The Scam Emails Are Getting Lazy: “Thanks for Your Order”… What Order?
Apparently, my imaginary shopping spree continues.
After Bitcoin purchases, mystery subscriptions, Geek Squad renewals, Facebook event invitations, and even a watch repair I never requested, the scammers have apparently decided they were working too hard.
Why bother creating an elaborate fake invoice when you can simply send:
“Thank You for Your Order.”
What order?
Excellent question.
Two Days, Two Mystery Orders
Yesterday, I received an email from “Manthan Williams” with the subject:
“Re: Thank You for Your Order 1KJBO6SYBRM6TJBQLEDV”
There was an attachment.
And almost nothing else.
Today, “Elizabeth Lewis” joined the party with:
“Thank You for Your Order 0RQKQA6198JOMD57P”
Another random order number.
Another attachment.
Another email with practically no explanation.
Apparently, customer service has embraced minimalism.
At Least Tell Me What I Bought
This is what makes these emails almost funny.
No recognizable retailer.
No product description.
No price prominently displayed.
No useful explanation of what I supposedly ordered.
Just:
Thank you for your order. Here's an attachment.
Oh, sure. Let me immediately open a mystery attachment from a random Gmail account to discover what I supposedly purchased.
What could possibly go wrong?
I'm not opening it.
That's an important point. I don't need to open an unsolicited attachment to investigate a purchase I don't recognize.
If I actually ordered something, I can check the retailer or payment account independently.
The Random Gmail Addresses Aren't Helping
One email claims to be from Elizabeth Lewis but arrives from a seemingly unrelated Gmail address.
The other claims to be from Manthan Williams and also comes from an unrelated Gmail address.
Could legitimate people use Gmail?
Of course.
But when an unexpected “order” email arrives from a random Gmail account, provides virtually no information, and wants me to open an attachment to learn more, my curiosity isn't winning this battle.
Delete beats double-click.
The Attachment Is the Bait
These messages use a slightly different approach than the fake PayPal and Facebook invitation scams I've been documenting.
Those messages tried to scare me with a large dollar amount and get me to call a telephone number.
These appear designed to create curiosity:
What did I order?
How much did they charge me?
Did somebody use my credit card?
What's in that attachment?
And that's exactly why I'm leaving the attachment alone.
Fear can make people click.
But so can curiosity.
My Imaginary Self Has Quite the Lifestyle
According to my inbox, imaginary Niel has been busy.
Bitcoin.
Geek Squad.
Mystery subscriptions.
Watch repairs.
More mystery subscriptions.
And now two mystery orders in two days.
The only thing missing is knowing what I actually bought.
Come on, scammers.
If you're going to invent purchases for me, at least make them interesting.
Tell me I bought a Ferrari.
A beachfront condo.
A private jet.
Maybe a lifetime supply of Coke Zero.
Give me something worth accidentally ordering.
Instead, I get:
ORDER 0RQKQA6198JOMD57P.
I'm underwhelmed.
Have a Scam Email? Send It to Me
I'm still collecting these because the tactics keep changing, even though the objective remains the same: get us to react before we stop and think.
If you've received a suspicious email, fake invoice, mystery order, phishing text, social media scam, or another creative attempt to separate you from your money, send it my way:
Tell me what happened and send a screenshot if you have one. Please remove or cover sensitive personal or financial information before sending anything.
Maybe I'll feature it in a future post.
Until then, Elizabeth and Manthan:
Thanks for thanking me for my orders.
Whatever they are.
They’re Back! Apparently I Paid $450 for Another Mystery Subscription
It’s been a little while, but apparently my scam social calendar is back in action.
For those who haven’t been following along, I’ve received some interesting emails over the past few months. According to my inbox, I’ve bought Bitcoin, renewed Geek Squad protection—more than once—and even had a watch repaired that I never sent anywhere.
Today, we return to an old favorite:
The Facebook Event Invitation Scam.
This time, “Brooke Alexandra” has invited me to an exciting event called:
“Your Subscription Payment of $450 was Paid. Your Order ID#663028”
Well, Brooke, thank you for the invitation.
Unfortunately, I have absolutely no idea what I supposedly subscribed to.
Going, Maybe, or Can’t Go?
My favorite part of these scams is still Facebook’s event format.
