Apparently, the Scammers Still Haven’t Started Writing Emails

Just when I thought the mystery-order-email department might have run out of ideas, two more showed up.

Apparently, writing an actual email is still too much work.

No company introduction. No explanation of what I supposedly purchased. No recognizable merchant. No dollar amount. No useful order details.

Just a mysterious attachment and the digital equivalent of:

“You bought something. Trust me. Open this.”

Yeah, I’ll get right on that.

Mystery Order #1: Thank You for…Whatever I Ordered

The first email arrived with this rather catchy subject line:

“Thank You for Your Order IJAAV~67DSW6N_8H07T29FPNUSVU~7D69Q8CJ520IWP”

Well, that certainly clears things up.

It came from someone named Sarah Black, using a Gmail address.

Inside the email?

Almost nothing.

There's another long collection of letters and numbers and a 36 KB attachment.

That's it.

No store.

No product.

No purchase price.

No credit card information.

No shipping address.

No customer-service information.

Nothing explaining what this alleged order actually is.

To see what I bought, I need to open the attachment.

Nope.

Mystery Order #2 Arrives the Next Day

Then another one arrived.

This time the subject was:

“Your receipt and invoice 2026401GDWNUH are attached”

Now we're getting fancy.

We've upgraded from a mysterious “order” to a mysterious receipt AND invoice.

This one came from someone named Malcolm, also using a Gmail address.

The body of the email contains another random-looking code:

RNUH-H5L1-I0MG2/GM41VL75ZUE

And, naturally, there's another attachment—this one is 24 KB.

Again, the message doesn’t identify a recognizable business.

No explanation of what I purchased.

No price.

No payment information.

No description.

Just an attachment.

🚩 The Attachment Is Still the Email

I've written about this before, and apparently somebody out there wants to provide me with additional examples.

These messages aren't really trying to communicate anything useful.

The attachment is the email.

Everything surrounding it seems designed to create just enough curiosity or concern to make me open it.

Maybe my first reaction is:

What did I order?

Then:

Did somebody use my credit card?

Then:

How much did they charge me?

And finally:

I’d better open this invoice and find out.

That's precisely the reaction I don't want to have.

If I don't recognize a purchase, my first move isn't to open a mystery attachment from an unfamiliar Gmail account.

I'm going directly to my bank, credit-card company, retailer account, or whatever legitimate service supposedly processed the transaction.

Curiosity Can Be the Bait

I haven't opened either attachment, so I don't know what's inside them.

I can't claim they're malware without examining them.

And that's really the point.

I don't need to know what's inside.

Neither message gives me a reason to take that risk.

If I really made a purchase, I can verify it independently.

If there's an unauthorized charge, I can see it through my financial institution.

If a legitimate company needs to contact me about an order, I can go directly to that company's website or app rather than following instructions contained in an unsolicited email.

Opening a mystery file shouldn't cost me to find out whether I supposedly spent money.

Two Emails, Same Basic Formula

These arrived on consecutive days from different Gmail addresses with different names, different order numbers, and different attachments.

But look at the structure:

Unexpected purchase notification → vague message → meaningless-looking number → attachment → curiosity.

That's what catches my attention.

They don't need me to believe the email for very long.

They need me to think:

“What the heck did I buy?”

…and click.

Don't Let the Email Create the Emergency

That's another lesson I've learned from documenting these messages.

A suspicious email shouldn't create a problem and then dictate how I investigate it.

If an email tells me there's an order I don't recognize, I'll check my accounts independently.

If it says there's a PayPal charge, I'll log in to PayPal independently.

If it says there's a credit-card transaction, I'll check that card myself.

If it claims there's an Amazon order, I'll open Amazon myself.

I don't need the mystery attachment.

Be a Good Neighbor

These emails may look ridiculous to someone who's seen hundreds of them.

Not everyone has.

Someone else might see “Thank You for Your Order” and immediately panic.

Maybe they're worried someone stole their credit card.

Maybe they're afraid hundreds of dollars just disappeared from their checking account.

Maybe they can't remember whether they ordered something.

That's when it's worth saying:

Don't open the attachment yet. Let's verify the supposed purchase another way.

Help someone check the real account.

Show them how to inspect the sender.

Explain why an unexpected attachment deserves caution.

Report suspicious messages.

Then delete them.

Because apparently the scammers still haven't started writing emails.

But they certainly haven't stopped sending attachments.

Day 105: “The Power of We” Sounds Great. I’m Still Waiting for the “We.”

Today, Nextdoor CEO Nirav Tolia posted about speaking to a room of founders and operators at Venture Dallas.

One line immediately caught my attention:

“The power of me becomes the power of we.”

That's a pretty good line.

Actually, it fits remarkably well with what I've been writing about for the past 105 days.

