Knowledge Base

Overview 

This article helps you check token-delivery emails against your order, verify shipment information independently, and recognize when to contact Sectigo Support or your Information Technology (IT) security team. 

Important: A familiar sender, matching order number, or recognizable branding is not sufficient proof that an email is genuine. 

Applies to 

Sectigo hardware token orders. 

1. Check the sender—but do not rely on it alone 

The expected sender for the shipment notification and encrypted token-password email is [email protected]. 

Expand the sender details and inspect the full address rather than relying on the display name. 

Watch for misleading addresses such as sectigo-support.com, sectlgo.com, or sectigo.secure-mail.net. 

Even an address that appears correct should be checked alongside independent order and shipment information; ask your security team to investigate if anything is uncertain. 

2. Confirm the order independently 

Access your order records through your usual trusted method—not through a link in the email being checked. 

For orders managed in Sectigo Certificate Manager, compare the order number and status with the message. 

If you cannot find a matching order, check with the order administrator, your reseller, or Sectigo Support before concluding that the email is fraudulent. 

A missing match may require investigation; it is not, by itself, a definitive authenticity test. 

3. Verify the tracking number independently 

Open the carrier’s website independently and enter the tracking number rather than following a link in the uncertain email. 

Carriers identified for Sectigo token shipments include UPS, FedEx, DHL, and Canada Post. 

Matching tracking information helps confirm shipment details but does not establish that every link or request in the email is safe. 

4. Review destinations before opening links 

Preview the complete destination address where your email application allows it. 

Do not rely on a familiar company name appearing somewhere in an address. 

Treat shortened links, unfamiliar destinations, and misleading addresses as reasons to pause and investigate. 

For uncertain encrypted-message access links, ask Sectigo Support or your security team to confirm the approved destination before entering any credentials. 

5. Understand encrypted-email authentication 

Sectigo’s shipment notification directs you to look for a separate encrypted token-password email in your mailbox. 

Searching your mailbox avoids following an uncertain retrieval link, but the second message still needs independent verification. 

Opening encrypted content may involve authentication with your email provider or a one-time passcode sent to your email address. 

Distinguish these actions: 

• Email-access authentication: Signing in through a confirmed, approved access page to read protected email. 

• Password disclosure: Sending a password in a reply, sharing it with someone requesting it, or entering it into an unverified form. 

Do not provide your token password or Sectigo account password in response to an email request. 

A request for your Sectigo Certificate Manager password to unlock the encrypted email is a warning sign. 

Do not download untrusted attachments or install unverified software to access a purported secure message. 

6. Investigate unexpected payment requests 

Requests for card details, bank information, or payment to release a certificate should be independently verified before you respond. 

Customs duties or taxes may apply to a shipment; verify these directly through trusted carrier or customs-authority channels rather than an uncertain email’s payment link. 

If you suspect phishing 

1. Stop interacting with the message. Do not open its links or attachments. 

2. Report it to your IT security team using your organization’s approved reporting method. 

3. Report the concern to Sectigo at https://sectigo.com/support-ticket, preserving the original message and full headers where permitted. 

4. If you entered credentials, change the affected password immediately through a trusted account-access method and notify your security team. 

Your security team can review message headers and authentication results as part of its investigation. 

If your token password may have been exposed 

If you can access the token, change its password immediately using Change Token Password in SafeNet Authentication Client, then contact Sectigo Support. 

If you cannot access the token, contact Support for assistance. 

Also notify your security team so it can assess possible unauthorized signing or certificate/private-key exposure; do not treat a password change alone as confirmation that the incident is resolved. 

Need help? 

Use contact details obtained independently—not those supplied only in the suspicious message. 

• Support ticket: https://sectigo.com/support-ticket 

• United States: +1 (888) 266-6361 

• International: +1 (703) 581-6361.