Another $399.99 Subscription? Apparently Geek Squad Is Throwing a Facebook Event

I have another expensive subscription I didn’t know about.

And once again, the scammers were thoughtful enough to invite me to a Facebook event to celebrate it.

This email arrived with the subject:

“Jordan Ramirez invited you to Geek Squad Order confirmed: INV#445016.Amount:$399.99”

According to the invitation, I supposedly paid $399.99 for a Geek Squad PC Protection Plan.

There's just one minor problem.

I didn't.

And if this looks familiar, it should.

🚩 Haven't We Seen This Movie Before?

Just recently, I received another Facebook event invitation claiming that $498.99 had been paid for a subscription through my PayPal account.

That one came from “Agnes V. Burden.”

This time we have Jordan Ramirez, Geek Squad, and $399.99.

Different person.

Different company.

Different dollar amount.

But remarkably similar script.

The invitation claims:

“Bill has paid $399.99 for a subscription using your PayPal account from an unknown seller IP.”

Wait.

Bill is back?!

Apparently Bill has access to my imaginary PayPal account and is having quite a shopping spree.

It would be helpful to sit Bill down and discuss boundaries.

🚩 Facebook Is Literally Warning Me

One of my favorite parts is that the warning is sitting right there at the top of the message:

“Meta did not send this event invitation. Please be cautious when clicking on links or providing personal information.”

Thank you, Meta.

Message received.

That's an important distinction because the sender shown in the email is:

Jordan Ramirez <notification@facebookmail.com>

Someone might see the Facebook-related email address and assume the underlying message must be trustworthy.

But the screenshot itself explains what's happening.

Jordan Ramirez invited me to an event.

The suspicious content is contained inside that event invitation.

A legitimate platform delivering a notification doesn't automatically make the content created by another user legitimate.

🎉 What Time Does My Geek Squad Party Start?

The invitation gives me the traditional Facebook choices:

Going

Maybe

Can't Go

Let's see.

Am I going to my imaginary $399.99 Geek Squad subscription celebration?

I'm leaning toward:

Can't Go.

I have plans that evening.

Specifically, not calling the phone number in this message.

🚩 And There It Is: The Phone Number

The message says that if I don't recognize the purchase, I should contact a:

“Resolution Center”

and conveniently provides a phone number.

That's the part that deserves attention.

The scary $399.99 charge gets your attention.

Geek Squad provides a recognizable brand.

PayPal adds a financial component.

And the phone number provides an immediate way to “fix” the problem.

That's exactly when I'd stop.

If I genuinely thought Geek Squad charged me $399.99, I wouldn't call the number supplied in a suspicious Facebook event.

I'd check my PayPal, credit card, and bank accounts independently.

Then, if necessary, I'd independently find the legitimate contact information for Geek Squad or the financial institution involved.

The suspicious message doesn't provide both the problem and the solution.

🚩 “Pay_Pal” Makes Another Appearance

This is another detail I noticed in both messages.

Not PayPal.

Pay_Pal.

The previous $498.99 subscription invitation used essentially the same wording.

Now this one does too.

So let's compare.

Previous message:

$498.99 subscription.

Facebook event invitation.

Claim involving “Pay_Pal.”

Unknown seller IP.

Phone number to call.

Current message:

$399.99 Geek Squad subscription.

Facebook event invitation.

Claim involving “PayPal.”

Unknown seller IP.

Phone number to call.

That's quite a coincidence.

Or perhaps we're looking at variations of the same social-engineering template.

🧠 The Scam Isn't Really About Geek Squad

That's an important point.

The recognizable company name makes the story believable.

Today it's Geek Squad.

Another day it could be PayPal, Norton, McAfee, Amazon, Microsoft, or another familiar brand.

The psychology is what matters.

You see:

$399.99

Your immediate reaction might be:

WHAT DID I BUY?!

Then you see:

“If you do not recognize this purchase, please contact...”

Perfect!

There's a phone number!

And before you've checked whether the transaction actually exists, you're talking to whoever is on the other end.

That's why urgency is so effective.

The message doesn't necessarily need to survive careful analysis.

It just needs to get you to act before you do careful analysis.

🚩 Don't Call the Number to Find Out Whether the Number Is Legitimate

This seems obvious when you say it out loud, but it's worth repeating.

