PanicStation.org
UK USA
uk Money & financial emergencies

What to do if…
a retailer contacts you about a high-value order you did not place

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Treat the contact as unverified. Do not use the caller’s link, number, QR code, or request for a one-time passcode; check the retailer account through your own route and contact your bank or card provider immediately if any payment may be involved.

Do not do these things

  • Do not click links, scan QR codes, or call numbers given in the message, voicemail, or pop-up.
  • Do not confirm sensitive details on an inbound call or message, even if they already know some information about you.
  • Do not share one-time passcodes, banking app approval prompts, card security codes, or password reset codes.
  • Do not let anyone “help you cancel” by taking payment, moving money, or asking you to install software.
  • Do not assume it is genuine because the caller sounds professional or knows an order number.
  • Do not ignore it if you see a matching pending or completed transaction.

What to do now

  1. Pause the contact. Say: “I’m not able to confirm anything on this call or message. I’ll contact you through the official customer service route.” Then end the call or leave the message unanswered.

  2. Check the retailer account without using the inbound link.

    • Open the retailer’s app yourself, or type the retailer’s web address into your browser.
    • Check order history, saved delivery addresses, saved payment methods, and recent account changes.
    • If you cannot access the account, treat that as a warning sign and move to the next steps.

  3. Contact the retailer through details you find independently.

    • Use the retailer’s official website or app, a paper receipt, or a previous genuine email.
    • Ask whether the order exists.
    • If it exists, ask them to cancel it, remove any delivery address you do not recognise, and mark the account as suspected fraud or account takeover.
    • Ask what they can use to locate the order without you giving sensitive information.

  4. Check your bank or card activity now.

    • Look for a matching pending, authorised, or completed transaction.
    • If you see anything you do not recognise, or you are not sure, contact your bank or card provider immediately using the number on the back of your card, in your banking app, or on a statement.
    • Tell them the payment may be unauthorised and ask whether the card should be blocked or replaced, and how they want you to dispute the payment.

  5. Secure the most likely entry points.

    • Change your email password first, because email can control password resets.
    • Then change the retailer account password.
    • Turn on two-step verification where available.
    • Check for new addresses, phone numbers, payment methods, or linked accounts, and remove anything you do not recognise.

  6. Try to stop the parcel safely if shipping is involved.

    • Use tracking only from inside your own retailer account or from the retailer after you have verified the contact route.
    • Ask the retailer whether they can stop shipment, cancel delivery, or return the parcel to sender.
    • If a parcel arrives that you did not order, you can usually refuse delivery. Do not confront anyone you suspect is trying to collect it.

  7. Report the scam attempt or loss through the right route.

    • If you are in England, Wales, or Northern Ireland and you lost money, were hacked, or need to report fraud or cyber crime, use Report Fraud online or call 0300 123 2040.
    • If you are in Scotland, report fraud or cyber crime to Police Scotland by calling 101.
    • If it came by email, forward it to report@phishing.gov.uk.
    • If it came by text, forward it to 7726.

  8. Check for wider identity misuse if this looks bigger than one order.

    • Check your statutory credit reports with Experian, Equifax, TransUnion, and Crediva, because they may hold different information.
    • Look for credit applications, addresses, or accounts you do not recognise.
    • If you think your personal details are at heightened risk, consider Cifas Protective Registration. It can prompt extra checks by organisations that use Cifas data, and it may make some genuine applications take longer.

What can wait

  • You do not need to decide now whether to pay for credit monitoring or identity protection.
  • You do not need to contact every organisation at once; prioritise the retailer and your bank or card provider.
  • You do not need to complete every report before you have tried to stop the order or protect the payment card, unless there is immediate danger.
  • You do not need to change every password today; focus first on email, the retailer account, and banking or card access.

Important reassurance

Retailers sometimes contact customers because they have already noticed something suspicious. You are not being difficult by ending an inbound contact and verifying independently; that is a normal, safer way to handle a possible fraud attempt.

Scope note

These are first steps to reduce loss, protect access, and buy time. Later decisions, especially if there are repeated orders, new accounts, or credit applications, may need specialist help from your bank, the retailer, a fraud support service, or a regulated adviser.

Important note

This guide is general information, not legal, financial, cyber security, or professional advice. Follow the instructions from your bank or card provider, the retailer, and the official reporting service for your situation.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us