Talos saw about 1,400 messages where attackers placed fake orders so that genuine Staples and Dell order notifications, passing DKIM and DMARC, carried a "Helpline" phone number in the ship-to or bill-to fields. It has tracked this trick across more than 25 legitimate platforms, along with lures hidden in sign-up "name" fields and in bounce messages.

• Mail gateway: flag transactional mail where phone numbers, "helpline" or "cancel" wording appear in address or name fields, and run full phishing/URL checks on content nested inside bounce reports (DSN/NDR).
• Users: never call a number printed in an unexpected order email; check the order in the retailer's own account or app.
• If you send transactional mail: treat every user-supplied field rendered into a template as untrusted, and reject URLs, phone numbers and line breaks where they don't belong.