This scam involves my HomeDepot.com account. For those not in the US, Home Depot is a chain of very large home improvement / DIY stores.
Background / how I knew my account was compromised:
Yesterday I received 3 emails from Home Depot, followed by roughly 100 spam emails that all made it through the hotmail spam filter. The 3 emails from Home Depot were:
- Shipping address change
- Credit card added
- Order confirmation (about $1000 worth of power tools)
I did not have a credit card of mine on file. The credit card added was not mine. The shipping address for the order was a residential address about 10 miles from my address (same zip code).
I contacted Home Depot using the customer service number on their site and explained I had not placed the order. The rep said she thought it came about through someone placing the order over the phone, giving an email address close to mine and a Home Depot rep entering that person's information into my account. She said she would cancel the order and insisted my account had not been compromised.
At this point I did not make the connection between the deluge of spam mails and the Home Depot order so I considered her explanation plausible. I deleted the address and credit card from my account.
Today the same thing happened again. Another 3 emails from Home Depot (address change, credit card added, order placed, $1000 power tools) followed by another 100 spam emails. This made me (finally) realize that my account had indeed been compromised.
This time I changed my password and enabled 2FA authentication. I contacted Home Depot again and the order was canceled (they have a very inane system where the customer cannot cancel an order from their website, they have to cancel it).
Some things to note:
- Shipping address for second order was a different address, some 20 miles from my location, different zip code but fairly close
- Credit card used was the same as for the first order, or at least the last 4 digits are the same. I cannot see the full credit card number, just that it was a Mastercard and the last 4 digits
Now to my question:
- What is the endgame for this scam? The credit card used was not mine. Why use my account to place an order instead of creating a new account? I understand the deluge of spam emails is to try to hide the order confirmation / address change emails, but why? Why not just create a new account at Home Depot, which is free, and place the order from there?
I do not believe the residential addresses used are those of parties involved in the scam / theft. I'm guessing part of the scam is to contact the shipper once the order ships and divert the shipment to either a Home Depot store for pickup, or to a shipping center for pickup.
But I do not understand why bother to do all this through my account