One of the most impressive things about Amazon is the sheer breadth of its ecosystem. You can watch your favorite Amazon Prime shows and movies on your Fire tablet, read books on your Kindle, have Alexa call your Uber or use Amazon Pay to make a donation to charity. Of course, Amazon\u2019s own storefront and its third-party \u201cmarketplace\u201d sellers make it the greatest shopping mall imaginable. <\/p>\n\n\n\n
The flip side to Amazon\u2019s inescapable dominance is that criminals have learned to harness its visibility and familiarity to fuel their scams. One of the most common ways you\u2019ll experience this is through phishing attacks claiming to come from Amazon (if you haven\u2019t seen one yet, you will soon). Let\u2019s take a few minutes to review what those attacks can look like, how to identify them, and how to report Amazon phishing through the appropriate channels. <\/p>\n\n\n\n
Phishing scams can take a wide variety of forms, but they all follow the same basic principle:\u00a0 By ostensibly coming from a source you trust, they\u2019ll attempt to trick you into divulging sensitive information, clicking a malicious link or paying out some of your hard-earned money under false pretenses.\u00a0 You might receive these messages through emails<\/a>, social media<\/a>, text (SMS phishing, or \u201csmishing\u201d<\/a>) and even phone calls (voice phishing, or \u201cvishing\u201d<\/a>).\u00a0<\/p>\n\n\n\n Amazon-centric phishing attacks may use any of those approaches, with varying degrees of credibility.\u00a0 The company\u2019s own consumer fraud detection page<\/a> acknowledges, for example, that some departments really do make outbound phone calls.\u00a0 If you\u2019ve recently ordered from Amazon \u2014 and in any given week a lot of us have \u2014 then a message about an errant package sounds pretty plausible.\u00a0<\/p>\n\n\n\n Let\u2019s take a moment to break down some of the most common Amazon phishing scams and what they look like.<\/p>\n\n\n\n This is one of the most common phishing scams you\u2019ll encounter.\u00a0 You\u2019ll receive a text or email informing you that your Amazon order, tracking number [x], could not be delivered and instructing you to click the included link to correct the problem.\u00a0 If you click, scammers have the option of installing malware on your device or taking you to a bogus Amazon login page<\/a> where they\u2019ll harvest your username and password (and any additional information you might give them).\u00a0<\/p>\n\n\n\n This one can happen as an email, text or even a phone call.\u00a0 The message is the same, either way:\u00a0 There\u2019s been a suspicious charge on your account<\/a>, and the fake representative will help you fix it.\u00a0 If you fall for it, the scammers have numerous ways to exploit you including installing malware or getting your bank information so they can \u201ccredit your account\u201d for the fraudulent purchase.<\/p>\n\n\n\n Another common Amazon scam tells you that your recurring payment with Amazon \u2014 for Prime services or product subscriptions \u2014 has failed and that they need to verify your payment method. Again, this scam may come as a phone call or a text\/email message. Either way, once you\u2019ve given the caller your payment or clicked the link and filled out the form, scammers have your bank or credit card information (and if you\u2019re very unfortunate, they\u2019ve also installed malware on your system or scammed additional personal information). <\/p>\n\n\n\n A caller, claiming to be from Amazon, informs you that you\u2019ve been overcharged at some point and that they just need your up-to-date banking information or credit card number in order to complete the refund. But these scammers are far more interested in making a withdrawal than a deposit.<\/p>\n\n\n\n Amazon offers a service called Amazon Pay, which allows you to use the payment methods you\u2019ve saved on your Amazon account in order to pay for products or services on non-Amazon sites. That\u2019s perfectly legitimate and convenient \u2014 but in this scam, when you attempt to make a purchase on a website using \u201cAmazon Pay,\u201d it generates either an \u201cinvoice\u201d or a pop-up requesting payment in the form of an Amazon gift card claim code. <\/p>\n\n\n\n That\u2019s never, ever legitimate:\u00a0 You can\u2019t use Amazon gift cards<\/a> for purchases anywhere but Amazon, even if they\u2019re already loaded to the account you\u2019re using with Amazon Pay.