---
title: Tip: a real Staples or Dell order email can still be a scam. Flag phone numbers in shipping fields, and scan inside bounce messages | ctxsec
url: https://ctxsec.com/items/tip-talos-trusted-notification-callback-lures
description: ""
status: "guidance based on Cisco Talos research (Oct 21)"
published: 2026-10-22
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-talos-trusted-notification-callback-lures.md)

guidance based on Cisco Talos research (Oct 21)

2026-10-22

### Tip: a real Staples or Dell order email can still be a scam. Flag phone numbers in shipping fields, and scan inside bounce messages

Talos saw about **1,400** messages where attackers placed fake orders so that genuine **Staples** and **Dell** order notifications, passing DKIM and DMARC, carried a "Helpline" phone number in the ship-to or bill-to fields. It has tracked this trick across more than 25 legitimate platforms, along with lures hidden in sign-up "name" fields and in bounce messages.

- **Mail gateway:** flag transactional mail where phone numbers, "helpline" or "cancel" wording appear in address or name fields, and run full phishing/URL checks on content nested inside bounce reports (DSN/NDR).
- **Users:** never call a number printed in an unexpected order email; check the order in the retailer's own account or app.
- **If you send transactional mail:** treat every user-supplied field rendered into a template as untrusted, and reject URLs, phone numbers and line breaks where they don't belong.

Sources: [Cisco Talos: Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers (Oct 21)](https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/)