ACCOUNT TAKEOVER REPORT

Argos account hacked: the takeover fraud behind orders you did not make

An order confirmation from Argos for something you never bought, a changed delivery address, or spent points you did not spend, usually means someone logged into your account, most often with a password you reused from another site. Here is exactly how the takeover works and what to do about it in 2026.

SB

SafeBrowz Threat Research Security ResearchJuly 1, 20268 min read

What an account takeover looks like

Account takeover is quieter than a phishing email, because nothing lands in your inbox asking you to click. The first sign is usually the aftermath. You get a real order confirmation, from the real Argos, for something you did not buy.

The tell-tale signs, in the order people tend to notice them:

• An order confirmation for an item you never ordered, often a high-value one like a games console, phone, or laptop, set for click-and-collect at a store.
• A delivery or collection address you do not recognise, because the criminal changed it to a store or address they can reach.
• Argos loyalty points, vouchers, or gift-card balance spent without you touching them.
• A password-changed or email-changed notice you did not request, which can mean they are locking you out.
• A charge you cannot explain, or no charge at all. Sometimes the criminal adds their own unrelated card to the account so the purchase does not hit your saved card, and you do not see a payment leave your bank until you go looking.

The click-and-collect part is what makes this attractive to criminals. They never need a delivery to their door. They order to a store, walk in, and collect the goods, then the account goes cold.

How the criminals get in

There is no clever hack of Argos here, and no malware on your device is needed. The method is called credential stuffing, and it works because of one habit: reusing the same password across different sites.

It goes like this. Some other company, nothing to do with Argos, suffers a data breach and their user list leaks. That list contains email addresses and passwords. Criminals buy or download these lists, then use automated tools to try each email-and-password pair against lots of popular services, Argos among them. If you used the same password on Argos that you used on the site that got breached, the pair still works, and they are straight in.

Once inside, they behave like you: they place an order, usually changing the collection point, and sometimes add their own card so your saved payment method is not touched and you get no immediate alert. You find out from the order confirmation, the changed address, or the spent points, not from anything you did wrong on the day.

This is worth being clear about, because it changes the fix. A takeover from a reused password is a separate problem from a fake Argos login page. A phishing page, on a lookalike domain, is one of the ways attackers harvest a fresh password directly from you. Credential stuffing reuses a password that already leaked somewhere else. Both end in a stranger inside your account, and you want to close off both.

The fake pages that harvest passwords in the first place

Reddit's real login and Argos's real account both live on their own domains. Argos is argos.co.uk, and its help and fraud-reporting pages live at help.argos.co.uk. Anything else asking for your Argos password is a fake. The lookalike pages below are illustrative patterns, not live sites, showing the shape phishing reuses to steal a fresh Argos password, which is the other route into your account.

• argos-account-verify[.]com (Argos does not run account verification on a separate "verify" domain)
• argos-order-confirm[.]net (a fake "confirm your order" page built to capture your login)
• my-argos-rewards[.]co (a "claim your Argos points" lure on a cheap lookalike domain)
• argos-secure-login[.]help (Argos's real login is on argos.co.uk, never a "secure-login" host)

The page behind an address like these can be a near-perfect copy of the real Argos sign-in. What it cannot fake is the registered domain in the address bar. If you reach a "log in to Argos" page from a text, email, or ad and the domain is not exactly argos.co.uk, do not type your password.

What to do right now if it happened

1. Change your Argos password to a unique one. Go to argos.co.uk directly, sign in, and set a password you have never used anywhere else. If you are already locked out, use the password-reset flow or contact Argos to regain access.
2. Turn on two-factor authentication where the account offers it, so a leaked password alone is not enough to get back in.
3. Contact Argos. Report the fraudulent order and any changed details through help.argos.co.uk so they can cancel the order and secure the account.
4. Report it to Action Fraud on 0300 123 2040, or online at actionfraud.police.uk, the UK's national reporting centre for fraud.
5. Change that same password everywhere else you used it. If the criminal got in through a reused password, every other account with that password is exposed too. This is the single most important step for stopping it spreading.
6. Check whether your details have leaked at haveibeenpwned.com, a free breach-lookup service. If your email shows up in a breach, treat every password you used at the time of that breach as compromised.

Updated July 1, 2026.

How to prevent it happening again

Because the root cause is password reuse, the prevention is about passwords, not about spotting a clever message.

• Use a unique password for Argos, and for every account that matters. A password used in only one place cannot be stuffed into another when a different site is breached.
• Turn on two-factor authentication wherever it is offered. Even if a password leaks, the attacker still cannot log in without the second factor.
• Use a password manager so that "a unique password for everything" is actually workable. It generates and remembers long random passwords so you do not have to.
• Check haveibeenpwned regularly so you know when an email of yours turns up in a breach, and can change the affected passwords before criminals get there.

How SafeBrowz helps, and where it cannot

Being honest about scope matters here, because account takeover has two doors and SafeBrowz only guards one of them. SafeBrowz uses its 3-layer detection (Local + APIs + AI).

• Layer 1, local detection, runs inside the browser with 60+ URL pattern signatures and 550+ brand signatures. If you reach a page impersonating Argos on a domain that is not argos.co.uk, it flags the fake login before the form even finishes loading.
• Layer 2, reputation and API checks, aggregate threat intelligence including Google Safe Browsing, PhishTank, URLhaus, ScamAdviser, and scam-TLD signals, so a fake "Argos order" link that has already been reported is caught on reputation alone.
• Layer 3, AI content analysis via our proxy (Premium), reads the live page in 100+ languages and recognises a login-and-credential-capture layout impersonating a brand, which flags a brand-new clone no blocklist has seen yet.

Where SafeBrowz helps: it blocks the fake Argos login and phishing pages that steal your password in the first place, and it flags the fake "your Argos account order" confirmation links that lead to those pages. That closes the door where a fresh password gets harvested.

Where it cannot help, plainly: SafeBrowz cannot stop a criminal reusing a password that already leaked from a completely different company's breach. No browser tool can, because that login happens on the real Argos site with a real password. That door is closed only by a unique password plus two-factor authentication. Use SafeBrowz to stop the phishing route, and unique passwords with 2FA to stop the credential-stuffing route. Together they cover both. The free browser extension does this on desktop, and the SafeBrowz Android app on Google Play applies the same engine on your phone.

Detection signatures come from threat-intelligence research and our internal brand database, not from user browsing data. SafeBrowz does not store per-user browsing history.

Bottom line: an Argos order confirmation for something you did not buy means your account was taken over, and the usual cause is a password you reused that leaked in someone else's breach. Change it to a unique password, turn on two-factor authentication, tell Argos through help.argos.co.uk, report to Action Fraud on 0300 123 2040, and change that password everywhere. Put SafeBrowz on your browser so the fake Argos login page that harvests passwords gets flagged before you ever type one in.

Frequently asked questions