How Fake Order Form Scams Target Small Businesses

A P3C Technologies help article  |  Updated September 25, 2026

What happened

Earlier this week, one of our clients received a paper form in the regular mail from a “vendor” they had never done business with. It billed them for 10 boxes of disposable gloves at $99.98 a box — just under $1,000. Nobody had ordered anything.

The staff member who opened it did a lot of things right. She called the number on the form (and got a recording saying the lines were “down for maintenance, please email us”), then emailed to ask who had placed the order. And then she did the most important thing: she checked with us before anyone paid a dime.

It was a scam, and a well-known one. The same template has hit businesses across the country under a rotating list of company names — usually about 10 boxes of gloves for about $1,000, often with a Florida PO box and a professional-looking website to match.

What it looks like

We recreated an example so you know what to look for. Everything on it is made up — the company, address, phone, and email are fake — but the layout and the wording follow the real thing closely. Take a look and see how many red flags you can spot before scrolling to the marked-up version.

An illustrative example created by P3C. Not a real company.

Here’s the same form with the red flags marked:

Red flags annotated. An illustrative example created by P3C.

The red flags

• It says “Order Form,” not “Invoice.” That’s deliberate, and it’s tied to the next flag.
• The fine print admits it isn’t a bill. Federal law requires mailed solicitations that look like invoices to carry a disclaimer saying so. These scammers include it, in small type, to stay technically legal. Paying is what “accepts” their offer.
• No PO number, no name of who ordered it, no account number. Real vendors reference your order.
• The price is way off. Roughly $100 for a 100-count box of disposable gloves is several times the going rate.
• The phone “doesn’t work.” A line that’s always “down for maintenance” pushes you into email, where they can collect information on their terms.
• They offer to send a W-9 or set up ACH payments by email. This is the real prize. Your EIN and bank details are worth far more to a scammer than $1,000 in glove money.

And one that isn’t a red flag, but trips people up: the company has a website that looks legitimate. That’s part of the setup. A search that turns up a nice website proves nothing.

What to do if you get one

1. Don’t pay it. Not even a partial amount to “make it go away.”
2. Don’t reply, call back, or open attachments from the sender. If they email you, forward it to your IT provider instead of clicking anything.
3. Never send a W-9, EIN, or banking information to a vendor you can’t verify through an existing relationship.
4. Tell Accounts Payable. Flag the company as do-not-pay, because a “past due” or “final notice” follow-up is likely — and it will sound more urgent than the first one.
5. Keep the original. Hang on to the paper form and envelope in case you decide to report it.
6. If a box actually shows up, you don’t have to pay for it or send it back. More on that below.

Your rights with unordered merchandise

The Federal Trade Commission is clear on this: companies can’t send you merchandise you didn’t order and then demand payment. You don’t have to pay for it, you don’t have to return it, and you’re legally entitled to keep it as a free gift. The FTC explains it in plain English here:

FTC: What To Do if You’re Billed for Things You Never Got, or You Get Unordered Products

Reporting it (optional)

You can report the scam to the FTC at ReportFraud.ftc.gov. Because it came through the mail, you can also report it to the U.S. Postal Inspection Service. Reports help investigators connect the dots between the rotating company names. P3C clients: we’re happy to help you file.

What we did behind the scenes

Once our client had emailed the scammers, they had two live addresses to target — including the accounts payable mailbox. So we blocked the sender’s email domain in our email security platform, and we didn’t stop at the one client. We applied the block for every P3C client, since this scam hits businesses everywhere. We also watched the affected mailboxes for follow-ups.

That’s the part we want you to take away. One person asking one question protected everyone we support.

A simple habit that stops this cold

Make it a rule that nothing gets paid without a matching purchase order or a confirmation from the person who ordered it — and that new vendors are verified by phone at a number you found yourself, not the one printed on the bill. It takes thirty seconds and shuts down this entire category of scam.