The order confirmation really is from Staples. The helpline number is not.

An email arrives from orders.staples.com. Order number 9939818875, an Apple iPad, and a line reading "Helpline 806 283 7712". You did not buy an iPad. The sender is real, the domain is real, the message passes DKIM and DMARC because Staples genuinely sent it. The only false thing in it is the phone number, and that is the only thing the scammer needed to supply.

Cisco Talos published the research on 21 October. The trick is to start a real transaction and type the lure into a field the retailer prints straight back at the customer, usually something in the shipping or billing details. The Dell version cites purchase ID 2009829958247 for Microsoft Project Standard 2024 at 736.09 dollars and gives "Helpline 808 232 6397". Talos counted around 1,400 messages across the two campaigns, and the same idea in two other shapes: submitting your address to sign-up forms so the welcome mail carries a message typed into the name or company field, and abusing delivery-failure bounces so the lure rides in on a mail error. More than 25 legitimate platforms have been used this way in the past year. As Talos puts it, trusted infrastructure is being treated as a shortcut for trusted content.

So the old advice about checking the sender address has quietly stopped being enough, and the replacement is narrower: never ring a number that arrived attached to a problem. If an order confirmation worries you, go to the retailer's site yourself, or to the card statement, and find the charge or fail to find it. A call that starts with a planted number tends to end with a request to install remote-access software so the nice person can help, and that is where the real damage begins.

If one of these ever gets that far, Tendvane's Safety check lists the remote-access tools and unwanted programs that have appeared on your PC, which is usually the first visible trace.