Official Purchase Order Email Scam Exposed: Fake PO 20013962 Investigated

An unexpected purchase order can look like excellent news, especially when the message mentions a previous quotation. That familiar business language encourages a fast response.

Before confirming delivery dates or opening the file, examine what the sender actually provided. Several quiet details reveal whether the opportunity deserves your trust.

Overview

The email announces a supposedly confirmed order

The message carries the subject “Purchase Order #20013962” and tells the recipient that an official order is attached for immediate review.

It claims the purchase follows an earlier quotation. The sender asks for acknowledgement, confirmation of pricing, and the earliest possible delivery date.

That wording targets suppliers, manufacturers, and sales teams accustomed to converting quotations into orders. A large opportunity can make an unfamiliar sender seem worth investigating.

The attachment is an HTML page disguised as paperwork

The attached file is named “Purchase Order.html,” not a normal PDF, spreadsheet, or document exported from a purchasing system.

When opened, it launches in the browser and presents a blurred technical drawing behind a secured-document prompt. The display is designed to resemble an Adobe viewer.

The recipient is told to enter an email address and password to unlock the order. Those credentials are the real objective of the message.

A real manufacturer is used as visual cover

The email borrows a company name, employee identity, signature, and telephone details to appear established. The impersonated organization did not authorize the campaign.

Copying public business information is easy. A polished signature proves only that the attacker found details online, not that the message came from that company.

The most important warning signs are:

• An order from a buyer the recipient cannot match to a verified quotation.
• An HTML attachment presented as official purchasing paperwork.
• A blurred document that becomes visible only after entering an email password.
• A display name and signature that distract from the actual sender domain.
• A request for quick acknowledgement before independent verification.

Why Purchase Orders Make Effective Business Bait

A purchase order feels positive. Unlike an overdue invoice or security warning, it promises revenue and invites the recipient to imagine a new customer relationship.

Sales staff are trained to respond quickly. Delays can cost business, so an unexpected order may be opened before anyone confirms who requested the quotation.

The message also creates a plausible task. A supplier must check quantities, specifications, delivery dates, and payment terms before accepting an order.

Technical drawings reinforce that story. Even when blurred, engineering imagery suggests a detailed project exists and makes the locked viewer feel commercially important.

The phrase “based on your previous quotation” supplies invented history. It encourages staff to assume another colleague handled the earlier conversation.

In a busy company, that assumption is dangerous. Different departments may share a sales inbox, while staff cannot remember every enquiry received during the month.

The order number provides another anchor. “20013962” looks specific, yet a sequence of digits can be placed into thousands of identical messages.

A genuine order should survive basic verification. The buyer, requested goods, quoted price, delivery address, tax information, and procurement contact should all align.

How the Scam Works

Step 1: Attackers identify businesses that accept purchase orders

Criminals collect sales and purchasing addresses from company websites, trade directories, data leaks, exhibition lists, and compromised correspondence.

They often target manufacturers because drawings, quotations, and unfamiliar procurement contacts are normal parts of daily work.

Generic addresses such as sales, estimates, enquiries, and orders are useful. Several employees may monitor them, reducing personal scrutiny.

Step 2: The sender borrows a credible corporate identity

The message may display a real employee’s name and a recognizable company. Telephone numbers and office details copied from public pages complete the signature.

However, the true sending address may use an unrelated domain, a free account, or a mailbox compromised at another organization.

Readers who inspect only the display name can miss that contradiction. Email clients frequently make the friendly name more prominent than the address.

Step 3: A fictional quotation creates continuity

The email refers to a previous quote without naming its date, recipient, requested items, or internal reference. Ambiguity lets the same lure fit many companies.

The recipient may search their memory instead of challenging the claim. They might assume another salesperson submitted the quotation.

A legitimate procurement contact can resend the earlier request and identify who supplied the quote. Scammers avoid details that can be checked.

Step 4: The HTML attachment opens a controlled page

An HTML attachment contains webpage code. Double-clicking it causes the default browser to render content selected by the attacker.