If a suspicious message tells you that something terrible happened and then provides a phone number to fix it:

Don't use the suspicious message to verify the suspicious message.

Go around it.

Open your actual PayPal app.

Check your bank.

Check your credit card.

Go independently to the company's official website.

If there's no $399.99 transaction anywhere, that's important information.

And if there is an unauthorized transaction, contact the financial institution using independently verified information—not the number supplied in the questionable message.

🏡 Don't Be Passive. Be a Good Neighbor.

This is why I keep sharing these.

I recognize the pattern because I've been documenting them.

Someone else might not.

Someone might see Geek Squad, recognize the name, and panic.

Someone might think their spouse or child bought something.

Someone might worry that their PayPal account has been hacked.

And someone might immediately call.

If you see one of these, don't just delete it and move on.

Warn somebody.

Show your parents.

Show your neighbors.

Show the person who always calls you when something weird appears on their computer.

Report suspicious content through the appropriate platform.

Sometimes being a good neighbor is simply saying:

“Don't call that number. Let's check your actual account first.”

Jordan, I'm Going to Have to Decline

So thank you, Jordan Ramirez, for inviting me to the celebration of my imaginary $399.99 Geek Squad subscription.

Unfortunately:

Going? Nope.

Maybe? Still nope.

Can't Go? That's the one.

And apparently I need to have a serious conversation with Bill, because he keeps buying subscriptions with my imaginary PayPal account.

Follow along at NielFlamm.com/blog for more scam emails, suspicious recruiters, questionable vehicle offers, and whatever strange invitation lands in my inbox next.

A $7,000 2024 Toyota Camry XSE? TikTok’s $500 Down Car Deal Is Back

At this point, I think TikTok believes I’m shopping for a car.

I’m not.

But the algorithm apparently knows I enjoy looking at vehicle offers that make me stop scrolling and say:

“There is absolutely no way.”

We've already had the $6,800 Camry. Then the $5,000 Honda Accord. Then the brand-new 2026 Toyota RAV4 Plug-In XSE advertised for $8,500.

Now we have another contestant.

According to a TikTok posted under the name “Daniel’s Dealership,” this is a:

2024 Toyota Camry XSE
Price: $7,000
Down payment: $500

And the caption adds:

“SPORTY & FULLY LOADED!”

Well, fantastic.

Where do I send my $500?

Actually, don't answer that.

🚩 Let's Start With What This Car Is Actually Worth

The advertised price immediately caught my attention, so I checked current values.

Kelley Blue Book currently puts the Fair Purchase Price of a used 2024 Toyota Camry XSE at about $28,000 nationally. Depending on condition, KBB estimates trade-in value around $21,620–$24,920 and private-party value around $23,590–$27,190. Kelley Blue Book

So let's compare:

TikTok: $7,000

KBB Fair Purchase Price: approximately $28,000

That's not a small discount.

That's about 75% below KBB's current Fair Purchase Price.

Even more interesting: Toyota's original base MSRP for a 2024 Camry XSE was $31,720. The XSE AWD started at $33,120 and the XSE V6 at $36,845. Toyota

In other words, we're being presented with a relatively recent Toyota—one of the more desirable Camry trim levels—for less than many dealerships would expect to receive simply by trading one in.

Could a $7,000 Camry exist?

Of course.

Maybe it's wrecked.

Maybe it has a salvage title.

Maybe it has extraordinarily high mileage.

Maybe it has mechanical problems.

Maybe there's some other legitimate explanation.

But those details would be pretty important, wouldn't they?

The TikTok doesn't tell us.

🚩 “Fully Loaded!” Okay. How Many Miles?

This is where these advertisements continue to fascinate me.

We get:

SPORTY!

FULLY LOADED!

🔥🔥🔥

What don't we get?

Mileage.

VIN.

Vehicle history.

Title status.

Accident history.

Financing terms.

APR.

Loan length.

Dealer address.

Those boring little details that might explain why a car worth around $20,000 is supposedly being offered for $7,000.

Maybe there's a perfectly reasonable explanation.

I'd love to hear it.

Preferably publicly.

🚩 And There’s That $500 Again

This is becoming my favorite recurring character.

THE $500 DOWN PAYMENT.

I've now encountered multiple suspiciously cheap vehicle advertisements using essentially the same formula:

Unusually inexpensive vehicle.

Tiny down payment.

Very little financing information.

