How to Spot a Fake Order Confirmation Email Fast

An email lands saying your order for a $749 laptop has been confirmed, and you never ordered a laptop. Your stomach drops, the "Cancel order" button is right there, and that button is exactly what the sender wants you to press. A fake order confirmation email works because it turns panic into a click, so the fix is a short routine that lets you check the message without touching anything inside it.

The brands and prices change, but the structure barely moves, so you can learn to sort a real receipt from a fake in under two minutes.

Why a fake order confirmation email is so convincing

Real confirmation emails all look alike: a logo, an order number, a product photo, a total and a button, and copying that template takes minutes. The bigger trick is the emotional setup. A real receipt for something you bought is boring. A receipt for something you did not buy is alarming, and alarmed people act before they read.

Most fake confirmations push you toward one of three actions:

Click a link to "cancel" or "review" the order, which leads to a login page that steals your password.
Call a phone number printed in the email, where a fake support agent asks for card details or remote access to your computer.
Open an attachment called something like Invoice_88213.pdf or Order_Details.html, which can carry malware or a hidden login form.

Notice that all three require you to act from inside the email. That is the single most useful fact in this article.

The two minute check that settles it

Do these steps in order. You do not need any special software.

Do not click, call or open anything in the message. Leave it sitting in your inbox for now.
Open the store yourself. Type the retailer's address into your browser or open its official app from your home screen. Log in and go to your order history.
Look for the order number. If the order is not in your account, the email is fake. Real orders always appear in the account that placed them, usually within seconds.
Check your bank or card app. A real purchase normally shows as a pending charge within an hour. No pending charge plus no order in your account means there is nothing to cancel.
Report and delete. Most mail apps have a "Report phishing" option. Use it, then delete the email.

This check works even against a perfect forgery, because a forger cannot put an order into your real account.

Red flags inside the message

You should not rely on these alone, since better scams fix them one by one. Still, most fakes trip at least two.

What to look at	Real receipt	Typical fake
Greeting	Your name as it appears on the account	"Dear Customer" or your email address
Sender address	The store's own domain	A free mail account or a lookalike domain with extra words
Phone number	Rarely included; support is through the site	Large and bold, often repeated three times
Deadline	None	"Cancel within 24 hours or you will be charged"
Shipping address	Your real address	Missing, or a vague city only
Attachment	Rare; receipts are in the body	PDF or HTML file you are told to open

On a phone, tap and hold the sender name to see the full address. On a computer, hover over any button without clicking and read the link preview in the corner of the window. If a "Manage order" button points to a domain you have never heard of, you have your answer.

The phone number version

This variant has grown fast because it skips links entirely, which helps it get past spam filters. The email contains only text and a number, with no clickable button at all. When you call, a friendly agent offers a refund, then asks you to install a "refund tool" or to read back a code sent to your phone. That code is usually a login or payment verification code. No real store will ever ask you to read one out.

Why "just ignore it" is not quite enough

The usual advice is to delete suspicious emails and move on. I disagree with stopping there, for one practical reason: some fake confirmations are a cover for real activity. If a criminal already has your card details, a flood of fake receipts can bury a genuine fraud alert from your bank in the same week.

So treat every fake order email as a nudge to do a five minute account check, not as noise:

Review the last 30 days of transactions on every card you use online.
Look at the "recent logins" or "devices" page on your main shopping account.
If you reuse that account's password anywhere, change it now.

Most of the time you will find nothing, and that is fine. The one time you do find a charge you did not make, you will have caught it weeks earlier than you would have otherwise.

If you already clicked or called

People do click. A rushed morning, a believable price and a familiar logo are enough. What matters is how fast you respond.

If you entered a password, change it on the real site straight away, then change it anywhere else you used it. Turn on two step verification.
If you entered card details, call the number on the back of your card and ask for the card to be blocked and reissued. Do this even if no charge has appeared yet.
If you installed remote access software, disconnect from the internet, uninstall it, and run a full security scan. If you logged into your bank during the session, call your bank.
If you paid by gift card or bank transfer, contact the gift card issuer or your bank within hours. Recovery chances fall sharply after the first day.

Payment method makes a real difference to how much you get back. Our guide to the safest payment methods for online shopping explains why credit cards give you the strongest dispute rights, and what buyer protection actually covers when a seller vanishes.

Habits that make fake receipts easy to spot

A few small changes make the fakes stand out on sight:

Use one email address for shopping. If a "store" writes to an address you never gave it, the message is fake by definition.
Turn on purchase notifications in your card app. You then know about every real charge before any email arrives.
Never act on order emails from your lock screen. Wait until you can open the real app.

The same playbook shows up in text messages. If you also get parcel alerts you did not expect, read our breakdown of fake delivery text scams, which follow nearly identical tricks.

Frequently asked questions

Can I get hacked just by opening a fake order confirmation email?

For almost everyone, simply opening the email in a modern mail app is not enough to cause harm. The danger starts when you click a link, open an attachment or call the number in it. Keeping your phone and mail app updated closes the rare exceptions.

Should I reply to tell the sender it is a scam?

No. Replying confirms that your address is active and read by a real person, which usually brings more scam emails. Report it with your mail app's phishing button and delete it instead.

Why did I get an order email from a store I really use?

Scammers pick the biggest brands because many recipients will have accounts there, so the odds of a believable match are high. It does not mean your account was breached. Check your real order history through the official app to be sure, and change your password only if you see something you do not recognise.