I’ve supposedly just discovered an unauthorized $450 PayPal transaction, and immediately underneath this alarming news, I’m asked:
Tell them if you can make it.
My choices?
Going.
Maybe.
Can’t Go.
Decisions, decisions.
I’m going with Can’t Go.
Not because I have another commitment. I try not to attend celebrations for fraudulent purchases.
Meet Bill, My Apparently Very Generous Alter Ego
The description gets even better.
It says:
“Bill has paid $450 for a subscription using your Pay_Pal account from an unknown seller IP.”
Who is Bill?
I have no idea.
Bill, please stop spending my imaginary money.
The message then provides a phone number and tells me to call if I don’t recognize the seller.
And then comes my favorite instruction:
“Please do not copy the number, type it manually to call.”
Oh, absolutely.
I'm not comfortable trusting a financial alert that asks me to type a phone number manually.
That’s practically the international symbol for:
“Nothing suspicious happening here!”
Meta Is Literally Warning Me
As with the previous versions, there’s an important message sitting prominently near the top:
“Warning: This event invitation was not sent by Meta. Please be cautious when clicking on links or providing personal information.”
That deserves more attention than the scary $450 headline.
The formula hasn’t changed much:
Create an alarming transaction.
Use a recognizable brand name like PayPal.
Please let me know if my account may have been compromised.
Give me a telephone number.
Please create urgency so I call before I stop to think.
And package everything inside a Facebook event invitation so the resulting notification looks more familiar.
The Scam Has One Big Problem
If my PayPal account really has a mysterious $450 transaction, I don’t need Brooke Alexandra—or Bill—to help me investigate it.
I can go directly to PayPal through its official app or website and check my account.
The same rule applies to suspicious emails claiming to come from a bank, credit card company, retailer, Geek Squad, or practically anyone else.
Don’t let the suspicious message tell you how to verify the suspicious message.
Verify it independently.
And don’t call a mystery number just because someone put “PayPal” next to it.
My Imaginary Spending Spree Continues
So let’s add another purchase to the growing list.
Bitcoin? ✔️
Mystery subscriptions? ✔️
Geek Squad? ✔️
Watch repair? ✔️
Another mystery $450 subscription? ✔️
At this point, the person living inside my spam folder has a considerably more exciting financial life than I do.
I’m just disappointed that after all this imaginary spending, nobody has emailed me to say I’ve purchased a beachfront condo in Thailand.
Scammers, if you’re reading this, at least make the next fake purchase interesting.
Have a Scam Story? Send It My Way
Now I want to hear what’s landing in your inbox.
If you’ve received a scam email, suspicious text, social media message, fake invoice, questionable refund notice, or something that made you think, “There is no way this is legitimate,” send it to me.
Please send me your screenshots and let me know what happened. I may feature some of them in future posts as we look at the creative—and sometimes hilariously bad—ways scammers try to separate people from their money.
Please remove or cover passwords, account numbers, addresses, phone numbers, or other sensitive personal information before sending screenshots.
Maybe it’s time to turn my scam collection into our scam collection.
And until then, Brooke...
Can’t Go.
Another TikTok “Auction Car” Deal: A $60,000 Hellcat for $4,999? Here We Go Again
Apparently TikTok has decided I need another car.
Actually, based on what keeps showing up in my feed, TikTok apparently thinks I need an entire dealership.
After documenting accounts advertising $4,000 Scat Packs, $7,000 Camrys, $10,000 BMW M3S, and other remarkably inexpensive vehicles, another account landed in my “For You” feed.
This one calls itself:
Auction Cars For Sale — @auctioncars35
And we've got another Hellcat.
According to the video:
2021 Dodge Charger SRT Hellcat Redeye Widebody
Price: $4,999
Down payment: $499
Monthly payment: $299
Come get it right away!
Well, hold on.
🚩 A $4,999 Hellcat Redeye?
This isn't just an inexpensive used Dodge Charger.
The post specifically identifies it as a 2021 Dodge Charger SRT Hellcat Redeye Widebody.
Kelley Blue Book currently puts the Fair Purchase Price for that model around $60,500, with estimated private-party values ranging roughly from $52,000 to $60,000, depending on condition. KBB also notes that mileage, condition, location, and equipment can significantly affect an individual vehicle's value. Kelley Blue Book
The TikTok price?
