Oh fun. Fake payment confirmation scams are back (or more likely have been there all along and simply managed to slip one by my spam filters).

I hadn't really thought out it in these terms before, but this is a fine argument for enabling real-time transaction alerts with one's bank or payment card processor. Not only do those alerts give an immediate heads-up to an unauthorized transaction, but it's pretty obvious that an emailed "confirmation" is fake, when there is no corresponding transaction alert from my bank.