The first page may be stored inside the attachment itself. It can then submit information elsewhere or send the browser toward another phishing address.

This format helps the lure bypass expectations. Employees anticipate a document, but they receive an interactive webpage with form fields.

Step 5: The fake viewer asks for mailbox credentials

A blurred drawing appears beneath an Adobe-style panel. The recipient is told the file is protected and requires account verification.

The form usually requests an email address and password. No genuine buyer needs a supplier’s mailbox password to share a purchase order.

The blur prevents meaningful inspection. It creates the impression of valuable content while hiding the absence of a real order.

Step 6: Submitted details travel to the criminal

Pressing the unlock or view button sends the entered information to infrastructure controlled by the attacker.

The page may display an error and request the password again. Repetition helps capture alternative passwords when the first entry appears unsuccessful.

It may eventually open a harmless document or redirect elsewhere. That closing behavior is intended to reduce immediate suspicion.

Step 7: The stolen mailbox supports deeper fraud

Once inside, criminals search for quotations, invoices, customers, shipment schedules, and conversations involving bank details.

They may create forwarding rules, delete security notices, and watch ongoing negotiations. This surveillance lets them imitate normal language and timing.

A later message can replace payment instructions during a genuine transaction. Because it comes from a real mailbox, colleagues and customers may trust it.

What Criminals Can Do With a Compromised Sales Mailbox

A sales account contains more than messages. It provides relationships, context, signatures, attachments, and evidence about how the organization approves commercial decisions.

Attackers can reply inside an existing thread. That makes the fraudulent request appear connected to a conversation both parties recognize.

They can download customer lists or confidential drawings. Sensitive attachments may later support extortion, industrial espionage, or more convincing phishing.

Forwarding rules are especially damaging. Copies of incoming messages can silently reach an external account after the password has been changed.

Criminals may also send new purchase-order lures to contacts found inside the mailbox. Recipients see a trusted supplier and are more likely to open the attachment.

Account recovery information can be altered when protection is weak. The legitimate user may then struggle to regain control.

Damage may spread beyond email when the same password protects cloud storage, accounting portals, customer systems, or remote access services.

For that reason, changing only the compromised mailbox password may be insufficient. Every reused credential and active session deserves review.

What a Genuine Purchase Order Should Let You Confirm

A traceable quotation relationship

A legitimate order follows a conversation someone can locate. The buyer should reference the quotation date, number, contact, and version accepted.

If pricing changed during negotiation, the final order should reflect those revisions. Unexplained totals or specifications deserve clarification before acknowledgement.

Searching the sales system should reveal who prepared the quote. No matching history means the sender must provide stronger evidence.

Products and quantities that make commercial sense

Real orders identify part numbers, descriptions, units, quantities, prices, and requested dates. Those details allow a supplier to evaluate capacity.

A blurred drawing offers none of that. It prevents staff from comparing the request with capabilities, stock, tooling, or agreed terms.

Unexpected high-volume orders deserve additional care. Criminals may select impressive quantities because imagined revenue makes recipients overlook ordinary controls.

A delivery destination connected to the buyer

The ship-to address should belong to the customer, an identified project, or an approved logistics partner. Verify new destinations before dispatching goods.

Freight forwarders and collection requests can be legitimate, but they increase risk when combined with a first-time buyer and unusual payment terms.

Use independent company records to confirm the receiving site. Never accept a last-minute address change solely through an unverified mailbox.

Payment and legal terms that match prior discussions

Purchase orders normally state currency, tax treatment, payment period, Incoterms when relevant, and contractual conditions. These elements should match the quotation.

Inconsistencies may indicate error rather than fraud, but they still require resolution. A valid buyer will welcome accurate commercial confirmation.

Do not purchase materials or reserve production based on a locked image. Wait until authorized people verify the complete order.

An approval trail outside the attachment

Established customers usually have recognizable procurement addresses, portal records, supplier numbers, or telephone contacts. Those channels create evidence beyond one message.