$4,999
That's roughly 92% below KBB's $60,500 Fair Purchase Price.
Now, could an extraordinarily cheap Hellcat exist?
Absolutely.
It could have major damage. It could have mechanical problems. It could have a branded title. There could be circumstances we can't see from a TikTok video.
But if you're asking me to believe a vehicle worth tens of thousands of dollars is available for less than $5,000, I need an explanation.
And documentation.
Lots of documentation.
💰 $499 Down, $299 a Month... For How Long?
Then we have the financing.
Price: $4,999
Down payment: $499
Monthly payment: $299
Okay.
If $4,999 is truly the purchase price, subtracting the $499 down payment leaves $4,500.
At $299 per month, ignoring interest, taxes, and every other fee, that would pay off the remaining balance in only about 15 months.
But where are the complete financing terms?
What's the APR?
What's the loan term?
Who's the lender?
What are the taxes and fees?
What credit qualifications apply?
Is $4,999 actually the cash selling price?
Those details matter considerably more than the giant $499 DOWN floating across the TikTok video.
👀 Then I Looked at the Profile
The account had 809 followers and 12,600 likes when I took the screenshot.
Its profile says:
“Get your vehicles at auction prices”
“Clean title/paperwork ✅”
“Financing ✅”
And then:
WhatsApp: +1 (672)-285-4522
There's that familiar move to WhatsApp again.
WhatsApp itself isn't evidence of a scam. Legitimate businesses use it every day.
But if I'm buying a $60,000-class performance car, I want a little more than a TikTok profile and a WhatsApp number.
Where is the business?
What's the legal company name?
What's the physical address?
What's the dealer license number?
What auction is supplying these vehicles?
What's the VIN?
Who's providing the financing?
Can I see the title?
Can I have an independent mechanic inspect the car?
Those questions aren't unreasonable.
They're called buying a car.
😂 Apparently Hellcats Are Having a Clearance Sale
Then I looked at the rest of the profile.
This isn't a one-car phenomenon.
One pinned video appears to advertise a vehicle for:
$7,900 — $500 down
Another:
$10,000 — $600 down
And another pinned video says:
“2022 Dodge Charger SRT Hellcat $7000”
Seven thousand dollars.
For another Hellcat.
Elsewhere, I can see vehicles advertised at:
$6,000 with $600 down
$9,800 with $700 down
$9,000 with $1,000 down
$5,000 with $500 down
Once again, we're seeing the same basic formula I've been documenting across multiple TikTok accounts:
Desirable vehicle.
Extraordinarily low advertised price.
Small down payment.
Financing.
WhatsApp.
Act now.
Different account.
Same questions.
📊 For Perspective: Even Ordinary Chargers Cost More
KBB's current national averages illustrate just how unusual these numbers are.
A regular 2021 Charger SXT has a Fair Purchase Price around $18,500. A Scat Pack is around $32,300, a Scat Pack Widebody around $38,000, and a Hellcat Redeye Widebody around $62,300 on KBB's broader 2021 Charger pricing page. Kelley Blue Book
So the $4,999 TikTok asking price isn't merely inexpensive compared with another Redeye.
It's dramatically below KBB's current Fair Purchase Price for even the least expensive 2021 Charger trim.
That doesn't independently prove anything about this particular vehicle.
It does give me an excellent reason to investigate before reaching for my wallet.
🏷️ But They're “Auction Cars”
That's presumably supposed to explain the prices.
Auctions absolutely can produce vehicles below retail value.
I've discussed the Manheim Market Report (MMR) in previous posts because wholesale value and retail value aren't the same thing.
Dealers buy at wholesale and try to sell at retail. Condition, mileage, title history, location, demand, and vehicle configuration all matter.
But “auction price” isn't a magic phrase that makes market economics disappear.
If a supposedly clean-title Hellcat has a retail value around $60,000 and someone is selling it for $4,999, I'd still like to know:
What did the seller pay for it?
Which auction did it come from?
What's the VIN?
What's the title status?
What's wrong with it?
Why is it being sold for a fraction of its market value?
A legitimate explanation can be checked.
🚗 And Yes, That's a Real Car in the Video
We've encountered this issue repeatedly in this series.
A man sits inside a Charger.
We can see the interior.
There's another vehicle outside.
It looks like a real dealership or automotive environment.
That's visually persuasive.
