LinkedIn New Purchase Order Email Scam: Fake Webmail Login Fully Exposed

A new buyer appears to have reviewed your company catalog and submitted a purchase order through LinkedIn. For a sales team, that notification can feel promising.

The opportunity becomes less convincing once the button, destination, and unusual login request are examined together.

Overview

A business opportunity designed to attract attention

The email imitates a LinkedIn notification and says a buyer has sent a new purchase order. It claims the buyer reviewed the recipient’s product catalog.

The supposed customer asks about shipping availability, giving the message a believable commercial purpose. Employees handling sales or accounts may feel expected to respond quickly.

Buttons such as “Confirm Purchase Order,” “View All Order,” and “My LinkedIn” encourage the recipient to continue through the email.

The page is not a LinkedIn order portal

The main button redirects to a counterfeit webmail login. The observed page used a pages.dev address and imitated a cPanel-style mail service.

The email address may already appear in the form, creating the impression of a connected workflow. The page then asks for the mailbox password.

LinkedIn is not involved with this campaign. The platform’s name is being used to make an unexpected sales inquiry feel professionally sourced.

The real target is the company inbox

The criminals are not trying to complete an order. They want access to the mailbox used by sales, procurement, accounting, or another business role.

That access can expose customer conversations, quotations, invoices, and password resets. It can also support payment fraud sent from the legitimate address.

Important facts about this campaign include:

• The purchase order exists only inside the phishing story.
• The confirmation button opens an unrelated webmail sign-in.
• A prefilled email address does not prove account integration.
• The password is collected for mailbox takeover.
• Compromised business email can endanger customers and suppliers.

How the LinkedIn New Purchase Order Email Scam Works

Step 1: The message arrives as a valuable sales lead

Instead of threatening the recipient, this campaign offers something desirable: a customer who appears ready to buy.

The approach suits shared inboxes because multiple employees may handle inquiries. A person who lacks context can assume another colleague maintains the LinkedIn catalog.

Attackers can collect company names, job roles, and email addresses from public pages. That research helps them direct the lure toward employees likely to open orders.

The notification format reduces the need for a long explanation. It resembles an automated platform event rather than a cold message from an unknown buyer.

Step 2: Commercial details make the request feel plausible

The fake buyer supposedly reviewed available products and wants shipping information. That small detail mirrors questions genuine prospects ask before placing a substantial order.

The scam avoids specifying enough information to be checked. There may be no verifiable company, product list, quantity, delivery address, or purchase-order number.

Employees may click because the missing details seem likely to appear behind the button. Curiosity and fear of losing business replace the usual security hesitation.

A real procurement request should be independently attributable to a buyer. It should not require an email password merely to reveal what was ordered.

Step 3: The confirmation button leaves LinkedIn

“Confirm Purchase Order” sounds like a normal platform action. However, the link does not remain on an authenticated LinkedIn service.

The destination uses an unrelated hosting domain. In the examined campaign, the address was under pages.dev rather than a LinkedIn-owned web property.

Cloud development platforms legitimately host many sites, but criminals can also place temporary phishing pages there. Hosting reputation cannot validate the individual page.

The other buttons may lead to the same trap or decorative destinations. Their presence makes the email look complete without proving any functional relationship.

Step 4: A prefilled webmail form asks for the password

The landing page resembles webmail, not LinkedIn. It may display the recipient’s email automatically because that value was embedded in the phishing link.

Prefilling creates false confidence. It shows that the attacker knew the address receiving the campaign, not that the page recognized a genuine account.

The form asks for a password to view the order. LinkedIn would not need credentials for the recipient’s independent company mailbox.

After submission, the page may reject the password or show a loading message. This behavior can prompt a second entry and confirm the stolen value.

Step 5: The attacker searches the business mailbox

If the credentials work, the intruder can read current threads and identify people authorized to approve payments, release goods, or change supplier records.

Quotations and invoices reveal transaction sizes and payment schedules. Signatures provide names, roles, direct contacts, and the writing style used internally.

