A New Scam Tactic Made Me Do a Double Take: “Walmart Order password88458”
When I thought my inbox scammers had settled into a comfortable routine of fake PayPal charges, Geek Squad subscriptions, and invitations to give away hundreds of dollars, somebody apparently decided the script needed an update.
This one actually made me do a double take.
The subject line reads:
“Walmart Order password88458”
Password?
Wait.
Did I ask for my Walmart password to be reset?
No.
And that tiny moment of uncertainty is exactly what caught my attention.
This One Feels Different
Most of the scam emails I've been receiving practically announce themselves.
YOU SPENT $499.99!
YOUR GEEK SQUAD SUBSCRIPTION RENEWED!
CALL THIS NUMBER IMMEDIATELY!
They want panic.
This one is quieter.
The email body has no real message. Instead, it has two attachments: an HTML file and what looks like an invoice.
The sender shown is:
Yet the subject references Walmart.
That's enough for me to stop.
If this is supposedly about my Walmart account, why is the message coming from a completely unrelated domain?
And why would I need to open attachments to figure out what's happening with my password?
No thanks.
The “Password” Word Almost Worked
That's what I find interesting about this one.
I saw “password” and instinctively wondered whether I'd requested a password reset.
For a moment, the message made me question my own memory.
That's potentially much more effective than another ridiculous $499.99 invoice.
People reset passwords all the time. Sometimes we forget that we requested one. Sometimes an app logs us out. Sometimes we get legitimate security alerts when someone attempts to access an account.
So seeing Walmart + Order + Password mashed together in a subject line can create just enough confusion to make someone investigate.
And investigating might mean opening one of those attachments.
That's where I stop.
Two Attachments? I'm Good.
One attachment ends in .htm.
That's an HTML file—a webpage packaged as a file.
Opening an unexpected HTML attachment can potentially take someone into a fake login or other deceptive content designed to look legitimate. I'm not opening it to find out what this particular one does.
The second attachment appears to be an invoice.
I'm not opening that one either, thank you.
If Walmart needs me to take action on my account, I don't need an attachment from solodax.com to proceed.
I can independently open the Walmart app or type the legitimate Walmart website into my browser and check my account there.
The suspicious email doesn't give me a roadmap for how to investigate it.
This Is Why I Keep Sharing These
Scams don't always look like:
“HELLO DEAR SIR, YOU HAVE WON $47 MILLION.”
Sometimes they're messy.
Sometimes they're polished.
Sometimes they use familiar company names.
And sometimes all they need is one word—like password—to make me stop and wonder:
“Wait...did I do something?”
I did the double take.
Then I looked at the sender.
Then I looked at the attachments.
And I remembered:
I didn't request a password reset.
Mystery solved.
No attachments opened.
No links clicked.
No passwords entered.
And, for once, Bill apparently had the day off.
Send Me Your Scam Attempts
I'm still documenting the different tactics that land in my inbox because seeing real examples can make the next suspicious message easier to recognize.
If you've received an unusual scam email, phishing attempt, fake invoice, suspicious password-reset message, or another creative attempt to get your information, send me a screenshot and your experience:
First, remove or cover any sensitive personal, financial, or account information.
The scammers changed tactics.
So I'll keep paying attention.
If I didn't request a password reset, I won’t open an attachment to understand why someone believes I did.
The Facebook Experiment Continues: Amy Messaged Me, and Now I Have More Questions
Well, that didn't take long.
In my last update, I shared that I finally accepted the mysterious friend request from Amy Ford on Facebook.
I didn't know Amy. We had one mutual friend. Her profile caught my attention for several reasons, including a rather impressive collection of jobs. Still, none of that proved anything was wrong with the account.
So curiosity won.
I accepted.
And shortly afterward, Amy messaged me.
“I Added You Out of Curiosity”
Amy opened with:
“Hello, Niel. I'm glad we have established a connection here.”
I asked the obvious question:
“Hello, Amy, have we met?”
Nope.
She said Facebook recommended me and that she added me “out of curiosity.”
That made me laugh because curiosity was exactly why I accepted her.
I told her:
“I accepted out of curiosity.”
Her response?
“I sent the friend request just out of curiosity, hahaha.”