But here's the line I'm going to keep repeating:
A real car doesn't automatically make the offer real.
A TikTok account showing footage of an actual automobile doesn't, by itself, establish that the account owns the vehicle, has authority to sell it, or can deliver it under the advertised terms.
Videos can be reposted.
Dealer footage can be reused.
Auction footage can be copied.
Customer-delivery videos can be repurposed.
I'm not saying that's necessarily what happened here. I haven't established where this particular footage originated.
I'm saying the video itself isn't proof of ownership.
🚩 Followers and Views Aren't Verification Either
One of this account's pinned videos shows more than 300,000 views.
Another has more than 100,000.
That creates powerful social proof.
If 300,000 people watched it, it may feel legitimate.
If hundreds of people liked it, it may feel legitimate.
If other people are commenting that they're interested, maybe it feels legitimate.
But we've learned this lesson already:
Followers aren't a dealer license.
Likes aren't a vehicle title.
Views aren't a VIN.
And 300,000 views don't transform a $60,000 vehicle into a $4,999 vehicle.
🧮 Show Me the Economics
This remains one of my favorite tests.
Forget TikTok for a moment.
Forget the music.
Forget the guy sitting inside the car.
Forget the giant $499 DOWN text.
Explain the transaction economically.
If a dealer can legitimately acquire a clean-title 2021 Hellcat Redeye Widebody cheaply enough to sell it for $4,999 and make money, I want to understand how.
Maybe there's an explanation.
Great.
Show me.
Give me the VIN.
Show me the title.
Tell me the auction.
Give me the physical location.
Show me the purchase agreement.
Let me independently verify the dealership.
Let me arrange an independent inspection.
Give me the financing disclosures.
Those things interest me far more than a TikTok follower count.
🚨 Don't Let the Deposit Become the Decision
This is where these advertisements concern me most.
The headline isn't:
“Please conduct a comprehensive examination of this vehicle's ownership, title history, and financing.”
It's:
$499 DOWN
That's a psychologically manageable number.
Someone who can't afford a $60,000 Hellcat might be able to find $499.
And once someone sends that first $499, the psychology changes.
They've committed.
That's why verification needs to happen before money changes hands.
The FTC has repeatedly warned consumers about online vehicle-related scams and emphasizes caution when someone online asks you to send money in transactions that can't be independently verified. Consumer Advice
🏡 Be a Good Neighbor
This is also why I keep posting these.
Someone looking at this advertisement might not see what I see.
They might see:
2021 Hellcat Redeye.
$4,999.
$499 down.
$299 a month.
And think:
“I can actually afford my dream car.”
Don't make fun of that person.
Help them.
Before they send $499, ask for 15 minutes.
Check the VIN.
Check KBB.
Check the title.
Find the business independently.
Verify the dealer license.
Call a telephone number obtained independently.
Ask for the physical address.
Arrange an inspection.
Read the financing agreement.
And if the seller starts creating urgency because somebody else is supposedly about to buy the car?
Let the other imaginary customer have it.
Different Account. Same Playbook?
That's what I'm trying to document.
I've now encountered multiple social-media accounts advertising remarkably inexpensive cars with tiny down payments.
The names change.
The cars change.
The phone numbers change.
The prices change.
But I keep seeing familiar ingredients.
Unusually cheap vehicles.
Tiny deposits.
Social-media storefronts.
Private messaging.
WhatsApp.
Financing claims.
Shipping or delivery.
And vehicles priced far below ordinary retail values.
Does that automatically prove this particular TikTok account is fraudulent?
No.
But $4,999 for a vehicle KBB values at around $60,000 is more than enough reason for me to start asking questions. Kelley Blue Book
And judging by my recent experiences, I seem to be getting pretty good at making TikTok car sellers uncomfortable with one particularly difficult question:
What's the address?
Follow the continuing investigation at NielFlamm.com/blog.
Update: The “Totally Legitimate” TikTok Car Seller Blocked Me
Well, that escalated quickly.
I've been documenting the TikTok account landmark75, which describes itself as “Landmark Auto” and has been advertising vehicles at prices that raised plenty of questions—including a supposed 2021 Dodge Scat Pack with 45,000 miles for $4,000 with $500 down.
Then they contacted me.
At 2:45 in the morning.
