PanicStation.org
UK USA
us Money & financial emergencies

What to do if…
a retailer contacts you about a high-value order you did not place

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Do not use the inbound call, message, or link to confirm or cancel anything. Check the order through the retailer’s official website or app, then contact your card issuer or bank promptly through a trusted route if any payment may be involved.

Do not do these things

  • Do not click links or call numbers provided in the message or voicemail.
  • Do not share one-time passcodes or verification codes.
  • Do not approve security prompts in your banking app because an unexpected caller asks you to.
  • Do not share full card details, PINs, or online banking login information.
  • Do not pay a verification fee or cancellation fee.
  • Do not transfer, withdraw, or move money because a caller says it will protect your funds.
  • Do not let urgency or threats rush you into acting through the inbound contact.
  • Do not ignore a matching transaction in your card or bank account.

What to do now

  1. End the inbound contact. Say that you will contact the retailer independently. Do not continue the call or message exchange.
  2. Check whether the order appears in your real retailer account. Open the retailer’s official app or type its known web address yourself. Review the order history, delivery address, saved payment methods, and recent profile changes.
  3. Contact the retailer through a verified route. Use the retailer’s official website, official app, or another route you already independently know is genuine. Ask whether the order is real, whether it can be cancelled, and whether any unfamiliar address or payment detail can be removed.
  4. Check the payment account. Review your card or bank account for a matching charge or pending transaction. If you see one, or you are unsure, contact the issuer or bank using the number on the back of your card, its official app, or its official website. Report the suspicious transaction and ask what immediate protection and dispute steps are needed.
  5. Secure affected logins. Change the retailer password if the account shows an unknown order, changed details, or suspicious access. If the retailer password was reused elsewhere, change it on those accounts too. Secure your email account as well if it may have been accessed or if it can be used to reset the retailer password. Enable multi-factor authentication where available.
  6. Use the official identity-theft recovery route if the problem looks wider. Go to IdentityTheft.gov if you find new accounts, repeated misuse, or signs that personal information may have been used beyond this order.
  7. Consider credit protection if personal information may be exposed. A credit freeze can make it harder for someone to open new credit accounts in your name; place it separately with Equifax, Experian, and TransUnion. An initial fraud alert is another option; you can contact one of the three bureaus, which must notify the other two.
  8. Review your credit reports if wider misuse is possible. Free weekly online reports are available through AnnualCreditReport.com. Look for accounts or activity you do not recognise.
  9. Handle any package through a verified route. If a shipment is involved, ask the retailer or carrier through an independently verified route whether it can be stopped, refused, or returned. If someone appears to collect a package and you feel unsafe, do not engage. Call 911 if there is immediate danger.

What can wait

  • You do not need to decide now whether to pay for monitoring services or identity-protection products.
  • You do not need to contact every organisation at once. Start with the retailer and the relevant card issuer or bank.
  • A police report can usually wait unless there is immediate danger or your recovery plan, issuer, or bank says it is needed.
  • You do not need to change every password at once. Start with accounts that show suspicious activity or reuse the affected password.

Important reassurance

The contact is not proof that the order is real, and it is not proof that you did anything wrong. It is reasonable to end an inbound call or message and verify the situation through routes you trust.

Scope note

These are first steps to limit loss and reduce repeat attempts. Later decisions may need help from the retailer, your card issuer or bank, or an identity-theft recovery service.

Important note

This guide is general information, not legal, medical, financial, therapeutic, or other professional advice.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us