Well, there we go.
Two strangers brought together by the powerful matchmaking algorithm of The Facebook—and apparently mutual curiosity.
What could go wrong?
Then Came the Questions
Amy asked where I was from.
I told her I was originally from New York and mentioned that I saw she was from Korea.
She explained that she's originally from Seoul, South Korea, has lived in New York for five years, and then asked whether I still lived in New York.
I said I didn't.
She asked where I live now.
I didn't answer.
Instead, I asked what brought her to New York.
According to Amy, she moved there after leaving a failed marriage because New York offered better career opportunities.
I asked how long she had been married and what she did for work.
She said the marriage lasted three years and told me:
“I work in real estate and run a TikTok agent shop.”
Now I had another question.
What's a TikTok Agent Shop?
Remember, her Facebook profile already showed several professional roles, including investor, real estate business owner, and an HR-related position.
Now I had a TikTok agent shop to add to the résumé.
So I asked what a TikTok agent shop does.
Her explanation was:
“You can understand it as providing goods specifically for retailers to make profits.”
Okay.
I still don’t entirely understand it.
Then the conversation turned back toward me.
She asked what I do for work.
I told her:
“I'm currently not working, kinda retired early.”
Her response caught my attention:
“Alright, you've got an enviable life ahead of schedule.”
Then she asked again:
“Do you still live in New York?”
I answered:
“I do not.”
And that was it.
No location.
Amy joked that my location was apparently a secret.
For now, it is.
Then the Conversation Took an Unexpected Turn
Amy said she had enjoyed talking with me but needed to get ready for some work meetings. We exchanged pleasantries, and the conversation ended.
Or so I thought.
Later that night, at 10:17 p.m., another message arrived:
“Are you a person with a disability?”
That's certainly a conversation starter.
I answered:
“Several.”
She asked what challenges I deal with.
I told her about my amputation and kidney failure.
And that's where the screenshots currently leave us.
So, Is This a Scam?
I still don't know.
And I think that's important to say.
Nothing in this conversation proves that Amy is running a scam or that the person behind the account isn't who they claim to be.
At the same time, I'm paying attention.
An unsolicited friend request from a stranger.
Very few Facebook friends.
Several different professional descriptions.
Questions about where I live.
Questions about my employment.
A business involving retailers making profits.
And now questions about my disabilities.
Each one can have a perfectly innocent explanation.
Taken together, they're enough for me to continue being cautious.
I'm Also Curious About Where This Goes
This has become a little social-media experiment for me.
I'm not sending money.
I'm not providing financial information.
I'm not sharing passwords or account information.
I'm not clicking mystery links.
And I'm not rushing to provide personal details simply because someone asks.
I'm having a conversation.
If Amy is simply a friendly person in New York who found my profile through Facebook recommendations, that may be all this ever is.
If the conversation eventually turns into:
“Niel, have you ever considered cryptocurrency?”
Well...
I may have another blog post to write.
For now, The Facebook Experiment continues.
And I have a feeling this story isn't finished yet.
Did It: I Accepted the Mystery Friend Request on The Facebook
Well, I did it.
Against the little voice in my head saying, “Niel, you know how these stories usually end,” I clicked Confirm.
Amy Ford and I are now officially friends on The Facebook.
I feel like I should update my relationship status.
For anyone who missed the first chapter, a few days ago I received a friend request from Amy. I had no clue who she was. We had one mutual friend, and her profile raised enough questions that I wrote an entire blog post asking whether I should accept the request or hit Delete.
Curiosity won.
Welcome to the experiment.
First Discovery: Amy Is Still Posting
After accepting the request, I noticed a new post from today about the Broadway Flea Market & Grand Auction in New York.
There are pictures of Broadway memorabilia, Playbills, auction items, and the theater.
Okay.
That's certainly more interesting than immediately receiving:
“Hello dear, how are you today?”
Followed seven minutes later by an incredible cryptocurrency opportunity.
So far, so good.
But accepting the request also allowed me to see more of the profile.
And that's when I noticed Amy's résumé.
Amy Is Apparently Very Busy
According to the profile, Amy has not one, not two, but three different employers listed.
