Weekly Scam Alert: Scammers Are Using Fake Order Receipts to Get You on the Phone
Shop app users in multiple states are reporting mysterious orders for more than $300 for computer services they never purchased in the latest version of a common fake receipt scam.
These fake orders look especially convincing because they appear inside the Shop app, a Shopify service that lets you discover products, make purchases and track packages, rather than arriving through a suspicious email or text. The receipt makes it appear that the user bought a "Premium PC Protection Plan," but no such purchase has been made.
The fake receipt is actually bait: It includes a customer-service phone number — sometimes inserted directly into the shipping address — telling users to call if they didn't make the purchase. That's when the real scam begins, as fraudsters try to trick you to give up your personal information.
Must Read
The Better Business Bureau received several reports of this scam last week from users in California, Virginia, Illinois, Pennsylvania and Florida, following other reports earlier this month. And in the past year, similar scams spread through PayPal, where users reported Geek Squad charges for tech services they never bought, and showed up on Google Calendar as invites with fake payment notifications from Malwarebytes.
If an unfamiliar order appears in any of these platforms, don't call the phone number in it. Instead, contact the platform or retailer through contact information you independently verify.
Other current scams to watch out for
Mystery package scam
The Federal Trade Commission (FTC) issued a new warning about so-called brushing scams after receiving recent reports from people who got packages they never ordered. The deliveries typically contain cheap, random items such as baby wipes, toothpaste or seeds.
The scammer isn't necessarily after payment for the package. Instead, sending an item to a real name and address gives them proof of delivery, which they can use to post fake positive reviews and boost a seller's ratings. What's more concerning is that some packages include a QR code that supposedly reveals who sent the item or helps process a return. Scanning it can lead to a phishing site designed to steal credit card information, usernames or passwords.
The FTC says recipients should avoid scanning QR codes, change passwords on shopping accounts that may have been compromised and check their credit reports for signs of identity theft. And remember: You don't have to pay for or return merchandise you never ordered.
Must Read
Fake unemployment benefits
The Michigan Unemployment Insurance Agency is warning consumers about callers claiming residents are owed roughly $4,000 in unpaid unemployment benefits. The catch? You have to pay a $105 fee first. In one reported case, the caller claimed to be a human resources manager from the agency and even supplied an employee number.
Officials have said similar suspicious calls have surfaced in other states, suggesting the scheme isn't limited to Michigan. The U.S. Department of Labor's Unemployment Insurance Integrity Center reported an AI-driven calling operation targeting North Dakota residents with the same $4,000 promise and attempting to collect personal information.
State unemployment agencies don't charge people a fee to release benefits they're entitled to receive. If you receive an unsolicited call offering unpaid benefits, verify the claim directly with your state's unemployment agency rather than using any contact information provided by the caller.
Protect your digital life: See Lifelock's current identity theft plans and get your first year of the standard plan for just $7.99 a month
The most common types of scam you should know
Scammers are constantly upping their game, coming up with new and exciting ways (for them) of fooling their targets. AI-powered scams are one example of this; the technology is being used to reach a larger number of people with increasingly more convincing schemes
But some tricks never run out of style. Most scams fall into a handful of familiar patterns, and many long-standing schemes are still a threat today. They’ve just evolved to better fit today’s digital landscape
- Imposter scams: Scammers often pose as trusted figures such as government agencies, banks, employers and even friends or family to pressure victims into sending money or sharing personal information
- Phishing and spoofing scams: These scams use emails, texts or phone calls that look like they’re from legitimate organizations. The goal is to trick you into clicking a malicious link, downloading malware or handing over sensitive information
- Online shopping scams: Fraudsters can create fake online stores or listings with hard-to-find items at unusually low prices. After you pay for an article, what you end up getting might be counterfeit — or it may never arrive in the first place
- Investment scams: This type of scam often arrives with promises of high returns from crypto, forex or other “exclusive” opportunities. Many involve long-term grooming tactics in which victims are encouraged to invest more over time before losing everything
- Romance scams: Some scammers try to get into your pocket through the heart. They build a relationship with you on dating apps or social media, then convince you to give up money and assets by fabricating emergencies or investment opportunities
Plans for everyone: Check out Aura's identity theft options for you and your family, starting at $9 a month when you pay annually
What to do if you’re the target — or victim — of a scam
No one is immune to scams or fraud, but a few consistent habits can reduce their danger and the damage they cause
For starters, be skeptical of unsolicited messages, especially those creating fear or urgency. This might look like an email from your bank threatening to close an account, a text from an online marketplace saying you’ll lose a discount or a call from the IRS claiming they’ll report you to the authorities unless you “act now.”
Scammers love to use this sort of language because it puts you on the spot, which they expect will move you to action
Always verify any requests from an organization by cross-checking with its official phone numbers, email or website. And don’t click any links, download attachments or respond to messages you suspect may be fraudulent. A legitimate organization will not pressure you for instant action or secrecy
Now, if you’ve already sent financial information or money to someone you suspect is a scammer, you’ll need to take a few steps to protect your data and possibly get your money reimbursed. Contact your bank, credit card issuer or payment platform immediately and attempt to stop or reverse the transactions. Make sure to change any relevant passwords and enable multi-factor authentication to safeguard your accounts, too.
Reporting a scam might also help protect others. You can file a report with the Federal Trade Commission and with local authorities at your nearby police department or sheriff’s office. Identity theft victims should also consider temporarily freezing their credit
Lastly, review your financial statements and credit reports regularly, keep your software updated and limit how much personal information you share online. Scammers often rely on publicly available details to make their schemes more convincing