Treat every unexpected shipping alert, offer, or account notice as untrusted until you verify it independently. Check the sender, hover over links, compare the tone and details with past messages, and confirm the claim through a known website or trusted phone number. If anything feels off, close the message, do not download attachments, and report it to your IT team if it arrived at work.
How to check a shipping or shopping email before you click
Start by treating the message as a claim, not proof. A legitimate email should still be verified through a separate path, such as typing the company’s address yourself, using the official app, or calling a number you already trust. The goal is to confirm the shipment, offer, or account notice without relying on the email’s own links or attachments.
What to inspect in the message itself
Check the sender address carefully, not just the display name. Small spelling changes, odd subdomains, or a reply-to mismatch are common warning signs. Then read the message for pressure, generic greetings, mismatched order details, unusual payment language, or a tone that does not match the company’s normal communications.
Hover over links before clicking and compare the visible text with the actual destination. A link can look like a shipping tracker, login page, or refund form while sending you somewhere else entirely. If the URL is shortened, unrelated, or slightly altered, stop and verify the claim another way.
Attachments deserve the same caution. Shipping notices sometimes hide invoices, labels, or customs forms that are really malware delivery points. If you were not already expecting a document from that sender, do not open it until you have confirmed the message through an independent source.
Verify the claim outside the email
Use a known-good path to confirm the message. For a delivery alert, go to the retailer or carrier website yourself and check the order or tracking number there. For an account notice, sign in from a bookmark or the official app instead of using any button in the email. If the message asks for payment, credentials, or personal data, verify through a trusted phone number or support channel you sourced independently.
The most useful habit is to compare the email with what the company has sent you before. Real notices usually match the brand’s normal format, timing, and level of detail. When the content feels slightly off, that mismatch matters even if the message looks polished.
What to do when something does not add up
If the email creates any doubt, do not use the embedded links, do not download files, and do not reply to the sender to “confirm” it. Close the message and verify the event another way. If it arrived in a workplace mailbox, report it so others can be warned before someone else clicks the same lure.
What to verify: Confirm the sender, destination URL, and business claim independently before you trust any action request. A legitimate shipping or shopping notice should still make sense when checked through a separate channel.
Common mistake: People often trust a message because the logo looks right or the tracking language feels familiar. Attackers rely on that reflex, so the safer test is whether the claim survives outside the email.
Decision rule: If the message asks you to act quickly, log in, pay, or open a file, pause and verify through a channel you initiated yourself. If you cannot confirm it that way, treat it as untrusted.
Practitioner takeaway: The safest verification pattern is to separate identity of the sender from legitimacy of the claim, then confirm both through an independent source before any click, download, or payment step.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST Zero Trust (SP 800-207), NIST SP 800-53 Rev 5 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST Zero Trust (SP 800-207) | N/A — Zero Trust Architecture | Verifying messages through a separate trusted path follows verify-first trust discipline. |
| Recommendation — Apply verify-first trust checks before acting on email links or attachments. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Suspicious email reporting and review support detection of phishing and related abuse. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Reviewing reported messages and outcomes helps validate suspicious-email handling. | |
| Recommendation — Monitor and triage suspicious messages as potential indicators of malicious activity. Review and report suspicious email events for timely investigation and response. | ||
| NIST SP 800-63 | N/A — Digital Identity Guidelines | The advice to avoid trusting email links supports phishing-resistant verification of identity claims. |
| Recommendation — Use phishing-resistant verification paths instead of email-supplied links. | ||
| MITRE ATT&CK | T1566 — Phishing | Shipping and shopping lures are common phishing delivery patterns. |
| Recommendation — Hunt and train for phishing lures that impersonate shipping or shopping services. | ||
Related resources from NHI Mgmt Group
- How should people verify whether a COVID-related message is legitimate before they act on it?
- How should people verify a bank SMS or email before clicking a link?
- How should teams verify whether a Python package release is legitimate before upgrading it in production?
- How should job seekers verify whether a recruiter outreach is legitimate before sharing personal information?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org