She is apparently:
Investor — Gilpin Lodge
Owner — The Lighter Side of Real Estate
HR Specialist — Samsung Global
That's quite a career portfolio.
Investor.
Business owner.
Human Resources professional.
I'm tired just reading it.
And remember, the profile currently shows only 16 Facebook friends.
It seems Amy may have more jobs than friends on The Facebook.
I'm not judging.
Maybe she's simply very career-focused.
Maybe she's an extraordinarily successful multitasker.
Maybe LinkedIn wasn't challenging enough.
Then There's the Rest of the Profile
The information visible to me now says she:
Lives in New York, New York.
Is from Seoul, Korea.
Is single.
Went to the University of Leeds.
Works—or has worked—in those three very different roles.
And she's posting about New York attractions and events.
Does any one of those things prove anything suspicious?
No.
That's important.
People move. People change careers. People have multiple jobs. People don't always maintain large Facebook friend lists. People use English names. And successful people can certainly have unusual career paths.
But taken together with an unsolicited friend request from someone I don't know?
My eyebrow remains raised.
Possibly both eyebrows.
Now We Wait
I'm not messaging Amy.
I'm not asking for a phone number.
I'm not moving the conversation to WhatsApp or Telegram.
I'm certainly not discussing investments.
And if Amy happens to have an uncle who is a cryptocurrency genius who can turn $500 into $47,000 by Thursday...
I'm probably going to pass.
For now, I'm simply curious about what happens next.
Maybe nothing happens.
Maybe Amy is a perfectly real person who happened to send me a random friend request.
Maybe I'll eventually discover why she wanted to connect with me.
Or maybe the next chapter writes itself.
Either way, I clicked Confirm.
The experiment has officially begun.
And Amy, if you're real and eventually stumble across these posts:
Hi.
Please don't take it personally.
My inbox has trained me to be suspicious of everybody.
Especially people with more jobs than Facebook friends.
$500 Down for Everything? This TikTok Car Account Raised More Questions the Longer I Watched
Apparently, TikTok still thinks I need a car.
At this point, I'm starting to think the algorithm wants me to open a dealership.
This time I came across an account calling itself “Michael Werve Cars Near You” with more than 4,300 followers and 15,000 likes shown on the profile when I took the screenshot.
The bio promises:
“Same day shipping”
“Affordable cars under $10K”
“Quick approvals”
And, of course, the magic number that keeps appearing in these TikTok vehicle posts:
$500 DOWN
But the more videos I watched, the more questions I had.
🚩 This Isn't Just a Few Cheap Used Cars
The account shows a surprisingly broad assortment of vehicles.
There's a 2016 Audi A6 advertised with only $500 down.
There's a 2021 Ford Escape with $1,000 down.
There's a 2025 Toyota Corolla with only $500 down.
There's a woman pictured with a 2018 Nissan Altima with 73,000 miles, accompanied by text saying:
“Congratulations 🎈🎊 just $800 down.”
Then we jump to something much more interesting:
“Offloading the New Cayenne GTS coupe!”
The video shows a Porsche being unloaded from a vehicle transporter and says:
“Same-day delivery with just a $500 down payment.”
That's quite a range of inventory.
Entry-level cars.
Used luxury cars.
SUVs.
Nearly new Toyotas.
And a Porsche Cayenne GTS Coupe.
All apparently tied together by remarkably small down payments.
🚩 Then There's the Camaro
One video caught my attention because the vehicle is sitting directly in front of a dealership.
The TikTok overlay says:
Price: $6,000
Down payment: $800
Monthly payment: $250
All credit situations approved
But look behind the Camaro.
The dealership sign says Paisanos Auto.
That gave me something I could actually verify.
Paisanos Auto is a real used-car dealership at 2212 Wirt Road in Houston, Texas. Its own website confirms that address and says it has operated for more than 20 years. Paisano's Auto Sales
Here's where it gets much more interesting.
I found actual listings associated with Paisanos for Camaro 2SS models. One listing for a 2020 Camaro 2SS didn't advertise a $3,500 purchase price—it advertised $3,500 DOWN. Another 2023 Camaro listing similarly advertised $3,000 DOWN. OfferUp
Paisanos' own website makes the distinction even clearer. Its disclaimer says that prices advertised on Facebook Marketplace may represent the down payment, while the actual cash price and financing terms are separate. Paisano's Auto Sales
So a photograph or video of a real vehicle at a real dealership does not establish that the TikTok account showing it is authorized to sell that vehicle for the price it puts on the screen.