Then get the interested person into a private conversation.

For this Camry:

$7,000 price.

$500 down.

But what happens to the remaining $6,500?

What's the monthly payment?

How many months?

What's the APR?

Who's financing it?

What credit qualifications apply?

None of that appears in the screenshot.

But don't worry.

We do learn how to get more information.

🚩 “Where Is This Vehicle Located?”

Someone in the comments asks possibly the easiest dealership question imaginable:

“where is this vehicle located?”

That's a fantastic question.

It should also have an extraordinarily simple answer.

Charleston.

Charlotte.

Atlanta.

Chicago.

123 Main Street.

Whatever.

Instead, the account responds:

“Message me”

There it is again.

Why does the location of the vehicle need to be a secret?

If you're a dealership advertising a vehicle for sale, wouldn't you generally want customers to know where the dealership is?

Another commenter asks:

“Does it it have any issues?”

Also a very reasonable question considering the price.

That question is even more important when KBB indicates a typical 2024 XSE is worth several times the advertised $7,000 price. Kelley Blue Book

🚩 The DM Pattern Keeps Appearing

This is now one of the biggest recurring themes I've noticed in these social-media vehicle offers.

The advertisement gets your attention publicly.

The incredibly low price creates interest.

The small down payment makes the vehicle seem obtainable.

Then, when someone asks for basic information:

DM me.

Message us.

Message me.

I have not messaged this account, so I cannot tell you what happens after someone enters the private conversation.

Maybe they provide legitimate dealership information.

Maybe they provide the VIN.

Maybe they explain why the car is $7,000.

I don't know.

And that's an important distinction.

But if that private conversation eventually turns into:

“Send the $500 so we can hold the vehicle,”

I'd stop.

Especially if they ask for payment through a peer-to-peer payment service or another method that makes recovering the money difficult.

Before sending anything, independently verify the dealership, physical location, VIN, title, vehicle history, and that the person you're communicating with actually has authority to sell that vehicle.

🚩 There's Something Else Interesting in the Picture

Look closely at the exterior photo.

A dealership building sits behind the Camry.

There's signage.

There are other vehicles.

It certainly looks like a dealership photograph.

But a picture taken at a legitimate dealership doesn't automatically prove that the social-media account posting it represents that dealership.

That's an important distinction with online vehicle shopping.

Photos can be copied.

Listings can be copied.

Dealer inventory photographs can be copied.

Even entire descriptions can be copied.

So I'd want to identify the dealership visible in the photograph and independently contact that business—not using information supplied by the social-media account—to ask:

“Do you have this 2024 Camry XSE, and are you selling it for $7,000?”

That one phone call could answer quite a few questions.

Let's Do the Reality Check

The TikTok advertisement:

2024 Toyota Camry XSE — $7,000

Kelley Blue Book:

Approximately $28,000 Fair Purchase Price. Kelley Blue Book

Toyota's original XSE base MSRP:

$31,720. Toyota

TikTok down payment:

$500

Someone asks where the vehicle is located.

Response:

“Message me.”

Someone asks whether the vehicle has issues.

And here I am asking:

Why does a car potentially worth four times the advertised price cost only $7,000?

That's the question I'd want answered before worrying about the $500 down payment.

🏡 Don't Just Scroll Past It—Be a Good Neighbor

Another reason I keep writing about these posts is this:

Someone commented asking where the car is located.

Someone else asked whether it has problems.

Those aren't abstract numbers on a screen.

Those are people who may genuinely need transportation.

A $28,000 Camry may be completely outside someone's budget.

A $7,000 Camry with only $500 down may suddenly feel possible.

That's precisely why an extraordinary offer deserves extraordinary scrutiny.

And if you recognize the warning signs, don't be passive.

Say something.

Report suspicious listings.

Tell a friend.

Warn someone in the comments without harassing anyone.

Help somebody independently verify the seller before they send money.

Being a good neighbor online isn't much different from being one offline.

Sometimes it means seeing someone about to make a $500 mistake and saying:

“Before you send that money, let's make sure this car—and this seller—are real.”

Because the best scam prevention tool isn't always sophisticated technology.

Sometimes it's simply another person paying attention.

More scam emails, suspicious recruiters, questionable vehicle deals, and whatever else the internet sends my way at:

NielFlamm.com/blog

Apparently My $498.99 PayPal Subscription Is Now a Facebook Event

The scammers are getting creative.

