What Should I Do About Being Targeted for What Seems Like Bad Fraud?
April 8, 2024 3:17 AM Subscribe
In the past week, I have received email notifications for orders I didn't make at Dick's, Cabela's and Academy Sports. The billing address is my previous address, the shipping addresses are local to my previous address but unknown to me, and the card numbers used are not cards I own. What's going on here, am I at risk, and can I make it stop?
It seems like this is a terrible attempt at fraud, using cards I don't own with an out of date billing address, and then the email notifications for the submitted orders coming direct to me, so that I know the fraudulent orders have been made. Both Dick's and Cabela's automatically cancelled the orders (I don't know about Academy Sports - that one I just received and their customer service is not available yet), but it's unsettling receiving a notification for an order I didn't make for nearly $1000, so I'd prefer for this to stop - but I don't think there's anything I can do to protect myself, in that I don't own the cards so I don't know to which banks I should flag that my name and old address are being used for fraudulent purchases, and it doesn't feel good just doing nothing and hoping it goes away.
It seems like this is a terrible attempt at fraud, using cards I don't own with an out of date billing address, and then the email notifications for the submitted orders coming direct to me, so that I know the fraudulent orders have been made. Both Dick's and Cabela's automatically cancelled the orders (I don't know about Academy Sports - that one I just received and their customer service is not available yet), but it's unsettling receiving a notification for an order I didn't make for nearly $1000, so I'd prefer for this to stop - but I don't think there's anything I can do to protect myself, in that I don't own the cards so I don't know to which banks I should flag that my name and old address are being used for fraudulent purchases, and it doesn't feel good just doing nothing and hoping it goes away.
It sounds like you’ve communicated with Dick’s and Cabela’s—did you look them up to contact them directly rather than use any number/email address/link that might have been provided in those notification emails? I suspect Mid is right that this is an indirect scam intended to try to get you to follow up.
posted by staggernation at 4:15 AM on April 8 [1 favorite]
posted by staggernation at 4:15 AM on April 8 [1 favorite]
Response by poster: I didn't contact Dick's because the notification I received was for the cancellation of the order, but the notification from Cabela's was for an active order and I called their customer support and then made a second call to their fraud prevention dept (who were very helpful, didn't ask for any details, gave me the last 4 digits of the card used), both times using numbers from their official site (the email notifications also came from seemingly legit addresses - e.g. Cabelas@order.cabelas.com). I'm not familiar with Academy Sports, but the link in the email directs to a seemingly legit site (www.academy.com). Cabela's also suggested I change my email password, which I did last week, i.e. before this latest order from Academy.
posted by my log does not judge at 4:39 AM on April 8 [2 favorites]
posted by my log does not judge at 4:39 AM on April 8 [2 favorites]
This is almost certainly a phishing attempt, using bad links within the emails themselves or fake phone numbers to try and get you to either click a malware link/pdf/other exploit, or alternatively to contact them using their number and then get sucked into the scam.
Never believe email addresses! They are easily spoofed and are not signifiers of authenticity.
You did the right thing by contacting the companies using their direct numbers, but these are the sorts of emails you can just delete and ignore. Honestly, that's probably the better course, as it's possible the scammers can see when you open them via a tracking pixel or the like, and know you "interact" with them (thus making you more likely to get more of them).
posted by griffey at 5:46 AM on April 8 [12 favorites]
Never believe email addresses! They are easily spoofed and are not signifiers of authenticity.
You did the right thing by contacting the companies using their direct numbers, but these are the sorts of emails you can just delete and ignore. Honestly, that's probably the better course, as it's possible the scammers can see when you open them via a tracking pixel or the like, and know you "interact" with them (thus making you more likely to get more of them).
posted by griffey at 5:46 AM on April 8 [12 favorites]
Best answer: I'm going to go the other direction here. Sure, this could be phishing (I personally get "fake order" phishing attempts all the time that I ignore) but let's assume these are real orders for a second. If you called Cabela's via the number on their web site (not from a number or link in the email, which could have been fake!) and they confirmed there was a real order in your name, that sounds serious.
If so, someone could have stolen your identity to open up a credit card in your name at your old address, then nabbed the card from the mailbox when it was sent there. The fraud here would be that they would open and use the card (in your name and with your former billing address), then not pay the bill, pulling the same scam with a different identity or bank ad nauseum after the card gets cancelled.
Even more important than freezing your credit reports (as previously suggested) would be to request and review your yearly free credit report from all three vendors and look carefully to see if there are any accounts that you don't recognize. That would give you the information you would need as to what bank any fraudulent card had been opened with.
While it's curious that they would use your valid email address in addition to your name and former billing address in that type of identity theft, it may simply be that they would want to obfuscate their own actions by providing your valid email rather than setting up a fake email account somewhere.
If you can send me the full header information from the order emails in MeMail, I can review the path the mail took and let you know the likelihood of whether these were phishing attempts or evidence of other fraud. In Gmail, for example, you can see the full headers using Show Original from the options menu.
posted by eschatfische at 7:32 AM on April 8 [11 favorites]
If so, someone could have stolen your identity to open up a credit card in your name at your old address, then nabbed the card from the mailbox when it was sent there. The fraud here would be that they would open and use the card (in your name and with your former billing address), then not pay the bill, pulling the same scam with a different identity or bank ad nauseum after the card gets cancelled.
Even more important than freezing your credit reports (as previously suggested) would be to request and review your yearly free credit report from all three vendors and look carefully to see if there are any accounts that you don't recognize. That would give you the information you would need as to what bank any fraudulent card had been opened with.
While it's curious that they would use your valid email address in addition to your name and former billing address in that type of identity theft, it may simply be that they would want to obfuscate their own actions by providing your valid email rather than setting up a fake email account somewhere.
If you can send me the full header information from the order emails in MeMail, I can review the path the mail took and let you know the likelihood of whether these were phishing attempts or evidence of other fraud. In Gmail, for example, you can see the full headers using Show Original from the options menu.
posted by eschatfische at 7:32 AM on April 8 [11 favorites]
My personal opinion on this is someone fat-fingered or some corporate "auto-corrected" someone else's email to your email address. The fact that at least one order was cancelled may or may not confirm that hypothesis.
posted by kschang at 2:06 PM on April 8 [1 favorite]
posted by kschang at 2:06 PM on April 8 [1 favorite]
I'd second getting your credit report from all three agencies, and then after reviewing them, freeze your credit. You can get the reports with frozen credit still but it can be more of a hassle.
posted by Aleyn at 2:19 PM on April 8
posted by Aleyn at 2:19 PM on April 8
« Older 1st court appearance for 2 DUIs in one week. Go... | Suggestions to build muscle after 50 Newer »
You are not logged in, either login or create an account to post comments
The fact that you are getting email notifications is strange. Why would a scammer use your email address? This suggests that the scam may be that the orders are not real, but fake emails designed to trick you in some other way (like providing personal info to the scammer). Or, it could suggest that your email is hacked - change your passwords and turn on 2 factor authentication.
posted by Mid at 4:07 AM on April 8 [7 favorites]