That's a very important distinction.
🚩 Then I Started Paying Attention to the Locations
This was another thing that bothered me.
I watched several of the account's shorts.
The scenery changes.
Dramatically.
One vehicle is clearly sitting at Paisanos Auto in Houston.
Another shows what looks like a transporter unloading a Porsche on a city street.
Another vehicle is photographed in a parking lot surrounded by brick, residential-looking buildings.
Another Corolla appears in a completely different retail parking lot at night.
Different backgrounds by themselves don't prove anything. A legitimate broker, multi-location dealership or delivery operation could certainly photograph vehicles in different places.
But when an account presents a stream of vehicles as available for extraordinarily small down payments, those changing locations become another reason I'd want to know:
Where is the actual dealership?
Who owns these vehicles?
Where can I physically inspect them?
What dealer license is the seller operating under?
What's the VIN?
And why do these videos appear to come from so many different places?
🚩 The Porsche Video Looks Like Transportation—not a Sale
The Cayenne video particularly caught my attention.
The text says:
“Offloading the New Cayenne GTS coupe!”
And:
“Same day delivery just a $500 down payment.”
But what I'm looking at is a Porsche coming off what appears to be a commercial vehicle transporter.
That establishes that somebody was transporting a Porsche.
It does not establish that the TikTok account owns that Porsche, sold that Porsche or can deliver that Porsche to me for $500 down.
That's the recurring problem with social-media vehicle content:
A real car doesn't automatically mean a real offer.
A real transporter doesn't prove a sale.
A real dealership in the background doesn't prove affiliation.
A real customer photograph doesn't independently establish the terms of a transaction.
Pictures prove what's visible in the pictures.
Not necessarily the story wrapped around them.
💰 Let's Talk About the Actual Values
This is where the economics become difficult to ignore.
Take the 2025 Toyota Corolla shown with “Only $500 down.”
Kelley Blue Book currently puts the Fair Purchase Price of a 2025 Corolla at roughly $21,400 to $26,600, depending on trim, with original MSRP ranging from $23,460 to $29,175. Kbb.com
Then there's the 2021 Ford Escape.
KBB currently shows Fair Purchase Prices ranging from about $13,900 to $18,050, depending on configuration. Even KBB trade-in estimates run roughly $7,550 to $12,200. Kbb.com
The 2016 Audi A6?
KBB's current Fair Purchase Price ranges from approximately $11,350 to $14,600, depending on trim. Kbb.com
And the 2018 Nissan Altima supposedly purchased with $800 down?
KBB currently puts dealer Fair Purchase Prices around $10,200 to $11,750, depending on trim, before adjusting for the specific 73,000-mile vehicle shown in the post. Kbb.com
None of this means a legitimate dealer can't finance a vehicle with a small down payment.
They absolutely can.
But a down payment isn't a purchase price.
That's precisely why the rest of the financing information matters.
📊 What About MMR Wholesale?
I also wanted to compare these offers with MMR—Manheim Market Report- because retail KBB values only tell part of the story.
MMR is a wholesale benchmark based on actual Manheim auction transactions. Manheim says its database draws from millions of auction transactions across the United States and Canada. Manheim
Here's the problem with giving one blanket “MMR price”: MMR is vehicle-specific. Mileage, trim, condition, region and the date of the transaction matter. Without the VINs and exact specifications of these TikTok vehicles—and direct MMR access—I don't want to manufacture wholesale numbers and pretend they're precise.
But we can find real-world examples.
A 2018 Nissan Altima 2.5 S with about 150,000 miles recently showed an MMR median of $4,275, with a range of roughly $3,225–$5,350. AUTOMAX
For 2021 Ford Escape examples, recent Manheim-linked data varies dramatically with mileage and condition. One high-mileage SE showed an MMR median of $3,425, while another better-condition example showed $8,225. A recent SEL example showed $6,000. AUTOMAX
That's exactly why VIN, mileage and condition matter.
