Phishing and online scams on Amazon

Anyone who has had any contact with Amazon knows that, from time to time, you may come across scammers who parasitically exploit the marketplace’s popularity. They defraud all sorts of users: sellers, buyers, regular users, and one-time visitors.

Even if you’ve never logged on to Amazon (real talk, though: never?), some of these scams can affect you, too. We’ll focus first on buyers because they form the largest group, but we won’t ignore everyone else.

I shop on Amazon. What should I look out for?

For many years now, phishing — that timeless classic of Internet fraud — has remained the main threat to most ordinary users. A scammer’s main target is your personal data, and preferably data that gives access to important accounts (ideally, finance-related accounts). An Amazon account, as you might guess, is a worthwhile prize.

Scammers try to obtain this data using fraudulent e-mails, text messages, or calls purporting to come from Amazon. There are dozens of phishing techniques, but most often, they stress urgency. Below, you’ll find the main types of phishing e-mails our antispam analysts have come across recently.

Fake message about an Amazon Prime subscription

You receive an e-mail or text message claiming you’ll soon be charged for the Amazon Prime subscription you (allegedly) purchased and providing a number you can call to cancel the purchase. If you call it, they’ll try to trick or pressure you into revealing your username, password, and card number.

There is also a version of this scheme that involves persuading victims to install the remote access program TeamViewer on their computers — and that relieved ordinary Britons of a million pounds over a three-month period in 2019.

Fake alerts about suspicious activity on your Amazon account

One of the most common phishing techniques uses a message that appears to come from Amazon and refers to suspicious activity or unauthorized transactions in your account. In this scenario, the scammers try to frighten you by making you think someone hacked your account.

To put things right, the notification says, you need to click a link. The link leads to a fake Amazon site, and if you enter your username and password there, that information goes straight to the scammers, who use them to hack your account (for real). One woman in Fife, Scotland, ended up losing £80,000 as a result of such a call.

Confirmation of an Amazon order you didn’t make

Your Sony PlayStation will soon be shipped to the address you provided. Didn’t order one? Just call us and we’ll fix everything.

As you may have guessed, making that call is a bad idea. Once again, scammers are after easy money and personal data. One woman in Australia lost AU$4,000 this way; the scammers got her to buy Amazon gift cards.

Fraud involving paying for products with a gift card

Gift cards are central to a common ploy: You find a product online at a very good price, but the seller suggests you transfer the details of an Amazon gift card as payment. We do not recommend playing along. You’ll end up with no money on the card and no purchase.

It’s always best to pay for online purchases in ways that allow you to challenge the payment if something goes wrong. The main purpose of an Amazon gift card, as the name suggests, is to be given as a gift. Any challenge to sending one of these cards to an unscrupulous anonymous seller won’t hold up.

Fake requests to buy gift cards

Another option is a fake e-mail from your boss urgently requesting a pack of Amazon gift cards. It may come as a surprise, but people still fall for this trick.

The sender doesn’t have to be your boss, either; it could be a relative, such as a grandmother uncomfortable with technology, asking you to buy several small-value gift cards as Christmas gifts for the whole family.

The most effective counter is also the simplest: contact your boss (or grandmother) using a different method (don’t reply to the e-mail) and make sure everything is all right.

Fake notifications about a bonus or gift

We’ve seen examples of scammers using the stick, but they also use the carrot to lure people in. If they can’t intimidate you with talk of hacking your account or suspicious transactions, they can still send you an e-mail about accumulated bonus points about to expire or some other gift. The result is the same: If you click the link and enter data on the fake site, it will be sent to the scammers. Don’t do it.

I sell products on Amazon. Should I look out for anything?

Scammers don’t care if you’re a buyer or a seller; either way, you have money they want. If you sell on Amazon, look out for these scams.

A “failed delivery”

The delivery failure scam has already become a classic of Internet fraud (and perhaps of fraud in general). What can you do if a buyer claims their package never arrived? Does Amazon have ways to combat this kind of scam? Yes. Always choose delivery with precise tracking for your package, which lets you track it every step of the way, including learning when it’s received.

Product substitution after receipt

What if a buyer replaces the product they purchased with a damaged one and demands compensation? This one’s up to you: Before shipping the item, take a picture or video of the item in good condition and seal the package with a protective sticker. If the sticker’s broken, then you clearly held up your end of the deal.

Some shameless individuals have earned hundreds of thousands of dollars on illegal returns, replacing real goods with boxes of dirt. They were caught in the end, and justice prevailed, but sellers can experience real damage before everything shakes out.

I don’t have any kind of connection to Amazon. Should I be on the lookout for anything?

Surprisingly, yes. Amazon’s gravitational influence can affect you even if you’ve never visited the platform’s website.

Fake Amazon job offers

Take, for example, fake job offers. The scam starts out on a similar path, but instead of a gift or a delivery problem, the person with the unfamiliar phone number is offering you a job at Amazon. Weird, sure, but the prospect of working from home with a flexible schedule, making several thousand dollars per month is tempting.

Hang on: There’s an applicant fee. That you pay with an Amazon gift card. Sound familiar? It’s time to hang up. After all, Amazon advertises open jobs on its website and does not charge for the privilege of applying.

Another version of this scam invites people to write reviews of products on Amazon and get paid for it. Victims are redirected to a phishing site, and any data entered there will fall into the hands of scammers.

Mysterious packages and rigging ratings

Another type of fraud worth mentioning is rigging a seller’s rating using a method called “brushing.” It begins with a package of random stuff you didn’t even order. Some of the unwanted packages contained slippers, light bulbs, or seeds, for example.

The trick lies in the reviews. An unscrupulous seller can register hundreds of fake accounts, sell some cheap items to each of them, send said items to random addresses from a leaked database, and post rave reviews purporting to come from those fake accounts. In some cases, the packages have even gone to dead people.

This scam doesn’t pose a direct threat to the recipient, but if you receive a package like this, it’s very likely your data has leaked. Therefore, we recommend checking your e-mail addresses against this database of known leaks and, if necessary, changing your passwords. That done, report any such package to Amazon support so the company can deal with the fraudulent accounts.

How can I protect myself from fraud on Amazon?

Here are the basic rules for handling suspicious e-mails to protect yourself against phishing and other high-tech deception methods:

• Remember that Amazon will never ask you for your account login information by e-mail or text message;
• If you suspect a notification e-mail is fake, but you’re still worried, log in to your account directly (not by clicking the link in the e-mail!) and check for warnings or notifications;
• Pay attention to grammar. If the language looks perfect, the e-mail isn’t necessarily legit, but if you see errors, then you’re almost certainly looking at spam;
• If you’ve entered your details where you shouldn’t, or if you suspect you’ve been hacked, immediately contact Amazon support;
• Never send a product before you see the payment directly in your personal account, not simply a promise that it’s coming;
• Conduct all communication and monetary transactions within Amazon, the best assurance of successfully resolving any issues that may arise;
• Remember that phishing messages can come not only by e-mail, but also in texts (a method of fraud called smishing), and by voice over the phone (that would be vishing);
• Install on all of your devices reliable protection that will warn you about online scams and phishing, prevent your financial details from being intercepted, and save you from a whole bunch of other online troubles.