Nirav went on to describe growing up in Odessa, Texas, where knowing the names of people on the street helped shape the idea behind Nextdoor. He wrote that community makes people sharper because they're building on other people's ideas instead of constantly starting from zero.

Then came another line that caught my attention:

“That's the whole bet behind Nextdoor.”

Venture Dallas itself describes its mission in similar terms: connecting innovators and investors while building collaboration and a stronger entrepreneurial community.

Great.

So let's talk about the “we.”

I've Been Trying to Join the Conversation for 105 Days

For 105 days, I've been asking Nextdoor about detailed data referenced in two of its Insights posts.

This hasn't been 105 days of demanding that somebody agree with me.

It hasn't been 105 days of demanding that Nextdoor change its business because one small shareholder has an opinion.

I've asked a question.

I've provided feedback.

I've emailed.

I've followed up.

I've publicly documented the experience.

Communications eventually responded, and I acknowledged that response. I didn't receive the complete, detailed material I requested.

Yesterday, I expanded the email to Nextdoor's Executive Team.

Those emails did not bounce.

I also attempted to CC members of the Board of Directors. Every one of those attempted Board addresses came back undeliverable.

I’m waiting to see if anyone on the Executive Team responds.

My prediction is still that nobody will.

I would love to be wrong.

“Building on Somebody Else's Idea”

This is where Nirav's post gets especially interesting to me.

He talks about the value of building on somebody else's idea.

That's exactly what feedback can be.

Sometimes feedback is wrong.

Sometimes it's annoying.

Sometimes the person providing it has misunderstood something.

Sometimes it's brilliant.

Sometimes it's somewhere in between.

But an organization doesn't figure out which it is by ignoring it.

My Learning & Development brain immediately goes to the difference between hearing and listening.

Hearing is receiving the message.

Listening requires doing something with it—even if the eventual response is:

“We heard you. We disagree, and here's why.”

That's still communication.

What Does “We” Mean When Someone Disagrees?

The “power of we” is easy when everyone in the room is nodding.

It's harder when somebody keeps raising his hand.

For 105 days.

😂

That's where community becomes much more interesting.

If Nextdoor believes communities become stronger by building upon the knowledge and ideas of other people, shouldn't that philosophy apply when the ideas are uncomfortable?

Shouldn't it include shareholders asking questions?

Small businesses providing feedback?

Neighbors questioning policies?

People challenging research methodology?

People asking how their contributions are being monetized?

People saying, “I think there's a better way to do this”?

I'm not suggesting every piece of feedback deserves implementation.

That would be ridiculous.

But feedback can at least deserve consideration and, when appropriate, an answer.

And Then There's the Other “We”

There's another reason the phrase jumped out at me.

I've recently been writing about the economic value of the information neighbors contribute to Nextdoor.

Recommendations.

Reviews.

Local experiences.

Business information.

Questions.

Answers.

Years of neighborhood knowledge.

Nextdoor provides the technology, infrastructure, and distribution.

Neighbors provide most of what's inside it.

That's a pretty literal example of “me” becoming “we.”

And if that collective knowledge becomes increasingly valuable—particularly as AI makes it easier to organize, search, and commercialize enormous amounts of information—I think there's a legitimate conversation about whether the people supplying that knowledge should share in some of the value it creates.

That's why I started my petition calling for a Neighbor Value-Sharing model.

It currently has one signature.

Mine.

I'm apparently dominating the polling. 😂

But I'm still asking the question.

Community Can't Just Be a Stage Message

I like what Nirav wrote.

I genuinely do.

Community can make ideas better. Collaboration can create things an individual never could. Venture Dallas itself is built around connecting entrepreneurs, investors, and innovators.

But that's also why I'm going to keep comparing the message with the experience.

“The power of me becomes the power of we.”

Okay.

I'm here.

I've been here for 105 days.

I've provided feedback, asked questions, and repeatedly offered to connect—phone, video, or virtual coffee, whatever works.

Yesterday, my email appears to have successfully reached the addresses for members of Nextdoor's Executive Team.

So perhaps Day 105 is the perfect day to test the philosophy.

Does the “we” include people who ask uncomfortable questions?

I hope so.

Because if community really is the whole bet behind Nextdoor, then listening to the community shouldn't be the difficult part.

Day 105.

Now I wait.

👉 Read the continuing case study at NielFlamm.com/blog

When Helping Mom Means Setting a Boundary

This afternoon, I got frustrated with Mom.

Really frustrated.

It was lunchtime at the skilled nursing facility, which meant it was also time for one of Mom's favorite activities whenever she's in an institutional setting:

Complaining about the food.

Her favorite word seems to be “terrible.”

She uses it a lot.

More than a lot.

Today, though, the frustration wasn't just about whether lunch deserved another terrible review.