And it's also why a vague “$500 down” tells a consumer almost nothing about what they're actually agreeing to pay.
🚩 The Math Is What Matters
Let's say somebody genuinely finances a $20,000 vehicle with $500 down.
They haven't bought a $500 car.
They've put $500 toward a transaction that could ultimately cost tens of thousands of dollars after the remaining principal, interest, taxes, registration, documentation fees, and other charges.
That's why I want to know:
What's the actual selling price?
What's the APR?
What's the loan term?
What's the monthly payment?
What's the total of payments?
Who's the lender?
Are there additional dealer fees?
What credit qualifications apply?
Is the $500 refundable?
And—before we get to any of that—
Does this account actually own or represent the vehicle?
Those aren't annoying questions.
Those are $20,000 questions.
🚩 Followers Don't Equal Verification
The account had thousands of followers when I looked at it.
That can create credibility.
“Four thousand people follow this person. It must be legitimate.”
No.
Follower counts aren't dealer licenses.
Likes aren't vehicle titles.
Views aren't VINs.
A polished TikTok profile isn't proof that the person behind it owns the vehicles appearing in the videos.
And a link in a bio doesn't become trustworthy simply because thousands of people follow the account.
🏡 Don't Be Passive—Be a Good Neighbor
This is the part I keep coming back to.
Someone desperately needs transportation.
They've been rejected for financing.
Their credit isn't great.
They need to get to work Monday.
Then TikTok serves them:
2025 COROLLA — $500 DOWN
or:
SAME DAY DELIVERY — $500 DOWN
Suddenly, something that seemed financially impossible looks possible.
That's exactly when another person asking questions can make a difference.
If you see a friend or family member getting excited about an offer like this, don't mock them.
Help them verify it.
Ask for the VIN.
Look up the dealership independently.
Call the dealership using the phone number on its official website, not a number supplied in a TikTok DM.
Check the vehicle's value.
Get the complete financing terms.
And don't send somebody a deposit simply because they say they can deliver the vehicle today.
The real Paisanos Auto, for example, has an independently verifiable Houston address, website, and phone number. Paisano's Auto Sales. That's the kind of information I'd use to verify whether someone posting a vehicle photographed on its property actually represents the dealership.
Because there is one sentence I keep repeating throughout this experiment:
A real car does not automatically make the offer real.
And neither do 4,000 followers.
Before sending $500, $800—or one dollar—verify who's actually on the other side of the screen.
Follow along at NielFlamm.com/blog for more questionable vehicle offers, suspicious emails, recruiting scams and whatever TikTok decides I need to investigate next.
Another $399.99 Subscription? Apparently Geek Squad Is Throwing a Facebook Event
I have another expensive subscription I didn’t know about.
And once again, the scammers were thoughtful enough to invite me to a Facebook event to celebrate it.
This email arrived with the subject:
“Jordan Ramirez invited you to Geek Squad Order confirmed: INV#445016.Amount:$399.99”
According to the invitation, I supposedly paid $399.99 for a Geek Squad PC Protection Plan.
There's just one minor problem.
I didn't.
And if this looks familiar, it should.
🚩 Haven't We Seen This Movie Before?
Just recently, I received another Facebook event invitation claiming that $498.99 had been paid for a subscription through my PayPal account.
That one came from “Agnes V. Burden.”
This time we have Jordan Ramirez, Geek Squad, and $399.99.
Different person.
Different company.
Different dollar amount.
But remarkably similar script.
The invitation claims:
“Bill has paid $399.99 for a subscription using your PayPal account from an unknown seller IP.”
Wait.
Bill is back?!
Apparently Bill has access to my imaginary PayPal account and is having quite a shopping spree.
It would be helpful to sit Bill down and discuss boundaries.
🚩 Facebook Is Literally Warning Me
One of my favorite parts is that the warning is sitting right there at the top of the message:
“Meta did not send this event invitation. Please be cautious when clicking on links or providing personal information.”
Thank you, Meta.
Message received.
That's an important distinction because the sender shown in the email is:
Jordan Ramirez <notification@facebookmail.com>
Someone might see the Facebook-related email address and assume the underlying message must be trustworthy.
But the screenshot itself explains what's happening.
Jordan Ramirez invited me to an event.