Today I received an email with this wonderfully alarming subject line:

“Agnes V. Burden invited you to Notice: Your Subscription Payment of $498.99 was Paid.”

Wait.

I bought a subscription?

For $498.99?

And Agnes is throwing an event to tell me about it?

I appreciate the invitation, Agnes, but I think I'm busy that day.

🚩 The First Red Flag Is Actually a Giant Warning

This one gets interesting because the email appears to be generated through Facebook's event system rather than simply pretending to be a normal PayPal notification.

And Facebook practically puts a warning label on it for us:

“This event invitation was not sent by Meta. Please be cautious when clicking on links or providing personal information.”

That's not exactly subtle.

The apparent sender address is notification@facebookmail.com, which could make someone think, Well, it came through Facebook, so it must be legitimate.

But that's the trick.

The screenshot indicates that Agnes V. Burden created the event. The event itself appears to carry the scam message.

That's an important distinction: a legitimate platform can be used to deliver content created by someone else.

🎉 You're Invited! Your Money Is Gone!

The event title reads:

“Notice: Your Subscription Payment of $498.99 was Paid.”

Then we get the usual Facebook invitation:

Going | Maybe | Can't Go

I'm struggling to choose the right RSVP.

Going: Yes, I definitely want to attend the disappearance of $498.99.

Maybe: Depends. Will there be food?

Can't Go: Sorry, I have another fraudulent transaction at 1:00.

But then we get to the actual event description:

“Bill has paid $498.99 for a subscription using your Pay_Pal account from an unknown seller IP.”

There are so many questions.

Who is Bill?

Why is Bill spending my money?

Why is PayPal suddenly “Pay_Pal”?

And what exactly is an “unknown seller IP” supposed to mean?

But don't worry.

They've conveniently provided a phone number.

🚩 And THAT Is the Point

The message says that if I don't recognize the seller, I should call the number shown in the invitation.

There's the hook.

The $498.99 isn't necessarily the objective.

The objective may be to make me panic about the $498.99 and call the number.

The FTC specifically warns about this type of subscription-renewal scam. Victims receive notices claiming they've been charged hundreds of dollars for a subscription and are instructed to call a number to dispute it. Once they call, scammers may try to get financial information, persuade the victim to grant remote computer access, or create a fake “refund” problem that ultimately leads the victim to send money. Consumer Advice

In other words:

The fake charge creates the panic.

The phone number gives the scammer a path in.

🚩 This Facebook-Event Version Isn't Unique

Here's what really caught my attention.

I found a strikingly similar report in the Better Business Bureau's Scam Tracker from July 2026.

That report described a Facebook/Meta event invitation claiming a $749.49 MetaPay payment, complete with the same warning that the event invitation wasn't sent by Meta. The event then instructed the recipient to call a phone number if the payment was unauthorized. BBB categorized that report as phishing. Better Business Bureau

Different amount.

Different supposed transaction.

Different phone number.

Very similar playbook.

That's a useful reminder that scammers don't always need to spoof an entire company's email system. Sometimes they can abuse legitimate features—event invitations, calendar invites, shared documents, comments or other notifications—to get their message delivered.

💰 So What Should I Do About My $498.99?

First, I'm not calling the number in the invitation.

I'm also not clicking anything in the event to “resolve” the supposed charge.

If I were genuinely concerned that $498.99 had been charged through PayPal, I'd independently open the real PayPal app or website and inspect my transactions.

I'd also check the bank or credit-card account connected to it.

The FTC recommends that same approach for suspicious subscription notices: check your actual financial accounts, and if you need to contact the company, use contact information you know is legitimate—not the phone number supplied in the suspicious message. Consumer Advice

If the $498.99 transaction isn't there?

Then there's nothing to refund.

And there's certainly no reason to call Agnes.

🧠 The Psychology Is Better Than the Grammar

What makes this scam potentially effective isn't perfect spelling or a sophisticated story.

It's the number:

$498.99

That's large enough to make someone panic.

You don't stop to analyze “Pay_Pal.”

You don't wonder why a financial transaction has become a Facebook event.

You don't ask who Bill is.

You see:

YOU JUST LOST $498.99.

Then:

CALL THIS NUMBER.

That's social engineering.

The scammer doesn't need you to believe the entire story.

