I woke up this morning to two notifications from around 2am from Moonpig.com* saying "Thank you for your order!" - neither of which I'd made.
Checking into it further, each order was for £53 - a card plus a giant candle, sent to an address I didn't recognise.
Presumably part of a scam (which I'd heard of somewhat vaguely) where expensive items are delivered to a third party, and then the scammers collect them from there, before selling them on second-hand.
The Moonpig helpline didn't open until 9:30am, but I got straight on it then, they were incredibly helpful, and by 9:35 it was all fixed with both orders being cancelled. Quite impressed with their service.
And it serves me totally right for having a password that I hadn't changed in over a decade. Because I hadn't considered that "that place I order birthday cards from" was a threat.
*They make custom cards and send them out automatically. They also sell candles, flowers, and other gifts. They're really useful for birthdays, etc.
Original post on Dreamwidth - there are
![](https://www.dreamwidth.org/tools/commentcount?user=andrewducker&ditemid=3865049)
comments there.