Fake Home Depot Order-Confirmation Phishing
Fraudulent emails mimicking Home Depot order confirmations for tools, appliances, or large purchases alarm recipients into clicking a phishing link to cancel the supposed transaction.
Part of: Fake Order Confirmation Phishing Scams
Last reviewed: 7 June 2026
Home Depot's Buy Online, Pick Up In Store and Home Delivery services send genuine purchase-confirmation emails for everything from power tools to large appliances. Scammers leverage this by sending fake Home Depot purchase emails referencing expensive products the victim would immediately want to dispute.
The emails are styled with Home Depot's orange branding and include fake order numbers formatted to look authentic. Large-ticket items like riding lawn mowers, kitchen appliances, or tool sets are common choices because the apparent dollar amount is alarming enough to provoke immediate action.
General Home Depot purchase confirmations include the store location for pickup orders or a verified delivery address, the item SKU, and an order total. Fake emails typically omit specific store or address details, or include placeholder information inconsistent with the recipient's known location.
How this scam works on the Home Depot brand
The phishing link in a fake Home Depot order email usually leads to one of two destinations: a fake Home Depot sign-in page designed to harvest credentials, or a page that displays a phone number to call. The 'Home Depot agent' who answers will attempt to gather remote access to the victim's device under the pretext of 'securing the account'.
Some campaigns use the same fake order email as a pretext for a follow-up call. A recording or live agent calls the victim to 'confirm' the cancellation request, asks for the victim's Home Depot account password or full card number 'for verification', then uses those details for fraud.
Because Home Depot serves a largely homeowner and contractor audience, some scam variants reference large lumber or building-materials orders rather than consumer electronics — amounts that could plausibly represent a contractor's project order and therefore seem urgent to dispute.
Common red flags
- Email sender is not @homedepot.com
- No pickup store location or verified delivery address in the email body
- A customer-service phone number provided in the email — Home Depot's real cancellation is done online at homedepot.com
- The 'Cancel Order' or 'View Order' link resolves to a domain other than homedepot.com
- You have no such order when you log in directly at homedepot.com
- The email requests your Home Depot account password or card number to 'cancel'
How to protect yourself
- Check your Home Depot account directly at homedepot.com by navigating to My Orders
- If the order does not exist in your account, the email is fake — do not click any links
- If the order does exist and you did not place it, immediately change your Home Depot password and contact Home Depot Customer Care at homedepot.com
- Never call a phone number in an unsolicited email claiming to be from Home Depot
How to report it
- Forward phishing emails to [email protected]
- Report to the FTC at reportfraud.ftc.gov
- If your account was accessed, contact Home Depot Customer Care through homedepot.com/c/customer_service
Frequently asked questions
What does a real Home Depot order confirmation look like?
Real Home Depot confirmation emails come from @homedepot.com, include your full name, the pickup store or delivery address, and a real order number you can verify at homedepot.com under My Orders.