Key Takeaway:
In October 2026, Cisco Talos reported about 1,400 scam emails that were genuinely sent by Staples and Dell. Scammers placed fake orders and typed a “helpline” phone number into the name and address fields, and the retailers’ own systems emailed it to their targets as a normal order confirmation. Because the emails really came from those companies, they passed the authentication checks that email uses to catch forgeries. The lesson: a genuine sender doesn’t make the content genuine. Never call a number printed in an unexpected order email; check the order in your account, on a website you type in yourself.
Most advice about scam emails comes down to “check who really sent it”. That advice is right, and it still works for most fakes. But a new kind of scam gets around it completely, by getting a real company to send the message for them. In this article: what Talos found, why the security checks pass, how the same trick turned up in a booking breach in Australia the same week, and the simple habits that catch it anyway.
What Talos Found
On 21 October 2026, researchers at Cisco Talos, one of the largest security research teams, described campaigns that abused the order notification systems of two well-known retailers:
- Staples: an order confirmation from Staples’ real order system for an iPad. In the shipping and billing details, where your name and address would normally be, it said “Helpline” followed by a phone number.
- Dell: an order confirmation from Dell’s real order system for Microsoft Project Standard 2024, totalling $736.09. The “Ship To” and “Bill To” sections read “Confirmed Order”, “Helpline” with a number, and “Call Our Sales Team”.
Together the two campaigns sent roughly 1,400 messages. The trick is simple. When you place an order or create an account, the shop’s system takes whatever you type into the name, company and address fields and puts it into its confirmation email. The scammers typed their message into those fields, and the shop’s own system did the rest: the confirmation went out to the people they were targeting. Talos found the same approach across more than 25 legitimate services over the past year, from file-sharing and survey sites to payment and AI services.
🔍 Why the Security Checks Pass
Email has three checks designed to stop forgeries. SPF asks whether the server was allowed to send for that domain, DKIM asks whether the message was signed with the domain’s key, and DMARC asks whether the domain that passed those matches the one in the From line. Talos reported that the Staples messages passed DKIM and DMARC for Staples’ order domain, and the Dell ones for Dell’s.
That’s correct: they really were sent by Staples and Dell. The checks answer the question who sent this?, and they answered it truthfully. What they can’t answer is is what it says true? As Talos put it: “Sender authentication is necessary, but it is not sufficient.”
You can see this for yourself. Paste the headers of any genuine order email into our Email Header Analyzer, and it will show DMARC passing. An abused order email would show exactly the same. Our free lesson Who Really Sent That Email? covers how to read those results, and why a pass proves the sender, not the story.
The Phone Number Is the Trap
Notice what these emails don’t contain: a link to a fake website. Security filters are good at spotting dangerous links, so the scammers left them out. Instead, the email shows an expensive order you never placed and a number to call. The natural reaction is to ring and cancel it.
That call is the scam. Talos notes it could lead to payment fraud, stolen passwords or a fake “remote assistance” session. In callback scams like this, the person who answers usually offers to “cancel the order” or “process your refund”, and needs your card details, your login, or access to your computer to do it.
The Same Trick, With Your Real Details
A different version turned up in Australia the same week. On 27 October, ABC News reported that RMS Cloud, a company whose software many hotels and holiday parks use for bookings, had suffered a breach. Guests then received WhatsApp messages, texts and emails claiming their booking payment had failed, or asking them to “verify” their booking through a link. The messages used guests’ genuine names and real dates of stay. RMS said no payment card information had been exposed from its systems, which is exactly why the scammers were asking for card details.
It’s the same lesson from the other direction. In the Talos cases, the sender was real and the content was fake. Here, the details were real and the sender was fake. Either way, correct details or a genuine sender are not proof that a message is safe to act on.
How to Spot One
| What you see | What it usually means |
|---|---|
| An order or invoice you don’t recognise, often for something expensive | The goal is panic, so you call before you think |
| A phone number, “helpline” or “call us” inside the name, address or company fields | Text typed into a form by a stranger. Real support numbers never live in your shipping address |
| “Call to cancel” or “your payment failed, verify now” | Pressure to act through the channel the scammer controls |
| Your correct name, booking or order details | Nothing on its own: details leak in breaches and get reused |
| A request to install an app so they can “help” you | Remote-access fraud. Hang up |
And the habits that catch it every time:
- Check the order where it lives, not in the email. Open the shop’s website or app yourself, sign in, and look at your orders. If it isn’t there, it isn’t real. If you don’t even have an account there, that settles it.
- Never call a number from an unexpected message. If you want to speak to the company, find its support number on its own website, typed in by you.
- Look at your bank or card statement. A real $736 charge shows up there. No charge, no order.
- Don’t let anyone onto your computer because of an email or a call you didn’t start.
If You Already Called
- If you gave card details: call your bank or card company on the number on your card, report it as fraud and ask for the card to be blocked.
- If they connected to your computer: disconnect it from the internet, uninstall the remote-access app they had you install, and change your important passwords from a different device, starting with your email.
- If you gave a password: change it on the real site and turn on two-step sign-in.
- Report it: in the US at ReportFraud.ftc.gov; in the UK to Report Fraud (reportfraud.police.uk, 0300 123 2040), and forward the email to report@phishing.gov.uk.
Our free lesson If You’ve Been Scammed: The First Hour walks through each step in order.
If You Run a Website With a Sign-Up Form
This abuse works on any service that emails users back what they typed: order forms, account sign-ups, contact forms that send a copy, invitations. Talos recommends treating everything a visitor types as untrusted, and rejecting or flagging phone numbers, links and urgent language in fields where they don’t belong, like a name or a company. It’s a small check that stops your brand’s genuine emails being used against your own customers.
Frequently Asked Questions
If an email passes DMARC, is it safe?
It means the email really came from the domain it shows. That rules out most forgeries, which is why it’s still worth checking. But it says nothing about whether the content is honest, and the Staples and Dell cases show a real company’s system can be made to carry a scammer’s message.
Were Staples and Dell hacked?
Talos describes this as abuse of their normal order notification systems: the scammers’ text went in through the same order and account fields any customer fills in, and the companies’ systems emailed it out. The fix is on the companies’ side, by checking what customers type into those fields before it goes into an email.
I got an order email for something I didn’t buy. Should I reply?
No. Don’t reply and don’t call any number in it. Sign in to the shop’s website yourself and check your orders. If there’s nothing there and no charge on your statement, delete the email.
The message had my real booking details. Doesn’t that prove it’s real?
No. Booking and order details are exactly what leaks in a breach, as the RMS Cloud case shows. Contact the hotel or company through its own website or app, and never send card details in reply to a message.
Sources
- Cisco Talos — Parasitizing trust: how legitimate infrastructure becomes a delivery pipeline for attackers (21 October 2026)
- GBHackers — Cisco Talos uncovers 1,400 scam emails sent through Staples and Dell order notification systems
- ABC News — Holiday park operators warn guests about fraudulent messages after booking software breach (27 October 2026)