They just need you to become concerned enough to take the next action.

🏡 Be a Good Neighbor

I've said this before, and I'll keep saying it.

If you see something like this, don't be passive.

Tell your parents.

Tell your grandparents.

Tell your friends.

Tell the neighbor who isn't particularly comfortable with technology.

Share screenshots.

Report suspicious messages.

The FTC even recommends talking to someone you trust—a friend, family member, or neighbor—when you're unsure whether something is a scam. That second set of eyes can interrupt the panic that these schemes depend upon. Consumer Advice

You might recognize it as suspicious right away.

Someone else may see $498.99 and think their money is disappearing.

Sometimes being a good neighbor is simply saying:

“Don't call that number. Let's check your actual account first.”

Agnes, I'm Going to Have to Decline

So, Agnes V. Burden, thank you for inviting me to the celebration of my imaginary $498.99 subscription.

Unfortunately:

Going? No.

Maybe? No.

Can't Go? Absolutely.

And I'm definitely not calling your phone number.

Follow along at NielFlamm.com/blog for more scam emails, questionable TikTok car deals, suspicious recruiters, and whatever creative nonsense lands in my inbox next.

$8,500 for a BRAND-NEW 2026 Toyota RAV4 Plug-In XSE? TikTok Has Outdone Itself

I thought the $6,800 Toyota Camry was impressive.

Then TikTok showed me a $5,000 Honda Accord Sport.

Apparently, the algorithm took that as a challenge.

Because now we've reached:

2026 Toyota RAV4 Plug-In Hybrid XSE
Asking: $8,500
Down payment: $600
Monthly payment: $250

And according to the TikTok description, this isn't some damaged, high-mileage auction vehicle.

It's supposedly:

“BRAND NEW.”

And:

“FULLY LOADED.”

Okay.

This may be my favorite one yet.

🚩 Let's Start With the Actual Price

The easiest way to test this offer is to forget about complicated used-car valuations.

It's a brand-new 2026 model.

Toyota itself tells us what it costs.

Toyota lists the 2026 RAV4 Plug-In Hybrid XSE at a starting MSRP of $47,200. Toyota's consumer site currently shows the overall plug-in lineup starting at $41,500. Toyota Pressroom

Kelley Blue Book puts the XSE's MSRP at $48,650. Kelley Blue Book

And TikTok?

$8,500.

We're not talking about saving $2,000.

Or $5,000.

Or even $10,000.

The advertised price is roughly $38,700 below Toyota's $47,200 starting MSRP.

That's about an 82% discount.

Apparently Toyota has invented a revolutionary new sales strategy:

Build a nearly $50,000 plug-in hybrid SUV and immediately sell it for less than the price of many ten-year-old used cars.

Sounds perfectly reasonable.

🚩 Even a Dealer Couldn't Make This Math Work

This is where I always ask the same question:

Why me?

Why would anyone sell this vehicle to a random person scrolling TikTok for $8,500?

If this is genuinely a brand-new, fully loaded 2026 RAV4 Plug-In Hybrid XSE, a legitimate dealer doesn't need to discount it by almost $40,000 to make it disappear.

They could presumably sell it to another dealer for dramatically more.

They could take it to auction.

They could put it on any major automotive marketplace.

They could park it on the lot with a giant inflatable gorilla dancing beside it.

Almost anything makes more financial sense than:

“TikTok special! $8,500!”

That's why comparing these offers with wholesale or auction values matters. If a supposedly clean vehicle is advertised for dramatically less than what the seller could reasonably obtain through normal wholesale channels, you have to ask why.

With a brand-new 2026 model, the claim becomes even harder to explain away.

🚩 Then Comes My Favorite Part: $600 Down

The previous two suspicious vehicle advertisements I found used a remarkably similar formula.

Cheap vehicle.

Small down payment.

Low monthly payment.

Move the interested buyer into private messages.

This time:

$600 down.

That's slightly different from the $500 figure in the other ads.

Apparently inflation has reached the scam economy too.

But here's what I want to know.

$250 a month for HOW LONG?

The advertisement doesn't say.

Let's perform some kindergarten-level financing.

$8,500 minus the $600 down payment leaves:

$7,900.

At $250 per month, ignoring interest, taxes, and fees completely, that would take about:

31.6 months.

So apparently I'm financing a brand-new $47,000+ RAV4 XSE for less than three years at $250 a month?