While Mom ate, I stood in the hallway when one of the CNAs approached me. She brought up several concerns.

Mom isn't eating enough. She wants to go to sleep immediately after eating, even though she's been told she needs to remain upright for at least 30 minutes. Her stomach hasn't really settled since her second stroke. She's also frustrated because she says it sometimes takes too long for someone to respond after she pushes the call button.

There may have been a few other things mentioned that I'm forgetting.

I understand the complaints individually.

Put them all together, though, and I started getting frustrated.

What Does Mom Actually Want?

We've talked about this before.

Mom doesn't want to go home. She wants to leave skilled nursing and eventually move into an assisted living facility.

I'm touring two assisted living facilities this week to help make that happen.

But I explained something to her again today: moving to another facility won’t necessarily solve everything she doesn't like about this one.

There will still be other residents.

Staff will still care for multiple people.

There will still be menus she doesn't control.

There will still be times when she pushes a call button, and someone doesn't magically materialize next to her bed.

That's part of the compromise that comes with choosing a facility over living at home.

At home, she could have significantly more control over what she eats, when she eats, when she goes to bed, and many of the other things she's frustrated about now.

She doesn't want that option.

I respect that.

But choosing another option means accepting compromises.

And that's where we weren't getting anywhere today.

I'm Not Going to Chase the Impossible

I finally told Mom something that may have sounded harsh.

I'm not going to put in all the work required to find another facility, arrange everything, deal with the finances, move her, and get her settled somewhere else if we're going to repeat the same cycle.

New building.

New room.

New staff.

New food.

Same word:

“Terrible.”

I'm willing to help her find a place where she's safe, comfortable, and treated well.

I'm willing to tour facilities.

I'm willing to ask questions.

I'm willing to work through the financial issues.

I'm willing to help her get where she says she wants to go.

I can’t guarantee she’ll like everything.

No facility can do that.

I Had to Remove Myself

Eventually, I realized the conversation wasn't accomplishing anything.

I was frustrated.

She wasn't changing her position.

I wasn't changing mine.

Continuing the conversation would only make both of us more upset.

So I told her that I needed to remove myself from the situation.

That's a boundary I need right now.

There is a difference between helping someone and taking responsibility for making them happy.

I can help Mom.

I can't manufacture happiness for her.

And I can't keep running from facility to facility looking for a place where absolutely everything will be exactly the way she wants it.

Then There's the Money

There's another practical reality.

Assisted living costs money.

Potentially a lot of money.

If Mom is going to be unhappy regardless of where she lives, I have to ask a difficult question:

Why spend a significant amount of her money changing locations if the result will be the same dissatisfaction?

That's where my mind went today.

If she's going to be unhappy in assisted living and unhappy at home, then financially, being unhappy at home is considerably less expensive.

That doesn't mean I've decided she needs to go home.

It doesn't mean I'm abandoning the search.

I'm still touring the facilities this week.

But I am starting to recognize that finding Mom a new place to live and finding Mom a place where she'll never complain are two completely different assignments.

I can work on the first one.

The second one isn't mine.

Today, I needed to remind myself of that—and walk away before frustration took over the conversation.

Tomorrow is another day.

And apparently, somewhere out there, I still need to find a facility whose food doesn't earn the word “terrible.”

Wish me luck.

Thailand Update: Bangkok Hospital Hua Hin Responded—Now I Need a Date

Well, that was fast.

After writing about my plans to potentially spend about 30 days in Hua Hin, Thailand, I emailed the Hua Hin location of Bangkok Hospital to ask what I would need to do to continue my hemodialysis treatments while I'm there.

I expected to wait.

Instead, it took only a few hours for Bangkok Hospital Hua Hin to respond.

They sent me a detailed list of the medical records, dialysis information, and laboratory results they want me to provide before arriving in Thailand.

Suddenly, this little Thailand experiment feels considerably more real.

What Bangkok Hospital Needs From Me

The hospital wants my current hemodialysis prescription, including information such as my dialyzer, dialysate settings, blood-flow and dialysate-flow rates, dry weight, treatment duration and temperature, vascular access and anticoagulant. The prescription needs to be from within three months of my dialysis appointment in Hua Hin.

They also want my recent dialysis information, including any complications I've experienced during treatment, my blood pressure before and after dialysis, and medications administered during or after treatment, such as IV iron or erythropoietin.

Then come the labs.

They require recent testing for HBsAg, hepatitis C antibodies, hepatitis B antibodies, hepatitis B core antibody IgG, and HIV. Most of those results need to be from within six months, while the HIV result can be from within one year.

They noted that if I arrive without the required information, they may need to repeat blood testing before my first dialysis treatment—and there would be an additional charge.

They also want a list of optional information, including my medical history, recent dialysis treatment information, medication list, and additional lab results such as CBC, BUN, creatinine, electrolytes, calcium, phosphorus, and other tests.