The attacker may create a forwarding rule for messages containing words such as payment, bank, invoice, order, or transfer.

That surveillance period can remain invisible. The criminal gains context before choosing a conversation where a fraudulent instruction is least likely to be challenged.

Step 6: A fake order becomes business email compromise

Once the real mailbox is controlled, the attacker no longer needs the LinkedIn disguise. Messages can be sent directly from a trusted corporate address.

Customers may receive altered bank details, malicious documents, or requests for advance payment. Suppliers may be asked to redirect refunds to another account.

Existing conversation threads are especially valuable. A small modification inside a genuine exchange can escape the checks applied to an unfamiliar sender.

The organization may also face privacy consequences if personal or contractual data was accessible. Recovery must cover more than the owner’s password.

How to Verify a LinkedIn Purchase Order Notice

Check LinkedIn without using the email

Open the LinkedIn app or type the known address independently. Review messages, notifications, and any business tools your organization actually uses.

If no corresponding buyer or order exists, do not return to the email. Capture the evidence and report it through your company’s security process.

Remember that LinkedIn is primarily a professional network. Treat an alleged purchase workflow as unusual unless your organization knowingly configured such a feature.

Validate the buyer and the order details

A legitimate purchase order normally identifies a legal entity, contact person, items, quantities, delivery address, payment terms, and unique reference.

Verify the buyer through independently found company details. Do not rely on a telephone number, domain, or profile linked only from the suspicious message.

Ask sales colleagues whether they recognize the conversation. Genuine deals usually leave a trail beyond one automated-looking email.

Inspect the link’s destination

A LinkedIn action should not send you to a generic cPanel webmail screen on an unrelated pages.dev site.

Look at the registered domain, not merely familiar words elsewhere in the address. Subdomains and page titles can contain any brand name an attacker chooses.

Never enter corporate email credentials after following an unsolicited order link. Open webmail through the organization’s established portal instead.

Ask what credential the action should require

This simple question breaks the story. Viewing a LinkedIn notification should not require the password for a separate business email provider.

Unexpected transitions between brands often reveal phishing. The email starts with LinkedIn, promises an order, then suddenly requests cPanel-style webmail authentication.

When a workflow crosses unrelated services without explanation, stop and verify every component through its own trusted entry point.

Why Purchase Orders Are Effective Phishing Bait

Purchase orders carry urgency without sounding threatening. Sales teams want to respond quickly, while accounting teams expect documents and external contacts.

Large organizations receive many legitimate inquiries. A generic request can hide inside ordinary volume, particularly when a shared mailbox rotates among employees.

Orders also justify attachments, links, and logins. Those routine actions give criminals several believable ways to introduce credential theft or malware.

The safest culture does not punish reasonable verification. Employees should feel comfortable delaying an order until the buyer, destination, and requested action are confirmed.

Organizations can reduce exposure by publishing a clear intake process. Buyers should know where orders belong, and employees should recognize departures from that process.

Signs the Mailbox May Already Be Compromised

Unexpected sent mail is one clue, but sophisticated intruders often avoid obvious spam. Subtle changes deserve equal attention.

• Security alerts disappear shortly after arriving.
• Replies are automatically moved into unfamiliar folders.
• Unknown forwarding addresses or delegates appear.
• Sign-in logs show locations or applications nobody recognizes.
• Customers report invoice changes the owner never sent.
• Password resets arrive for unrelated business services.

Check audit logs with an administrator when available. A local inbox view may not reveal deleted rules, OAuth grants, or sessions maintained elsewhere.

Preserve timestamps before cleaning the account. They can connect a credential submission with later logins, messages, and payment changes.

What to Do If You Fell Victim to This Scam

Treat the incident as a business mailbox compromise, not merely a bad link. Fast coordination can protect the company and its external contacts.