\u00a0<\/p>\n\n\n\n Similarly, dubious sites may display Amazon logos prominently and tell you that your purchase is \u201cguaranteed by Amazon,\u201d as well as that the retail giant will handle the refund if you\u2019re not satisfied. Then you\u2019ll be prompted to send money by Amazon Pay or in the form of a gift card. Again, this is completely bogus. <\/p>\n\n\n\n In this one, the scammers\u2019 site again displays a prominent Amazon or Amazon Pay logo. When you click on it as your payment method, you\u2019re redirected to another site \u2014 which may be a faux Amazon page or just a generic form \u2014 in order to enter your actual payment information. <\/p>\n\n\n\n These aren\u2019t by any means the only ways criminals can exploit Amazon\u2019s sprawling commercial empire.\u00a0 Businesses that use Amazon Web Services to host their websites or provide cloud-computing services have a whole host of other potential phishing attacks to worry about, and Alexa \u2014 the company\u2019s popular voice assistant \u2014 has reportedly had security vulnerabilities<\/a> in the past.<\/p>\n\n\n\n So how can you identify Amazon phishing scams and protect yourself from them? In practice, there are several steps you can take. These include: <\/p>\n\n\n\n It\u2019s possible for scammers to spoof an email to make it look like it comes from Amazon, but there are ways to unmask them<\/a>. This can take some technical knowledge, but using Gmail\u2019s Priority Inbox and strong spam filter settings (and keeping your web protection software up-to-date) is a good first step.<\/p>\n\n\n\n Links in messages sometimes show their URL, but more often they\u2019re \u201cmasked\u201d under a button or a phrase of text. To see the actual link, hover your mouse over it (don\u2019t click!) or long-press it on a mobile device. The real URL will show up. <\/p>\n\n\n\n Better yet, make it your practice to never click a link in a message. Ever. That works for all phishing scams, not just the ones name-checking Amazon. <\/p>\n\n\n\n When any call or message claims to relate to an order, a refund or a payment issue, don\u2019t respond directly. Instead, log in to your Amazon account through Amazon itself and check your orders and your payments. If the problem is legitimate, you\u2019ll be prompted \u2014 on the Amazon site itself \u2014 to take any necessary steps.<\/p>\n\n\n\n A genuine Amazon URL will always be in the format of [something].amazon.com<\/em>. If it comes from Amazon Pay, for example, it might be payment.amazon.com<\/em>. A URL that looks vaguely plausible, such as amazon.accountsreceivable.randomletters.co<\/em>, is not legitimate. The only exception to the amazon.com rule comes in the case of localized Amazon sites, like amazon.ca in Canada and amazon.co.uk in Great Britain. <\/p>\n\n\n\n If an email, text or voicemail message gives you a number to call, use Spokeo\u2019s search tools<\/a> to attempt to verify it.\u00a0 If the number shows as registered to a person instead of Amazon, it could be bogus.\u00a0<\/p>\n\n\n\n Checking incoming calls is worthwhile, too, even though criminals can spoof caller ID information<\/a>.\u00a0 A Spokeo search on the phone number may reveal a reputation score information indicating numerous recent complaints about it.\u00a0 This can indicate that it\u2019s being actively exploited by number-spoofing scammers.\u00a0<\/p>\n\n\n\n If a call or message wants you to confirm or provide personal information or banking information, that\u2019s not Amazon.\u00a0 If they\u2019re asking for payment in gift cards, that\u2019s not Amazon.\u00a0 If they\u2019re offering an unexpected refund, that\u2019s not Amazon.\u00a0 The company\u2019s help page on identifying real and fake calls or messages can help you decide what\u2019s legitimate and what\u2019s not.\u00a0 The page on gift card scams<\/a> is pretty helpful as well.\u00a0<\/p>\n\n\n\n Reputation is everything in the online world, and Amazon is zealous in protecting its brand.\u00a0 If you suspect you\u2019ve encountered an Amazon-related scam, the company definitely wants to know<\/a>.