Beware the FAKE Rooftop Macarons Order Confirmation Scam Email

If you’ve recently received an email that appears to be from the popular Sacramento bakery Rooftop Macarons thanking you for an order, don’t click on any links right away. Scammers are sending out fake “thank you for your order” emails claiming to be from Rooftop Macarons in an attempt to infect devices with malware and steal personal information.

Overview of the Rooftop Macarons Order Confirmation Scam

This phishing scam involving Rooftop Macarons aims to trick recipients into believing they have placed an online order with the bakery. The email includes details like an order number, amount charged to a credit card, and a link to download an invoice or track the fake order.

The email is made to look like an official order confirmation notice from Rooftop Macarons. However, a closer examination reveals many red flags:

• The sender address does not match Rooftop Macaron’s official email address.
• There are grammatical errors, typos, and other odd phrases throughout the email
• It states that a charge has been made to the recipient’s credit card, when no real order was placed

Here is how this email scam might look:

Thank You For Ordering
Invoice 4552
Your order Has been placed with Credit Card ending ****.
$1445.5 ammout has been charged from the card.
You can download invoice and tracking your oder
Thank you ffor shupped form us

If the recipient clicks on the link, malware is automatically downloaded onto their device. This malware is designed to steal financial and personal information, including:

• Credit card numbers
• Bank account details
• Passwords
• Usernames
• Social security numbers
• Other sensitive data

With this data, scammers can engage in identity theft, drain bank accounts, make fraudulent charges, access other online accounts, and more. The malware can also potentially give attackers remote access to infected devices.

Rooftop Macarons has publicly denied sending these fake order confirmation emails. They stated on social media that the scam messages are not from their official email address and warned customers not to click on any links.

How the Rooftop Macarons Order Confirmation Scam Works

The scammers behind this phishing campaign are able to make the fake order confirmation emails appear convincing through specific techniques:

1. Sending from a spoofed email address

While the sender address on the email looks legitimate at first glance, it does not actually match Rooftop Macaron’s real domain. The scammers use a forged email address that looks similar to the bakery’s actual address.

2. Including fake order details

The email includes made-up specifics like an order number, amount charged, and credit card details. These details are fabricated to make it seem like a real recent purchase was made by the recipient.

3. Embedding malicious links

The emails contain links supposedly to download an invoice or track the fake order. These links actually install malware on devices.

4. Mimicking the tone/branding of a real order confirmation

The phishing emails closely imitate the messaging that a customer would receive after placing a real online order. This includes using the Rooftop Macaron logo and mimicking the tone of a legitimate confirmation notice.

5. Relying on urgency/curiosity

By making it seem like the recipient has been charged over $1000 for an order they didn’t place, the scammers hope the urgent need to contest the charge or curiosity about the situation will drive people to click the links.

6. Taking advantage of the brand’s reputation

The scammers exploit Rooftop Macaron’s reputation as a popular bakery that people are likely to have ordered from or at least be familiar with. This familiarity with the brand makes the fake confirmation more believable.

By combining these tactics, the scammers are able to trick a percentage of recipients into clicking on the embedded malicious links. Even a small amount of clicks can be enough for them to infect large numbers of devices and gain access to significant amounts of personal data.

What to Do If You Receive the Rooftop Macarons Order Confirmation Scam Email

If this phishing email ends up in your inbox, take the following steps right away:

1. Delete it immediately

Do not click on any links within the email. Delete it right away before even fully opening the message.

2. Mark it as spam

This will help filter future scam emails coming from the same address. In Gmail, you can click the dropdown menu next to the sender’s name and choose “Report phishing.”

3. Contact your credit card company if applicable

If the email includes partial credit card details, contact your credit card company to notify them of the phishing attempt and have them monitor your account for suspicious charges.

4. Run an antivirus scan

Even if you did not click on the link, run a scan to check for any malware that may have reached your device through other means.

5. Enable two-factor authentication

Adding an extra layer of security like two-factor authentication on important accounts can prevent criminals from gaining access even if they obtain your password.

6. Change passwords

Update passwords on your email, banking, shopping and other important online accounts. Make them strong and unique for each account.

7. Be extra cautious of any unsolicited emails

Going forward, be wary of any unexpected emails asking you to click links or download attachments. Verify the sender address is legitimate before interacting with the message.

8. Report the scam email

Forward the phishing email on to the Anti-Phishing Working Group at phish@apwg.org to help identify and stop scammers.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Free — one of the most trusted malware removal tools available.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.

Stay Protected: Block Ads and Malicious Sites

Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

Frequently Asked Questions About the Rooftop Macarons Order Confirmation Scam

1. I received an email thanking me for an order I never placed. Is this the Rooftop Macarons scam?

Yes, if you received an email about an order you never actually made claiming to be from Rooftop Macarons, it’s likely this phishing scam. The email may include fake order details like an order number, amount charged to a credit card, and a link to download the invoice. This scam aims to install malware or steal personal information. Do not click on any links within the suspicious email.

2. How can I tell if an order confirmation email from Rooftop Macarons is fake?

Warning signs include grammatical mistakes, a sender address that doesn’t match the official email adress, an urgent call to action, personal information you never provided, and an order number for a purchase you didn’t make. Any email with these red flags should be considered a scam.

3. What information are scammers trying to gain with the fake Rooftop Macarons order email scam?

This phishing campaign aims to steal personal and financial information such as credit card numbers, bank account details, passwords, and usernames. The malware installed when clicking their links can give them access to this sensitive data for identity theft.

4. I clicked the link in the fake Rooftop Macarons order confirmation email. What should I do now?

First, scan your device for malware and remove anything suspicious detected. Change passwords on all of your online accounts, starting with banking and email accounts. Contact your credit card company to monitor for unauthorized charges. Enable two-factor authentication wherever possible for an extra layer of security.

5. Is Rooftop Macarons being hacked? How are scammers sending fake emails from their domain?

Rooftop Macarons itself has not been hacked. The scammers are simply spoofing the domain to make it look like the email is coming from rooftopmacaron.com. The fake sender address is designed to imitate the real one. Rooftop Macarons has confirmed they did not send these phishing emails.

6. I operate an online business. How can I avoid having my domain spoofed for phishing like Rooftop Macarons?

Utilize email authentication protocols like SPF, DKIM, and DMARC. This will verify your legitimate outgoing emails and prevent scammers from spoofing your domain. Also educate customers on phishing threats and let them know to watch for any suspicious emails claiming to be from your business.

7. What precautions can I take to avoid falling victim to order confirmation phishing scams?

Carefully check the sender address on any unexpected emails and look for phishing red flags before clicking links. Avoid entering sensitive information on websites you access via email links. Enable multi-factor authentication when available. Monitor financial accounts regularly for fraudulent activity.

8. Where can I report the fake Rooftop Macarons order confirmation scam emails?

Forward any phishing emails you receive to the Anti-Phishing Working Group at phish@apwg.org. You can also report phishing attacks directly to Google, Microsoft, or any other email provider you use. Reporting scams helps mitigate the threat for everyone.

The Bottom Line

This scam takes advantage of Rooftop Macaron’s reputation to trick customers into infecting their own devices. If an email “thank you for your order” lands in your inbox seemingly from this bakery, proceed with extreme caution.

Look for signs it is fake, like grammatical errors and a forged sender address. Do not click on any links or download any attachments. Delete it right away and take steps to further protect your data and accounts from phishing. Staying vigilant for common signs of email scams can keep you safe.