Recognizing legitimate vendor communications

Phishing attempts targeting people who use novelty ID vendors are a real thing. Someone who searches for vendor reviews or visits vendor sites leaves a browsing profile that phishing operations can target. Here is how to tell real vendor messages from fake ones.

What legitimate vendor messages look like

Real order updates come from the email address you registered with when placing the order, or from a message system within the vendor's site. The sender domain matches the vendor's actual domain. The message references your specific order number and does not ask for payment information you already provided.

Red flags in suspicious messages

Any message asking you to re-enter payment information is a red flag. Legitimate vendors never need your payment details after the initial transaction. A message saying your order is on hold pending an "additional verification fee" is a scam — this is not how any real vendor operates.

Messages from slightly wrong domain names — fakeidvendors.com instead of fakeidvendor.com, or an email from "[email protected]" claiming to be a vendor — are phishing attempts. Check the exact sender address character by character.

Links in emails

Never click payment links in vendor emails without verifying the destination. Hover over or long-press any link in an order email to see the actual URL before clicking. If the URL does not match the vendor's known domain, do not click it.

When in doubt

Go directly to the vendor site by typing the URL yourself rather than clicking any link. Log into your account and check order status there. If something seems off, reach out to the vendor using contact information you already have from their official site, not from the suspicious message. Legitimate vendors will not penalize you for verifying through a direct channel.

One additional red flag: legitimate vendor support messages should never request your private key, wallet seed phrase, or any credential other than your order number. Any message requesting payment credentials, asking you to install software, or directing you to a URL that differs from the vendor's known domain is a phishing attempt regardless of how official the message appears. Verifying through the vendor's established channel before taking any action is always the right response to an unexpected communication.