Description: An unfamiliar business thanks you for an inquiry you never made. Its confirmation includes a fake-looking crypto balance and a suspicious link. Here's how a contact form can be hijacked as a delivery service.
Answer: Someone may have entered your email address into a public form and made the business's automated reply carry a scam. That message alone does not demonstrate a compromise of your inbox.
Thanks for contacting us. Sorry, when?
A restaurant you've never contacted sends a polite confirmation: they'll reply shortly. Reply to what? You didn't even ask for a menu.
The supposed customer's name is gibberish. The message promises a large USDT balance and tells you to follow a link. No question about food; just a cryptocurrency lure dressed up as a customer inquiry.
This pattern fits contact-form autoresponder abuse. It doesn't establish who submitted the form, whether a bot was involved, or where the address was obtained. The restaurant may be another victim.
How an innocent business becomes a courier
- A third party opens a public contact form.
- They put someone else's address in the reply field and a lure in the name or message.
- The site automatically sends an acknowledgment quoting the submitted content.
- The target receives an email associated with a real business but containing the scam.
Business: “Thanks for your inquiry.” Recipient: “I didn't inquire.” Scammer: “Delivery complete.” Nobody is having the same conversation, but the package arrives on time.
Japan's Information-technology Promotion Agency documented a separate 2020 case involving more than 100,000 malicious messages sent through automated replies. That historical number is not the count for this example.
Was my email hacked?
The reply alone doesn't tell you that. Visitors can type another person's address into many forms, and the website may not verify ownership before sending an acknowledgment.
Your address could have come from public data, an old breach list, or another source; this one message cannot identify which. If you also find unknown sign-ins, unfamiliar sent messages, or altered account settings, review account security separately.
What should the recipient and the website do?
Don't open the embedded link or try to claim the alleged balance. Report the mail as spam or phishing and delete it. If an actual account needs checking, use a trusted official site or app you already knew. Repeated episodes may justify keeping basic timestamps and subject lines.
Site owners should ask whether autoresponses need to echo visitors' names, free-text messages, or links. Removing unnecessary content, limiting submission volume and blocking automated abuse can reduce the risk. Contact Form 7 explicitly warns about sending to visitor-supplied addresses without sufficient protection; that warning does not prove this business used Contact Form 7.
The unwanted delivery
The recipient gets spam, the business risks its reputation and mail deliverability, and the attacker gets an unpaid courier. Nobody ordered dinner, but phishing arrived as takeout. Send it back to the kitchen.
Sources: IPA incident report (2020), section 5 · Contact Form 7 safety warning · FTC phishing guidance