1. Contact your IT or security team. Provide the original email, the time you clicked, the information entered, and any page behavior you observed.
2. Reset the mailbox password. Work from the known company portal on a trusted system, then invalidate every existing session.
3. Strengthen authentication. Enable multifactor protection, regenerate recovery codes, and remove unknown authentication methods or application passwords.
4. Audit mailbox configuration. Review forwarding, inbox rules, delegates, connected apps, recovery addresses, and sent or deleted messages.
5. Examine linked business systems. Secure customer platforms, cloud storage, invoicing tools, and services that used the same password or inbox for recovery.
6. Alert customers and suppliers when necessary. Warn them about unauthorized payment changes, files, or requests sent during the exposure window.
7. Run Malwarebytes. Scan the affected workstation for downloaded malware, malicious browser extensions, or other threats that may accompany the credential page.
8. Add AdGuard protection. Use it as another layer against malicious destinations, while completing direct account and administrator-led recovery.
9. Review financial activity. Check invoices, bank-detail changes, shipments, refunds, and pending transfers associated with the compromised conversations.
10. Document the incident. Preserve logs and evidence for insurers, law enforcement, privacy review, and any affected business partners.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Anti-Malware Free — one of the most trusted malware removal tools available.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The whole process takes about 5 minutes.

Stay Protected: Block Ads and Malicious Sites

Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

Controls That Stop Fake Orders From Becoming Real Losses

Require secondary confirmation for new banking instructions, unusual shipping addresses, and urgent refund requests. Use a known channel, not details supplied in the message.

Separate sales intake from financial approval. One mailbox compromise should not give an attacker the ability to request and authorize a payment.

Configure external-sender labels, attachment scanning, and domain protections. These controls will not catch everything, but they make unusual transitions more visible.

Train employees with examples relevant to their work. A sales representative benefits more from purchase-order scenarios than from generic security slogans.

Finally, maintain a rapid reporting route. A five-minute warning to administrators can be far more valuable than quietly deleting the message after a mistake.

How Finance Teams Can Validate an Unexpected Order

Start by matching the buyer’s legal name against the purchase order, tax information, delivery details, and independently located company records.

New customers requesting immediate credit deserve careful review. Urgency should not bypass ordinary checks for authority, identity, and payment terms.

Call the buyer using a number obtained from a trusted directory or established company website. Do not use contact details supplied only in the order.

Confirm that the employee named on the request works for the organization. A real profile can also be impersonated, so profile existence alone is insufficient.

Inspect document metadata and reply paths when a file is provided. Mismatched domains or last-minute address changes require escalation.

For high-value shipments, verify delivery locations and payment clearance before releasing goods. Fraudulent buyers may use forwarding addresses or compromised accounts.

Keep approval records outside the email thread. An intruder controlling the conversation should not be able to rewrite the only evidence of authorization.

A legitimate customer generally accepts reasonable verification. Pressure to ignore normal controls is always a much stronger warning than the promised size of any important sale.

Frequently Asked Questions

Does LinkedIn send purchase orders by email?

The examined notice is not a genuine LinkedIn order. Verify any claimed platform activity inside LinkedIn rather than through buttons in the message.

Why was my business email already filled into the login form?

The attacker placed it in the link or page data. Prefilling demonstrates targeting, not a secure connection with your mailbox provider.

What does the fake page steal?

Its primary target is the email password. Variants may also request multifactor codes, recovery information, or other credentials during additional screens.

Could the buyer still be genuine?

A real buyer can be verified independently and can provide a complete order without demanding webmail credentials. This campaign’s workflow is fraudulent.

What if I clicked but did not enter a password?

Close the site, report the message, and scan any downloaded files. Watch for follow-up phishing tailored to your address and company role.

Should the company warn its customers?

If unauthorized access or messages occurred, yes. Scope the incident first, then send a clear warning through established channels without spreading the malicious link.

The Bottom Line

The LinkedIn new purchase order email is a business-focused phishing lure that redirects employees to a counterfeit webmail login on unrelated infrastructure.

Verify orders outside the message, protect corporate inboxes with layered controls, and investigate the whole mailbox if anyone submitted credentials.