Getting shipment emails for purchases you didn’t make is finally explained

Over the past year, more people have reported receiving order shipment emails for purchases they never made. These messages usually come from legitimate retailers, often sportswear brands or electronics stores, and contain real tracking numbers and delivery details. The products are being shipped to different names at different addresses, but for some reason, the buyer’s contact email is yours.

It might seem like a harmless clerical error or someone accidentally typing the wrong email address. But when it happens repeatedly, and across multiple unrelated orders, it starts to look less like a coincidence and more like a tactic.

Arthur from Cape Coral, Florida, recently reached out with an experience that mirrors what others have been describing:

“My wife’s e-mail address is showing up in emails from various sports entities to notify her of shipping dates, etc. So far, three separate individuals have ordered products, shipped to a different name at a different address, but used her email as the contact. They didn’t use our credit card to place the order. What could be going on? I don’t believe it’s a coincidence.”

HOW TO DETECT FAKE AMAZON EMAILS AND AVOID IMPERSONATION SCAMS

Arthur is right to question what’s happening. Scammers are deliberately using real email addresses to push fraudulent purchases through retailer systems with fewer checks. They rely on your email to carry out the scam, even if they have not stolen your payment details.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide—free when you join my CYBERGUY.COM/NEWSLETTER 

What’s likely happening with those shipment emails in your inbox

It is unlikely that someone is accidentally typing your email address every single time. Rather, scammers are deliberately using valid, active email addresses like yours to bypass retailer fraud filters. Numerous sources confirm that fake order and shipping confirmation emails are a common tactic in fraud operations, with criminals exploiting the trust systems placed in legitimate email addresses.

When a stolen credit card is used, pairing it with a real email that has not triggered spam alerts increases the chance the transaction will go unnoticed by anti-fraud systems. Retailers often check whether an email address is active or bounces. If the system sees a functioning address, it may be less suspicious than an obviously fake one.

Once the order is placed, products are frequently sent to drop addresses or freight-forwarding services, as confirmed by official investigations into brushing scams. These services act as intermediaries, making the scam harder to trace. In that context, your email is simply a means to an end, a validated contact point that helps the operation move forward smoothly.

How bad actors are able to get your email

Your email address may have ended up in the hands of scammers through several common methods. The most likely cause is a data breach. Many well-known companies have suffered leaks where customer emails and other information were exposed. 

Once your email is part of a leaked database, it often circulates on the dark web or in underground forums where it is freely traded and reused. Even if you were not part of a breach, scammers often use a technique called credential stuffing. This involves testing stolen login details across different websites to confirm which email addresses are active.

REMOVE YOUR DATA TO PROTECT YOUR RETIREMENT FROM SCAMMERS

Remove yourself from the web

The best thing you can do to prevent this from happening is to invest in a data removal service. While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time. 

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan

7 ways to secure your email from scammers

These simple but powerful steps can help you protect your inbox, safeguard your identity, and stay one step ahead of scammers misusing your email.

1) Protect and monitor your email

Start by locking down your email account with a strong, unique password that you don’t reuse anywhere else. Enable two-factor authentication (2FA) so hackers can’t get in even if they’ve stolen your password. A password manager makes this much easier by generating and securely storing complex passwords, helping you avoid the risks of reuse. 

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com/Passwords.

Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com/Passwords) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

2) Watch for suspicious messages

Scan your inbox regularly for order confirmations, shipping notices, or account sign-ups you don’t recognize. If something looks off, report it directly to the retailer or platform; it could be part of a larger scam using your email address. Scan your inbox regularly for order confirmations, shipping notices, or account sign-ups you don’t recognize. If something looks off, report it directly to the retailer or platform; it could be part of a larger scam using your email address. Never click on suspicious links, even if the message looks legitimate, and protect your devices with strong antivirus software to catch threats before they spread.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com/LockUpYourTech 

3) Be picky about where you share your email

Avoid entering your email on shady giveaway sites or sketchy online forms. When in doubt, skip the sign-up or use a throwaway email. The fewer places your email lives, the harder it is for scammers to get hold of it.

4) Create a second email address for shopping

Set up a dedicated email for online purchases, newsletters, and subscriptions. This helps keep your main inbox clean and makes it easier to spot strange activity. Sometimes, it’s best to create various email aliases so that you don’t have to worry about all your info getting taken in a data breach.  An email alias address is a great way for you to stop receiving constant spam mail by simply deleting the email alias address. These aliases forward messages to your primary address, making it easier to manage incoming communications and avoid data breaches.

For recommendations on private and secure email providers that offer alias addresses, visit Cyberguy.com/Mail

HOW TO TELL IF A LOGIN ALERT IS REAL OR A SCAM

5) Monitor your credit and identity regularly

Even if no purchases appear under your name, scams involving your email can be a red flag for future identity misuse. Set up alerts with your bank and consider a credit monitoring service to catch unauthorized activity early.

See my tips and best picks on how to protect yourself from identity theft at  Cyberguy.com/IdentityTheft

6) Review connected accounts and revoke access

In your email settings (e.g., Gmail, Outlook), check for any connected apps, services, or delegated access you don’t recognize and remove them. This ensures no third party is piggybacking off your account.

7) File an identity theft report if the problem escalates

If this email misuse leads to fraudulent financial activity, direct users to file a report with the FTC at IdentityTheft.gov or their local authorities. Include this only if appropriate to your tone.

Kurt’s key takeaway

If you are receiving order confirmations for things you never bought, do not shrug it off. Your email is likely being misused as part of a larger fraud operation, not by accident but intentionally. Scammers are taking advantage of active, trustworthy email addresses to slip past retailer defenses and carry out unauthorized purchases. The repeated use of your email shows that fraud networks are already circulating it, even if your financial information remains untouched.

Are you comfortable with how much of your personal information is floating around online? Let us know by writing to us at Cyberguy.com/Contact

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide—free when you join my CYBERGUY.COM/NEWSLETTER

Copyright 2025 CyberGuy.com.  All rights reserved.