Watch Out on Amazon! New Types of Scams

Every day, millions of customers around the world make purchases through the Amazon platform. The ease and speed of shopping are exploited not only by buyers but also by cybercriminals.

– The scale of the operation, including countless transactions and the transfer of seller and buyer data, combined with a lack of basic precautions, creates enormous potential for data theft or money fraud – warn ESET experts. Phishing, fake gift cards, or data extraction during phone calls – these are the methods most commonly used by criminals.

Amazon is the largest online retail marketplace in the world. In 2020, its revenue exceeded $386 billion. The Amazon Prime service alone has 126 million subscribers in the United States and nearly 200 million worldwide. Among other things, the success of this platform in many countries allowed its founder – Jeff Bezos – to become, according to Bloomberg magazine, the richest person in the world in 2018. In Poland, the platform is visited by nearly 3 million users per month. Amazon's enormous popularity and the associated pool of customers who use its services every day attract cybercriminals. Their targets are unsuspecting victims who shop online.

Here is a list of the most common methods and scams used by criminals.

Email phishing with a fake order

Email phishing with a fake order

As with many other service providers, cybercriminals also impersonate the Amazon platform. Their goal is to extract customers' personal data or gain access to victims' accounts. The emails that unsuspecting Amazon customers receive can take various forms. The most common practice is impersonating a typical message from the platform that its customers encounter on a daily basis.

How to recognise new types of scams on Amazon?

How to recognise new types of scams on Amazon?

In practice, the customer receives an email confirming a purchase they did not make. The content of the message is constructed to encourage the victim to click on a link that supposedly leads to Amazon's customer service department. In reality, the link redirects to a website that closely resembles the official Amazon login page. When attempting to log in, the data entered falls into the hands of the fraudster. Another type of attack involves malicious software being downloaded onto the victim's device after they click a link or attachment in the email. Once installed, the malware will attempt to capture authentication data for any services the user uses.

– To defend against this type of attack, we should be alert to several warning signs that indicate attempted fraud. These include, above all, typos in the email address from which the message was sent, or grammatical errors in the message text. Also, any kind of attachment may indicate an attempted scam. Doubts should also arise when checking the link provided in the message. By hovering over it with the cursor, we can check whether it directs to the official amazon.com address or its official domains, such as pay.amazon.com – explains Kamil Sadkowski, senior cybersecurity specialist at ESET. – If any discrepancies are noticed, the message should be deleted immediately, and if in doubt, contact Amazon customer service directly using the contact details found on the platform's official website. The safest approach is to save the Amazon store's web address as a bookmark in your browser and always access the store through that bookmark – he adds.

Scams using gift cards

Scams using gift cards

One of the most common types of scams related to Amazon shopping are those using gift cards. The popular tactic typically involves time pressure, which is meant to be an additional factor to push the victim into acting quickly. For example, providing immediate help to a family member who has gotten into trouble and needs financial assistance. Fraudsters also impersonate company executives or the victim's employer and, using the employer's authority, try to persuade them to buy and hand over gift cards. Alternatively, through emails or phone calls, targeted individuals are informed, for example, of a fine imposed by a particular authority that can be paid using gift cards. The increasingly sophisticated methods of criminals have one goal – to persuade the victim to purchase and send Amazon gift cards.

– It is worth bearing in mind that most of these scams will not succeed if we keep a cool head. Criminals use social engineering to push the victim into a specific behaviour. Time pressure or instilling a sense of fear for a loved one are among them. In such a case, it is best to contact the family member in question directly by phone and verify whether they actually need help. Let us also remember that no institutions or government officials will ever ask us to pay a supposed fine or penalty using gift cards. We can be certain that such a request is always a scam – says Kamil Sadkowski.

Payment-related scams

Payment-related scams

Cybercrimes related to the payment process take various forms, but their common denominator is the desire to take control of the victim's bank account. One of the main methods used by fraudsters is trying to convince the user to make a payment outside the secure Amazon platform. Fraudsters try to encourage this behaviour, for example, by offering a reduced price for a product. If the victim falls for it, they will lose both their money and not receive the desired item. Moreover, they will not be able to file a complaint with Amazon because they made the payment outside their payment system. To avoid falling victim to this type of scam while shopping, one should only use the secure Amazon shopping platform.

Another type of payment-related scam involves the requirement to make a payment in order to collect a prize that the buyer supposedly won through Amazon. In such a case, both the very fact of the supposed prize and the inability to verify the seller should raise suspicion.

Data extraction during phone calls

Data extraction during phone calls

Cybercriminals also use phone calls related to supposed customer support. The content of calls in which the criminal impersonates an Amazon employee may concern, among other things, account issues, including a suspicious purchase being registered, a lost package, or warnings issued by government authorities. Engaging in the conversation can lead to the extraction of personal data or payment data. In such a case, the best defence is to contact Amazon customer service through direct contact channels. The platform acknowledges that in some cases it may make outgoing calls to its customers, but it never asks them to reveal any confidential personal data to verify their identity.

– Online shopping security is based on the most important principle: 'trust but verify'. Most scams can be avoided if we remain vigilant and use common sense. Emotions and time pressure are the worst advisors. If we receive unusual, non-standard emails supposedly from Amazon, we must always exercise particular caution and verify their origin before opening any link or attachment. We should also never provide or share personal data during incoming phone calls from a customer service representative of any sales platform – concludes Kamil Sadkowski from ESET.