Skip to main content
Skip to article content

The courier knew the order number. Was that enough to hand over 600 programmes?

By Ṣọ Email Security•2 min read estimated reading time

A courier knows the order number. A second email confirms pickup. Here’s why the print shop should call the customer before releasing the boxes.

Email SecurityBusiness Email CompromiseFraud PreventionSmall Business Security

The courier knew the order number. Who said he could take the boxes?

Picture a Monday morning at a print shop. Maya has paid for 600 event programmes and arranged to collect them herself. The boxes are ready when a courier walks in, gives you Maya’s name and reads out the correct order number.

You check your inbox. There’s a message about the courier, and someone at the shop has already replied to double-check. The answer is yes.

Would you hand over the boxes? Before you do, look at who had the chance to answer.

Three messages, one mailbox

9:12 a.m. · From Maya’s address: “Change of plan. A courier will collect the boxes for me.”

9:14 a.m. · From the print shop: “Maya, did you authorise this change?”

9:15 a.m. · From Maya’s address: “Yes, that’s right.”

The person at the counter did something sensible: they noticed that the pickup plan had changed and asked about it. The problem was where they asked. Their question went straight back to the mailbox that requested the change.

If someone else has access to Maya’s inbox, that person can read the original order, see its reference number and answer the shop’s question. That explains how a courier could know the right details without Maya ever asking him to collect anything.

There’s no suspicious link to spot in this example. The email asks the shop to do something ordinary: pass two boxes across a counter.

What to do while the courier is waiting

Keep the boxes behind the counter and tell the courier, “Maya arranged to collect these herself. Let me give her a call before I release them.”

Use the phone number Maya gave the shop when she placed the order. If the email about the change includes a different number, leave that one aside. The person who wrote the email may also answer it.

On the call, ask an open question: “Maya, I have your programmes ready. Who have you arranged to collect them?” Let her supply the details. If she confirms a courier, match those details to the person at the counter and follow your usual pickup procedure. If she says she’s coming herself, or you can’t reach her, keep the original arrangement.

Give the next shift a rule it can use

Write one sentence on the order sheet: “If the collector changes, call the customer on the number recorded with the original order before releasing the goods.” Leave space beside it for the confirmed collector’s name and the initials of the person who made the call. That way, the next person at the counter knows what “confirmed” means.

SO Mail helps you review suspicious emails. For a pickup change, check directly with the customer before the boxes leave. SO Mail is available on iOS and Google Play. Visit soemailsecurity.com.