Toyota currently has a real financing offer on the 2026 RAV4 Plug-In Hybrid: 4.99% APR for 48 months, for qualified customers. Toyota states that this works out to $23.02 per month for every $1,000 financed. Toyota

Finance $47,200 using that calculation, and you're looking at roughly $1,087 per month before accounting for things like taxes, registration, dealer-installed equipment, or a down payment.

TikTok:

$250.

That's quite a financing department.

🚩 Where Are the Financing Disclosures?

Once again, the advertisement gives us the magic number:

Monthly: $250

But where's the APR?

Where's the term?

How many payments?

Who's the lender?

What credit score is required?

What's the total amount financed?

Are there taxes and fees?

Nothing.

We're simply supposed to see $250/month and become excited.

And then comes the next part.

🚩 Somebody Actually Asked the Right Question

I opened the comments.

One person wrote:

“Yes to good to be true”

I'm assuming they meant too good to be true.

Correct.

Another asked exactly what everyone should be asking:

“That cheap... whats the catch?”

Excellent question.

And the account's public response?

“Dm me”

There it is again!

Not:

Here's our dealership address.

Not:

Here's the VIN.

Not:

Here's the complete financing disclosure.

Not:

Here's the listing on our dealership website.

Not even:

Here's why a nearly $50,000 SUV costs $8,500.

Just:

DM me.

Meanwhile, another commenter writes:

“I'm interested.”

That's precisely what worries me about these posts.

🚩 The Public Ad Creates the Dream. The DM May Close the Deal.

I have not privately messaged this account, so I don't know what happens after someone enters the DMs.

And I'm not going to claim that I do.

But after looking at several of these TikTok vehicle advertisements, I'm seeing a pattern worth recognizing.

The public post advertises an extraordinary deal.

It sets a small down payment.

Interested people comment publicly.

Then they invite them into private messages.

That's where I'd want to know whether the conversation eventually becomes:

We have several interested buyers.

You need to reserve the vehicle.

Send the $600 deposit.

We'll hold it for you.

And perhaps the payment needs to go through Cash App, Zelle, PayPal, crypto, or some other method.

Again, I haven't seen that happen with this account.

But if someone claiming to sell this vehicle asks you to send that $600 before you've independently verified the business, VIN, title, physical vehicle, and seller, I would stop immediately.

🚩 “Golden Auto USA”

The TikTok account identifies itself as GOLDEN.AUTO.USA.

A professional-looking name or logo doesn't prove who operates an account.

Before sending a penny, I'd want to independently establish that the seller is a real licensed dealer, find its physical address through independent sources, call a publicly listed number, verify the TikTok account actually belongs to that business and confirm that this exact vehicle exists.

And I'd want the VIN.

If the answer to:

“What's the VIN?”

is:

“DM me.”

We're not making much progress.

Let's Put This One Into Perspective

Toyota:

2026 RAV4 Plug-In Hybrid XSE — starting MSRP $47,200. Toyota

Kelley Blue Book:

MSRP $48,650. Kelley Blue Book

TikTok:

$8,500.

Down payment:

$600.

Monthly payment:

$250.

Question from a potential customer:

“What's the catch?”

Seller:

“Dm me.”

Ladies and gentlemen, I think we've assembled enough red flags to open our own flag store.

And This Is Why These Posts Matter

It would be easy to laugh at something this ridiculous.

But look at the engagement in the screenshot:

1,238 likes.

219 comments.

510 saves.

377 shares.

People are seeing it.

Somebody is interested.

And somebody looking for reliable transportation who doesn't know what a RAV4 Plug-In Hybrid XSE actually costs might see:

$600 DOWN!

and think they've finally found something they can afford.

That's why I keep writing about these.

Scams don't have to fool everyone.

They only need to reach the right person at the wrong moment.

Before sending money for a vehicle advertised on social media, independently verify the seller, the vehicle, the VIN, and the price.

And if someone offers you a brand-new, nearly $50,000 Toyota for $8,500?

You probably shouldn't start by asking:

“Where do I send the $600?”

Start with:

“Why would you possibly sell it to me for that?”

Follow along at NielFlamm.com/blog for more questionable TikTok vehicle deals, scam emails, suspicious recruiters, and whatever the algorithm decides to throw at me next.