\u00a0<\/p>\n\n\n\n After you report an Amazon phishing attack, you may want to take a few extra steps to protect your account and your identity in general, even if you\u2019re pretty sure the scammers came away empty-handed. These might include: <\/p>\n\n\n\n If there\u2019s any chance scammers might have your Amazon password (you can test it at a website called Have I Been Pwned?<\/a>), you should change it and make it stronger.\u00a0 In fact, you should probably do that anyway.\u00a0 If you find it hard to remember passwords<\/a>, use a password manager<\/a>.\u00a0<\/p>\n\n\n\n If you\u2019re at all concerned that scammers may have gotten some of your information (or if your password showed up as compromised), you should consider our identity theft protection service, Spokeo Protect<\/a>.\u00a0 It\u2019ll warn you if criminals offer your personal information for sale on the dark web<\/a>, and the affordable subscription options offer a choice of additional services.\u00a0<\/p>\n\n\n\n Protect your Amazon account by setting up another authentication option. This might be a code texted to your phone, a hardware key or something as simple as enabling push notifications on the Amazon app. (If someone tries to log in, you\u2019ll be notified and have to manually approve it.)<\/p>\n\n\n\n This is the Amazon-safety equivalent of \u201cbreak glass in case of emergency\u201d. If you think you might have fallen for a scam, log in to Amazon immediately, go to your Login & Security settings and choose \u201cSecure Your Account.\u201d You\u2019ll verify the login by email or phone (whichever your account is set up for) to verify that it\u2019s you, and then you\u2019ll be able to see all current logins to your account. If there are logins you can\u2019t account for, you can sign them out (and then change your password immediately<\/em>). <\/p>\n\n\n\n It\u2019s an unfortunate fact of life that wherever people congregate, and wherever money changes hands, criminals will be there and attempt to take advantage. That doesn\u2019t mean you need to live in fear, just that you need to be aware of the possibilities and take sensible precautions. <\/p>\n\n\n\n Following the few simple rules outlined here can help you avoid almost all Amazon-related scams and (for that matter) most online scams in general. If only the rest of life\u2019s problems were so straightforward!<\/p>\n\n\n\n References:<\/p>\n\n\n\n Amazon – Identifying Whether an Email, Phone Call, Text Message or Webpage Is From Amazon<\/a><\/p>\n\n\n\n Detroit Free Press – Amazon Scammers Are Slick, Good at What They Do:\u00a0 Here\u2019s What To Watch For<\/a><\/p>\n\n\n\n Amazon Pay – Internet Scams and Phishing<\/a><\/p>\n\n\n\n Check Point Research – Keeping the Gate Locked on Your IoT Devices:\u00a0 Vulnerabilities Found on Amazon\u2019s Alexa<\/a><\/p>\n\n\n\n Amazon – Common Gift Card Scams<\/a><\/p>\n\n\n\n Amazon – Report Suspicious Emails, Phone Calls, Text Messages or Webpages<\/a><\/p>\n\n\n\n ReportFraud.ftc.gov – Report To Help Fight Fraud!<\/a><\/p>\n\n\n\n Amazon – Fixing Things Is Quick and Easy<\/a><\/p>\n\n\n\n U.S. Federal Bureau of Investigation – Internet Crime Complaint Center (IC3)<\/a><\/p>\n\n\n\nSpecific Amazon Phishing Scams<\/h2>\n\n\n\n
Delivery Failure\/Tracking Number Scams <\/h3>\n\n\n\n
The \u201cSuspicious Activity on Your Account\u201d Scam <\/h3>\n\n\n\n
The \u201cPayment Failed\u201d Scam <\/h3>\n\n\n\n
The \u201cRefund\u201d Scam <\/h3>\n\n\n\n
Fake Amazon Pay \u201cInvoice\u201d<\/h3>\n\n\n\n
Amazon \u201cGuarantees Your Purchase\u201d <\/h3>\n\n\n\n
Payment via Redirect <\/h3>\n\n\n\n
Recognizing Amazon Phishing Scams<\/h2>\n\n\n\n
Learn How To Recognize a Spoofed Email <\/h3>\n\n\n\n
Look at the Real URL for a Link<\/h3>\n\n\n\n
Don\u2019t Click a Link in a Message<\/h3>\n\n\n\n
Log In to Your Account To Verify Messages <\/h3>\n\n\n\n
Know What Amazon URLs Look Like <\/h3>\n\n\n\n
Verify Any Phone Number You\u2019re Supposed To Call<\/h3>\n\n\n\n
Verify Incoming Phone Numbers <\/h3>\n\n\n\n
Know What Amazon Won\u2019t<\/em> Do <\/h3>\n\n\n\n
Report Amazon Phishing Attacks<\/h2>\n\n\n\n
\n
After a Phishing Attack<\/h2>\n\n\n\n
Changing Your Amazon Password and Making It Stronger<\/h3>\n\n\n\n
Getting Identity Theft Protection<\/h3>\n\n\n\n
Add Another Authentication Option <\/h3>\n\n\n\n
Secure Your Account <\/h3>\n\n\n\n
Be Wary but Confident<\/h2>\n\n\n\n