Email scam Harrods and Net a Porter

[Throwaway1066]

Morning, I’ve woken up to some very convincing looking emails from Harrods and Net a Porter. Both confirming purchase of high value goods.

Both show payment via Mastercard (I don’t have one) in HKD and both “Harrods” and “Net a Porter” have my full name and a shipping address to a university in Hong Kong. (I have no connection to HK)

Then they are followed up by another two emails cancelling the orders due to being unable to confirm payment method.

Normally I would write these off as phishing emails, but they are so good. They look exactly right. Even to the extent I got a separate Net a Porter email welcoming me and offering discount of my next purchase.

Theres no obvious phishing links to click. No “click here to cancel order” etc. The only links are right at the bottom in the small print, I haven’t clicked them of course but I have copied and pasted them onto a clipboard to read the links and they too look legit.

I want to find out if the email addresses are real. I’m not convinced by them, but they are not definitely dodgy looking. I don’t want to assume phishing email incase someone has managed to open a Mastercard in my name.

I’ve never shopped at either store, can anyone here confirm if either of these are genuine please?

[email protected]

[email protected]

it’s the @emails. And @orders. That I’m hoping will expose as a fake email!

Why? They're fake and you haven't bought anything?

both companies have great customer service - call them

Harrods do use this similar format:

[email protected]

So the prefix ahead of the harrods domain is not necessarily sign it's a phishing email.

It sounds like a data mix up, either their end, or with the person who made the order.

The fact it's not on your card is positive. Ditto the fact that it's cancelled.

I suspect you're right not to click the links anyway, as email addresses can be spoofed.

I'd be tempted to forward it to the vendor to ask them. If you can be bothered.

Could be an error in someone one giving out their email as yours.

I have a man who is now my Facebook friend who has the same initial as me and same surname and our emails are very similar and either he gave it incorrectly or a store took it down wrongly (car parts) and as part of his car business he started ordering lots and I got all the emails!

I traced him and he’s lovely and we sorted it out.

It's worth adding, I think Harrods and NaP use the same online storefront softwear. Owned by NaP.

Someone once told me that (someone who works in the luxury ecommerce industry).

Incase they are not fake and someone has fraudulently used my name and email address, I’m doing my due diligence.

The email address is went to is nothing at all like my name, it’s a completely made up word.

Probably is just a phishing email, but it’s niggling at me. They are not normally as good as these ones.

Even if it’s a real email address, doesn’t mean it’s an email from that address.

I will, they open at 10am 🙂

I work in email marketing and it’s quite common to use different domains like that when using different ESPs for different things - especially in retail, so the emails don’t suggest it’s not real

contact them to find out if it’s an address they use

I’ve definitely ended up on Net a Porter’s marketing list, I’ve had 2 marketing emails this morning!

The emails/orders is a sub-domain (in layman’s they use a different part of their system to handle orders). It’s the END of the address you need to look at - in this case harrods.com is legitimate- HOWEVER, it’s easy to fake the “from” address - you need to look at the email headers - so if you go to the email there’s usually a drop-down arrow and that’s where the fakery will be revealed.

but, as others have said - harrods customer service is second to none so I’d give them a call.

The combination of your actual name and your email address which doesn't include your actual name (if I've understood correctly) indicates that your details are being used fraudulently somehow, rather than it being some sort of error.

There's nothing to be gained from contacting the retailer but if you decide to then use details that you've googled, rather than trusting details which appear on the emails.

If I was you I'd check my credit file (Clearscore, Credit Karma etc) for any unknown credit cards or credit searches. There's probably nothing to worry about though.

it’s easy to fake the “from” address - you need to look at the email headers - so if you go to the email there’s usually a drop-down arrow and that’s where the fakery will be revealed.

It's almost as simple to spoof a 'from' address that wouldn't be revealed if you did that - so don't rely on doing that to detect fakes.