I’m another vote for phishing. Key things to check (WITHOUT CLICKING IN THE EMAIL):
-hover your cursor over the senders email (sometimes the email address is made to look legit, sometimes they change the name but not the actual address and you something like
evilbob@gmail.com)
-how’s the English look? 100% totally normal or is it a bit weird in places?
All that said, don’t click on it or call any numbers in it. If you think it’s legit call Bath and Body Works and they’ll be able to tell you if you have an order in process. If you don’t think it’s legit/not sure you can forward it to them if you want to bring it to their attention (most companies have this type of option to help them fight scammers). From the Bath and Body Works website “Help us fight fraudulent email requests that make reference to Bath & Body Works by forwarding them (without altering the subject line) to us at
CustomerCare@BathandBodyWorks.com” just forward it, don’t do anything else with it besides deleting it