Apparently, the Scammers Have Stopped Writing Emails

I've written quite a bit lately about scam emails, suspicious recruiters, mystery attachments, and people desperately trying to convince me to click something.

Apparently, we've now reached the minimalist phase of scamming.

Why bother writing an elaborate fake invoice when you can simply send me an attachment and hope I do the rest?

Over the past few days, I received two more emails that follow essentially the same strategy: almost no information, a mystery attachment, and curiosity as the bait.

🚩 Scam Email #1: Thank You for the Order!

The first one came from someone identifying himself as Philip Smith, using a Gmail address.

The subject:

“Re: Thank you for the order 8WXJBZYM91JW858X2A”

Oh!

Thank you for my order!

There's just one tiny problem.

What order?

There's no company name.

No product.

No price.

No shipping information.

No recognizable merchant.

The body of the email contains essentially nothing except the same mysterious string:

8WXJBZYM91JW858X2A

And then there's an attachment.

A 244.4 KB file with a filename beginning with a date and my name.

That's a nice touch.

Putting someone's name in a filename can make the attachment feel personalized and legitimate.

But I'm supposed to believe I placed an order somewhere, received no explanation of what I purchased, and now need to open an unexplained attachment to discover what happened?

No thanks.

🚩 Scam Email #2: They Didn't Even Bother With a Subject

Then another masterpiece arrived.

Sender:

Anushka Chatarjee

Another Gmail account.

Subject:

<no subject>

The message was sent using BCC, suggesting I may simply be one of multiple recipients who received the same message.

And what's in the email?

Nothing useful.

But, naturally, there's a 390.8 KB Microsoft Word attachment.

So now the pitch has been reduced to:

Hi.

Actually, they didn't even say hi.

It's basically:

Here's a Word document. Open it.

That's the entire sales presentation.

The Attachment IS the Email

This is what people need to understand about messages like these.

The lack of information isn't necessarily a failure.

Curiosity can be the social-engineering technique.

The first email wants me wondering:

Did I accidentally order something?

Was my credit card compromised?

How much did they charge me?

What did I supposedly buy?

And where should I look for the answer?

Inside the attachment.

The second email is even more direct.

There's no story at all. Just a mysterious Word document.

The scammer doesn't necessarily need me to believe anything yet.

They just need me to open the file.

Why I Don't Open Them

I don't know what's inside either attachment because I didn't open them.

That's important.

I'm not going to claim these particular files contain malware, malicious links or credential-stealing software when I haven't analyzed them.

I also don't need to.

An unexpected attachment from an unknown Gmail account with no legitimate explanation for why I'm receiving it has already failed my trust test.

The safest question isn't:

“I wonder what's inside?”

It's:

“Why would I open this?”

And in both cases, I can't come up with a good answer.

The Fake Order Trick Is Particularly Clever

The fake-order approach adds another psychological ingredient:

Fear.

Imagine someone receives the first email and thinks:

I didn't order anything!

That's exactly when rational thinking can get replaced by urgency.

They want to find out whether someone used their credit card.

They want to know how much money was charged.

They want to cancel the transaction.

So they open the attachment.

That's why, if you receive a suspicious purchase confirmation, don't use the mystery attachment to investigate it.

Check your credit card or bank account independently.

Log into Amazon, Walmart, PayPal or whatever company supposedly processed the purchase by going directly to the service yourself—not through links or attachments supplied in the suspicious message.

If there's no transaction, there's nothing to cancel.

From “Pharmacy Office” to This

Just days ago, I received another email with the subject “Pharmacy Office.”

That one also contained mystery attachments with practically no explanation.

Now I've received a mysterious order confirmation and a completely blank email carrying a Word document.

There seems to be a theme developing:

The scammers want me to supply the curiosity.

Sorry.

I'm fresh out.

My New Attachment Policy Is Pretty Simple

Unknown sender?

Unexpected attachment?

No explanation?

Generic Gmail account?

Fake urgency?

Mystery purchase?

I'm not opening it.

If someone legitimately needs me to review a document, they can identify themselves, explain what they're sending, and give me a reason to expect it.

Until then, your mysterious 390.8 KB Word document can remain a mystery forever.

Sometimes the safest click is the one you never make.

Follow along at NielFlamm.com/blog for more scams, suspicious emails, questionable recruiters and the increasingly creative ways strangers on the internet try to get me to click things.