They assured me:
“have no intentions of scamming you or anybody here I'm just on here to sell cars to make a living that's all.”
Great.
So I started asking questions.
Apparently, that was the problem.
🚗 I Asked Where the Dealership Was Located
This shouldn't have been difficult.
They told me:
Savannah, Georgia.
Okay.
I asked:
What's the address?
Not exactly an interrogation worthy of the FBI.
If you're operating a car lot and offering to sell and ship vehicles to customers, asking where the car lot is located seems like a fairly reasonable question.
I wanted information I could independently verify.
Then something interesting happened.
😂 Apparently I Asked One Question Too Many
Today I went back to the TikTok account.
The profile is still there.
At the time of my latest screenshot, it showed:
1,261 followers
4,803 likes
The bio still says:
“Landmark Auto 🚗”
“Your Trusted Auto Dealer”
It still lists a Gmail address.
It still says:
“WhatsApp only”
But now the videos are gone—from my view.
TikTok tells me:
“No content”
and:
“You cannot view the videos due to this user's privacy settings.”
Well, that's convenient.
The account that contacted me in the middle of the night and wanted to discuss selling me a vehicle apparently no longer wants me looking at its vehicle listings.
🚩 Let's Review the Timeline
This is what makes the progression interesting.
I saw vehicles advertised at unusually low prices and down payments.
I started documenting them.
The account contacted me.
I openly questioned whether the operation was legitimate.
They told me they had no intention of scamming anybody and were simply trying to make a living selling cars.
I asked where the business was located.
They gave me a city and state:
Savannah, GA.
I asked for the actual street address.
And now I can no longer view their TikTok content.
That's what I can document from my screenshots.
Whether TikTok's restriction reflects a block or another privacy setting, I can't determine that independently from this screen alone. But the result for me is the same:
I can't see their videos anymore.
🤔 That's an Interesting Way to Build Customer Confidence
Remember, their profile calls them:
“Your Trusted Auto Dealer”
Trust generally works better when customers can verify things.
If I were considering sending hundreds of dollars to an online vehicle seller, I'd want some pretty basic information:
Where is your dealership?
What's the street address?
What's your legal business name?
What's your dealer license number?
What's the VIN?
Can I inspect the vehicle?
Can someone I choose inspect it?
Can I call the dealership using a number I find independently?
Can you provide the complete purchase and financing terms?
Those aren't hostile questions.
Those are car-buying questions.
🚩 Blocking Questions Doesn't Answer Questions
Here's the important part.
Not being able to view the account's videos doesn't, by itself, prove that every listing was fraudulent.
But it also doesn't resolve a single concern I raised.
The $4,000 Scat Pack doesn't suddenly make more sense.
The $500 down payments don't become independently verified.
“WhatsApp only” doesn't establish a dealership.
“Savannah, GA” still isn't a street address.
And preventing a skeptical viewer from seeing the listings doesn't provide any of the documentation that could establish the seller's legitimacy.
It simply prevents that viewer from continuing to examine the content.
😂 Apparently Due Diligence Is Bad for Business
Maybe my mistake was asking too many questions.
Perhaps I should have said:
“$500 down? Fantastic! Where do I send it?”
Instead, I committed the unforgivable sin of online car shopping.
I asked:
“What's the address?”
Oops.
🏡 This Is Exactly Why I Say: Be a Good Neighbor
Someone else might see a beautiful car and an affordable down payment and think they've finally found a solution.
Maybe their credit isn't great.
Maybe their current vehicle just died.
Maybe they desperately need transportation to keep their job.
That person doesn't need ridicule.
They need someone willing to say:
“Before you send that money, let's verify this.”
Check the dealership.
Check the address.
Check the VIN.
Check the dealer license.
Check the title.
Check the vehicle's market value.
Call a phone number obtained independently.
And never let someone rush you into sending a deposit before you've verified who you're dealing with.
I'll Keep Asking Questions
I said I'd continue engaging with this account for as long as I was able.
Apparently, “as long as I was able” didn't last very long.
😂
But there's a useful lesson here.
When you're considering sending money to someone online, don't judge legitimacy by how confidently they tell you they're legitimate.
Judge it by how easily you can independently verify their claims.
And if asking ordinary questions suddenly ends the conversation?
Don't stop asking questions.
Just stop sending money.
Follow the continuing scam series at NielFlamm.com/blog.
