card as compromised, and ask them to block it and dispute any charges.
• Opened an attachment? Disconnect from the internet and run a full antivirus scan before logging into anything.
• Gave someone remote access? Shut the computer down, change your passwords from a different device, and contact your bank.

Then report the email: forward it to [email protected], use your mail app's "Report phishing" button, and — in the US — file a report at reportfraud.ftc.gov. Amazon impersonations can go to [email protected].

The bottom line

A real order confirmation matches a purchase you made, comes from the store's own domain, names you and your items, and never pressures you. When any of those pieces is missing, skip the links, check your account directly, and verify the sender before you do anything else. Thirty seconds of checking beats weeks of undoing fraud.