I received an order confirmation email completely out of the blue recently, thanking me for a $200 purchase of CBD gummies. This was not caught by a spam filter and went to my regular inbox. See below, with personal info redacted:
The shipping and billing address are both correct and have my name.
I did a little research on the company, it seems they typically advertise via sketchy banner ads (the "home page" of the site connected to the email I received is completely blank, one of the only pages on their site is a very suspicious purchase page) which I've never interacted with. I Googled the phone number in the email (unwilling to actually call it and give scammers another avenue to reach me), and it seems to be connected to a completely different, but still scammy-looking, website. I replied to the confirmation email requesting the order be cancelled and, predictably, received no response.
The next day I was sent another email stating the the order had shipped, providing a USPS tracking number. Copying-and-pasting the number into the usps.com tracker, it is a legitimate number and the package is moving through the mail system.
However, the confusing element of this is that I have not been charged for the order. I have been monitoring my bank, cards, and PayPal transactions (there was no specific payment info on the invoice), and several business days later there seems to have been no charge. Nothing matching the price or description from the confirmation email, no unexplained or pending charges of any amount, and no 'fraudulent charge detected and rejected' alerts from any of my accounts.
So what sort of scam is this, and what should I do next?
- Are they just hoping I really like their "free sample" and end up ordering again from the site?
- Is it that they haven't charged me yet and I should stay vigilant for however long until that $200 charge hits, and then report it as fraud?
- What should I do when the package arrives? Should I refuse it? Open it to see if there is an invoice that could provide additional information? Throw it away? (of course, I am not planning to consume unsolicited drugs)
- How concerned should I be that this unknown-to-me company has my name, email, and address? Is there any action I can or should take there?
- Should I report the emails as "spam" to my email service? I have already reported the company through the FTC's site.
Note: I live in Washington state where CBD is fully legal, so I am not concerned about any legal issues related to the contents of the package.