It looks like a lot on paper.

Fortunately, I shouldn't have to assemble all of this by myself.

I Talked to My Dialysis Provider

Most Mondays, either my nephrologist or his Physician Assistant checks in with patients at the dialysis center.

Today, I told him what I'm planning.

I think he was a little surprised when I told him where I was thinking about going—and that I was considering staying for about a month.

Thailand wasn't exactly the answer he was expecting.

I showed him the information Bangkok Hospital Hua Hin requested. He told me that my dialysis clinic should be able to obtain most, if not all, of it.

That's a pretty big hurdle potentially taken care of.

And that's exactly why I contacted the hospital before booking a trip. A beachfront condo with an ocean view sounds wonderful, but none of that matters if I can't safely continue dialysis three times a week.

The Pieces Are Coming Together

In a relatively short time, I've gone from thinking about Thailand to working through the logistics.

I've connected with an expat who may be able to help me find a furnished beachfront condo, work through the visa process, arrange transportation from Bangkok to Hua Hin, find temporary accommodations while I get settled, and potentially help arrange a caretaker for Mom.

Now I've heard directly from Bangkok Hospital Hua Hin about what they need for my dialysis.

My dialysis provider believes they can supply the medical information.

So what's the next major item on the Thailand checklist?

I need to pick a date.

That's where I am now.

No plane ticket yet. No condo lease yet. I'm not packing a suitcase tomorrow.

But each question I answer removes another reason this couldn't work.

A few days ago, dialysis in Thailand was one of the biggest unknowns.

Today, I have a list.

And apparently, my dialysis clinic has most of what's on it.

Now I just need to figure out when I'm going to Hua Hin.

Did It: I Accepted the Mystery Friend Request on The Facebook

Well, I did it.

Against the little voice in my head saying, “Niel, you know how these stories usually end,” I clicked Confirm.

Amy Ford and I are now officially friends on The Facebook.

I feel like I should update my relationship status.

For anyone who missed the first chapter, a few days ago I received a friend request from Amy. I had no clue who she was. We had one mutual friend, and her profile raised enough questions that I wrote an entire blog post asking whether I should accept the request or hit Delete.

Curiosity won.

Welcome to the experiment.

First Discovery: Amy Is Still Posting

After accepting the request, I noticed a new post from today about the Broadway Flea Market & Grand Auction in New York.

There are pictures of Broadway memorabilia, Playbills, auction items, and the theater.

Okay.

That's certainly more interesting than immediately receiving:

“Hello dear, how are you today?”

Followed seven minutes later by an incredible cryptocurrency opportunity.

So far, so good.

But accepting the request also allowed me to see more of the profile.

And that's when I noticed Amy's résumé.

Amy Is Apparently Very Busy

According to the profile, Amy has not one, not two, but three different employers listed.

She is apparently:

Investor — Gilpin Lodge

Owner — The Lighter Side of Real Estate

HR Specialist — Samsung Global

That's quite a career portfolio.

Investor.

Business owner.

Human Resources professional.

I'm tired just reading it.

And remember, the profile currently shows only 16 Facebook friends.

It seems Amy may have more jobs than friends on The Facebook.

I'm not judging.

Maybe she's simply very career-focused.

Maybe she's an extraordinarily successful multitasker.

Maybe LinkedIn wasn't challenging enough.

Then There's the Rest of the Profile

The information visible to me now says she:

Lives in New York, New York.

Is from Seoul, Korea.

Is single.

Went to the University of Leeds.

Works—or has worked—in those three very different roles.

And she's posting about New York attractions and events.

Does any one of those things prove anything suspicious?

No.

That's important.

People move. People change careers. People have multiple jobs. People don't always maintain large Facebook friend lists. People use English names. And successful people can certainly have unusual career paths.

But taken together with an unsolicited friend request from someone I don't know?

My eyebrow remains raised.

Possibly both eyebrows.

Now We Wait

I'm not messaging Amy.

I'm not asking for a phone number.

I'm not moving the conversation to WhatsApp or Telegram.

I'm certainly not discussing investments.

And if Amy happens to have an uncle who is a cryptocurrency genius who can turn $500 into $47,000 by Thursday...

I'm probably going to pass.

For now, I'm simply curious about what happens next.

Maybe nothing happens.

Maybe Amy is a perfectly real person who happened to send me a random friend request.

Maybe I'll eventually discover why she wanted to connect with me.

Or maybe the next chapter writes itself.

Either way, I clicked Confirm.

The experiment has officially begun.

And Amy, if you're real and eventually stumble across these posts:

Hi.

Please don't take it personally.

My inbox has trained me to be suspicious of everybody.

Especially people with more jobs than Facebook friends.