First-time customers require due diligence on company registration, creditworthiness, domain ownership, and the employee requesting goods.

A seller should be able to confirm the transaction without surrendering mailbox credentials. Any process demanding that secret has failed a basic security test.

Record who completed each check. A short verification note protects colleagues from repeating the same uncertainty when the sender follows up again later.

How to Verify an Unexpected Purchase Order

Compare the message with the alleged quotation

Search the customer system for the order number, buyer, contact, and quoted items. Ask colleagues whether anyone handled the claimed enquiry.

A buyer who genuinely accepted a quotation can provide the original reference. A vague reply or refusal to identify it is a serious warning.

Contact the buyer through an independently found channel

Use the company’s official website, an established customer record, or a previously verified telephone number. Do not trust contact details supplied inside the suspicious email.

Ask for the named procurement employee and quote the order number. This simple check can expose impersonation before any file is opened.

Inspect the attachment type and sender domain

Enable visible file extensions and note whether the attachment ends in HTML or HTM. Those are webpages, not ordinary purchase-order documents.

Expand the sender details. Similar spelling, extra words, misplaced hyphens, and unrelated domains can reveal the true source.

Reject any document page requesting an email password

A protected buyer portal may require its own account. It should never ask for the password used to access your email service.

Close the page and report the message. If the order is genuine, the buyer can provide it through a verified procurement channel.

What to Do If You Fell Victim to the Official Purchase Order Email Scam

1. Change the mailbox password from a clean device. Use a unique password that has never protected another account.
2. End every active session. Use the provider’s security page to sign out browsers, phones, applications, and unfamiliar connections.
3. Turn on multifactor authentication. Prefer an authenticator application, passkey, or hardware key when those options are available.
4. Inspect forwarding and inbox rules. Remove unknown rules, delegates, recovery addresses, application passwords, and connected applications.
5. Notify your administrator immediately. Ask them to review sign-ins, sent mail, deleted items, audit logs, and messages accessed by the intruder.
6. Warn customers and suppliers. Explain that your mailbox may have sent fraudulent orders or altered payment instructions.
7. Reset every reused password. Prioritize banking, accounting, cloud storage, remote access, and customer-management accounts.
8. Scan the computer with Malwarebytes. Check for information stealers or unwanted software, even when the initial page appeared to be credential phishing.
9. Use AdGuard to reduce malicious redirects. Blocking known advertising and phishing infrastructure adds protection, but does not replace careful verification.
10. Preserve the evidence. Save the email, complete headers, attachment, timestamps, and screenshots for your security team and relevant authorities.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Anti-Malware Free — one of the most trusted malware removal tools available.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The whole process takes about 5 minutes.

Stay Protected: Block Ads and Malicious Sites

Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

Frequently Asked Questions

Is purchase order 20013962 genuine?

The number appears in a credential-phishing campaign. Verify any similarly numbered order independently because scammers can change digits between messages.

Is the impersonated manufacturer responsible?

No evidence indicates the named company authorized the email. Criminals frequently copy real corporate identities to make fraudulent messages more credible.

Can an HTML attachment steal a password?

Yes. It can render a convincing sign-in form and send submitted details to an attacker, even when it opens locally in a browser.

Does opening the attachment automatically infect the computer?

Not necessarily. This campaign focuses on credentials, but hostile webpages can redirect elsewhere. Close it, avoid interaction, and scan the system.

Why does the page show a blurred technical drawing?

The blur implies valuable content exists behind the form. It prevents the reader from discovering that the promised purchase order is missing.

What should a legitimate buyer provide?

Expect identifiable goods, quantities, pricing, delivery terms, billing information, buyer contacts, and references that match a verifiable quotation or customer record.

The Bottom Line

The Official Purchase Order email is a business credential trap. Its corporate signature, order number, and drawing exist to legitimize an unnecessary password request.

Verify the buyer outside the message, treat HTML order attachments cautiously, and never unlock commercial paperwork with your mailbox password.