The suspicious content is contained inside that event invitation.
A legitimate platform delivering a notification doesn't automatically make the content created by another user legitimate.
🎉 What Time Does My Geek Squad Party Start?
The invitation gives me the traditional Facebook choices:
Going
Maybe
Can't Go
Let's see.
Am I going to my imaginary $399.99 Geek Squad subscription celebration?
I'm leaning toward:
Can't Go.
I have plans that evening.
Specifically, not calling the phone number in this message.
🚩 And There It Is: The Phone Number
The message says that if I don't recognize the purchase, I should contact a:
“Resolution Center”
and conveniently provides a phone number.
That's the part that deserves attention.
The scary $399.99 charge gets your attention.
Geek Squad provides a recognizable brand.
PayPal adds a financial component.
And the phone number provides an immediate way to “fix” the problem.
That's exactly when I'd stop.
If I genuinely thought Geek Squad charged me $399.99, I wouldn't call the number supplied in a suspicious Facebook event.
I'd check my PayPal, credit card, and bank accounts independently.
Then, if necessary, I'd independently find the legitimate contact information for Geek Squad or the financial institution involved.
The suspicious message doesn't provide both the problem and the solution.
🚩 “Pay_Pal” Makes Another Appearance
This is another detail I noticed in both messages.
Not PayPal.
Pay_Pal.
The previous $498.99 subscription invitation used essentially the same wording.
Now this one does too.
So let's compare.
Previous message:
$498.99 subscription.
Facebook event invitation.
Claim involving “Pay_Pal.”
Unknown seller IP.
Phone number to call.
Current message:
$399.99 Geek Squad subscription.
Facebook event invitation.
Claim involving “PayPal.”
Unknown seller IP.
Phone number to call.
That's quite a coincidence.
Or perhaps we're looking at variations of the same social-engineering template.
🧠 The Scam Isn't Really About Geek Squad
That's an important point.
The recognizable company name makes the story believable.
Today it's Geek Squad.
Another day it could be PayPal, Norton, McAfee, Amazon, Microsoft, or another familiar brand.
The psychology is what matters.
You see:
$399.99
Your immediate reaction might be:
WHAT DID I BUY?!
Then you see:
“If you do not recognize this purchase, please contact...”
Perfect!
There's a phone number!
And before you've checked whether the transaction actually exists, you're talking to whoever is on the other end.
That's why urgency is so effective.
The message doesn't necessarily need to survive careful analysis.
It just needs to get you to act before you do careful analysis.
🚩 Don't Call the Number to Find Out Whether the Number Is Legitimate
This seems obvious when you say it out loud, but it's worth repeating.
If a suspicious message tells you that something terrible happened and then provides a phone number to fix it:
Don't use the suspicious message to verify the suspicious message.
Go around it.
Open your actual PayPal app.
Check your bank.
Check your credit card.
Go independently to the company's official website.
If there's no $399.99 transaction anywhere, that's important information.
And if there is an unauthorized transaction, contact the financial institution using independently verified information—not the number supplied in the questionable message.
🏡 Don't Be Passive. Be a Good Neighbor.
This is why I keep sharing these.
I recognize the pattern because I've been documenting them.
Someone else might not.
Someone might see Geek Squad, recognize the name, and panic.
Someone might think their spouse or child bought something.
Someone might worry that their PayPal account has been hacked.
And someone might immediately call.
If you see one of these, don't just delete it and move on.
Warn somebody.
Show your parents.
Show your neighbors.
Show the person who always calls you when something weird appears on their computer.
Report suspicious content through the appropriate platform.
Sometimes being a good neighbor is simply saying:
“Don't call that number. Let's check your actual account first.”
Jordan, I'm Going to Have to Decline
So thank you, Jordan Ramirez, for inviting me to the celebration of my imaginary $399.99 Geek Squad subscription.
Unfortunately:
Going? Nope.
Maybe? Still nope.
Can't Go? That's the one.
And apparently I need to have a serious conversation with Bill, because he keeps buying subscriptions with my imaginary PayPal account.
Follow along at NielFlamm.com/blog for more scam emails, suspicious recruiters, questionable vehicle offers, and whatever strange invitation lands in my inbox next.