This T-Mobile Email Almost Got Me — And That’s What Makes It Good
I get enough scam emails that most of them don't survive more than a few seconds before getting mentally tossed into the garbage.
Bad grammar.
Random Gmail address.
Mystery attachment.
A $700 charge for something I never bought.
Somebody telling me I won a prize I never entered to win.
Easy.
This one was different.
This one almost got me.
And that is exactly why I'm writing about it.
📱 It Looked Like T-Mobile
The subject line was:
“Time is running out”
The email had the familiar magenta T-Mobile branding, addressed me by name, and told me:
“We have not received your T-Mobile bill payment and your account remains past due.”
It even gave me a specific overdue balance:
$67.10
Then came the threat:
My service was at risk of suspension for non-payment.
And conveniently, right underneath was a big magenta button:
“I Want To Set Up A Payment Arrangement”
That's a pretty effective combination.
Recognizable company.
My name.
Specific dollar amount.
Urgency.
Threat of losing service.
And an immediate solution.
For a moment I thought:
Wait... did I miss my T-Mobile payment?
🚩 Then I Looked Closer
The email looked fairly legitimate.
Fairly.
Then I looked at the sender:
FinancialServicesContact@financialservices.t-mobile.com
At first glance, that's pretty convincing.
There's “T-Mobile” right there in the address.
But an email address that looks legitimate isn't enough for me anymore.
And more importantly, I realized I was about to make the mistake these emails are designed to encourage:
I was using the email to determine whether the email was legitimate.
So I stopped.
I didn't use the button.
I didn't follow its instructions.
I went somewhere I already trusted.
📲 I Opened the T-Life App
This was the easiest test of all.
Instead of clicking the payment-arrangement button, I opened my T-Life app independently and checked my actual account.
Guess what?
I'm current.
My account isn't showing the overdue situation described in the email.
My next payment isn't due until September 17.
Well, that's awkward.
Apparently, my T-Mobile account forgot to tell T-Mobile that my T-Mobile account is fine.
😂
🚨 This Is the Kind of Message That Concerns Me
The ridiculous scams aren't necessarily the ones I'm most worried about.
It's these.
The ones that are close enough.
The branding looks right.
The formatting looks professional.
The amount is believable.
The situation is plausible.
And the sender information looks convincing enough that you might not examine it carefully.
Then they add urgency:
TIME IS RUNNING OUT
Your service might be suspended.
You owe money.
Fix it now.
And here's a convenient button.
That urgency matters because it pushes you to act before you independently verify the claim.
🔍 The Best Scam Detector Wasn't the Email
Here's the lesson I'll take from this one.
I didn't need to determine whether every graphic was authentic.
I didn't need to inspect HTML.
I didn't need to click the button to see where it went.
And I didn't need to contact whoever sent the message.
I went straight to the account the email was supposedly about.
My actual T-Mobile account told the story.
That's an incredibly simple habit:
If your bank emails you about a problem, open your banking app yourself.
If Amazon says there's an order, open Amazon yourself.
If PayPal says somebody charged you, open PayPal yourself.
If your wireless carrier says you're past due, open your carrier's app yourself.
Don't use the suspicious message to get there.
🧠 And Yes, This One Almost Worked
I think that's worth admitting.
People sometimes talk about scams as though only gullible or technologically inexperienced people fall for them.
That's dangerous thinking.
I spend a ridiculous amount of time looking at these things.
I've written about scam emails.
Recruiting scams.
Mystery attachments.
Fake subscription charges.
Questionable car advertisements.
And this email still made me stop and think:
“Wait... am I past due?”
That's what good social engineering does.
It doesn't necessarily make you believe something ridiculous.
It gives you something believable enough that you react before you think.
Fortunately, this time I thought.
Then I checked.
🏡 Be a Good Neighbor
If you have a parent, friend, coworker, or neighbor who might receive something like this, show them this simple trick:
Don't click the button.
Open the company's app or type the company's known website yourself.
Check the account independently.
A 30-second verification could prevent a much bigger headache.
And if you're ever tempted to think:
“I'd never fall for something like that.”
Neither did I.
But this one got close.
Very close.
That's why I'm sharing it.
Follow along at NielFlamm.com/blog for more scam investigations, suspicious emails and the occasional message that makes even me look twice.