Amazon Scams: How to identify, verify, report, and avoid them

Key takeaways

• Amazon’s brand power makes it an attractive target for impersonation by fraudsters
• Many scams involving Amazon’s name are classic social engineering scams that impersonate but don’t actually involve Amazon
• Learn to use useful free counter-fraud tools like ESET’s link checker to filter out most scam attempts
• A small number of attacks and scams take advantage of specific features of Amazon’s service
• Fundamental defenses against social engineering attacks exist and will protect you from most scams — Amazon or otherwise
• There are specific tools and services you can use to defend against fraud and report to Amazon

Why scammers impersonate Amazon

Amazon has built its business off of being a trustworthy brand, and it puts a huge amount of effort into keeping it that way. The company has some seriously effective account and transaction security controls that make it safe to buy from and deal with. Partly as a result of this, Amazon’s brand recognition is high — and, just like other big names, that makes it something that scammers use all the time to disguise the real nature of their activities. We’ve talked about scams that impersonate or make use of the goodwill of other well-known e-commerce brands like Airbnb, PayPal, and Etsy. Many scams that involve Amazon’s name are much the same: social engineering attacks aimed at tricking unsuspecting members of the public that have nothing to do with Amazon or its systems at all.

For the sake of clarity: Most Amazon-related scam activity tries to steer victims away from interacting directly with Amazon on its own platform. If you have secure, multifactor authenticated access to your Amazon account via its web page or app, ignore any messages from elsewhere and always check for any issues directly with Amazon. This will negate a lot of scam activity immediately.

With the right knowledge and tools, spotting a fraudster impersonating Amazon is easier than it might first look.

Secondly, Amazon takes this sort of thing seriously; later on, we’ll talk through the process of identifying and reporting fraudulent activity to Amazon.

In this article, we’ll look at Amazon-related scams in two broad groups: social engineering scams that take place without any involvement with Amazon as a merchant or platform, and “on platform” scams that take place through products and services provided by Amazon itself. This separation is intentional: If the fraud takes place using Amazon’s marketplace or its communications channels, the company can do something about it.

What to do if you suspect you’ve been scammed

If you’ve arrived at this page because you suspect you’ve fallen victim to a scam, go to "What to do if you clicked an Amazon scam link or shared information" to find out what to do immediately. If you receive communication and are suspicious or if you just want to be thorough, go to "How to verify Amazon emails, sender domains, and links" to find out how to verify that both communications and links are legitimate and not scams.

Common scams

Before we get into the detail of scams that specifically target Amazon and its customers, let’s look at common social engineering scams.

Impersonation scams: The fraudster attempts to impersonate an Amazon employee, often over email, SMS or similar messaging platforms like Telegram or WhatsApp, websites, and voice calls.

Marketplace scams: The sale of counterfeit or nonexistent goods, poor-quality or damaged goods, or bait-and switch, where an item is swapped before dispatch, either to Amazon or direct to the buyer.

Adjacent schemes: Brushing (more on this later), demands for gift cards purchased through Amazon, or scam “investment opportunities” claiming to use the Fulfilled by Amazon (FBA) service.

Warning signs — a quick checklist

Before going into detail, it’s worth looking at a couple of things that are scam red flags in many situations.

1. Beware urgency, especially when combined with emergency. Something that’s presented as an emergency that requires an immediate reaction is, 99% of the time, going to be a scam. That text message from a relative saying they’ve been arrested on holiday and need money via wire transfer? Incredibly likely to be a scam. The same applies to scammers impersonating Amazon employees.

If you’re presented with a situation that requires action first and thought later, take the time to give it a second thought. One example is a call claiming to be from Amazon’s fraud team saying your account has been hijacked and used to pay for expensive PCs or smartphones and asking you to share information like one-time passwords (OTPs) or authentication codes.

2. Watch out for anything that takes you off Amazon’s communication and payment systems. Amazon has robust, secure systems, many regulated by law or industry bodies to protect the public. A fraudster might impersonate Amazon in a phone call, email, or other communications medium and try to direct you to payment on a different website or try to steal sensitive payment or login information. If in doubt, log in directly to Amazon’s website and look for messages there. Chances are if the message isn’t waiting for you there, it’s a scam.

Scammers use a number of tactics to lead victims on. They may pose as an Amazon customer service or fraud investigation team member or even law enforcement, bank representative, or delivery provider, then inform the victim of a serious, possibly even criminal, issue with their account or purchases. Another tactic is to offer a refund or reward or a limited-time offer or scarce product in conjunction with a seasonal shopping period. Finally, scammers often do as much as possible to keep their target isolated, urging them to stay on the call, thus avoiding contacting their bank, friends and family, or Amazon directly. Any appeal like this is a major red flag; legitimate authorities will be more than happy for you to verify their identity.

3. Beware anything that looks too good to be true. Yes, you might have won a free holiday or a huge amount of shopping vouchers. But it’s more likely you haven’t, so treat good news out of the blue with caution.

For example, if you buy something from an e-commerce site, that business must be compliant with PCI-DSS, a standard set by the payment card industry to ensure that payments, authentication, data storage, and communication of card details are secure and reliable.

What are scammers looking for?

Scams are used to separate you from something that’s valuable to the scammer. That might be money — so beware anything that asks for payment asks for payment details for a refund, or offers to fix a problem with your account.

But there are other things, such as personal information and login details, that are valuable. Scammers might ask for your password or an MFA (multifactor authentication) code that the merchant sends you via SMS or which is generated by an authenticator app on your smartphone.

Access to your device is another red flag. If the scammer asks you to install software or an app or allow remote access to your device, don’t agree to it.

Here’s a quick list of potential scam content in calls, messages, and so on:

• An unexpected warning about an order, payment, refund, or account problem
• A request for a password, card number, bank information, or one-time passcode
• A payment demand using gift cards, cryptocurrency, or wire transfer
• A request for remote access to a computer or mobile device
• Links that don’t lead to the expected official Amazon domain
• Pressure to remain on the call or act immediately
• A request that the recipient installs software or visits a website
• Instruction to contact no one else — be it a bank, Amazon, or a family member
• A request to continue talking or make payment outside Amazon’s app or websites
• A claim that cannot be confirmed inside the recipient’s authenticated Amazon account.

How scammers reach you

Think of a messaging service more advanced than carrier pigeons, and it’s likely a scammer will have used it to pretend they’re contacting someone on behalf of Amazon. Yes, that absolutely includes old-fashioned letters addressed to you. But modern communications channels are much more convenient and cost-effective: You’ll be far more likely to get an email, text message (SMS), phone call, or social media message. Scam websites, social media posts, and fake adverts are also used.

Amazon also provides a messaging service for customers and merchants in its Marketplace. It’s pretty full-featured: Users can exchange images and documents, including XML files. The catch (for fraudsters at least) is that Amazon can and does monitor the service for fraud, whereas out-of-band messages and scams like the ones described above lie outside Amazon’s influence.

Let’s look at this in more detail:

The strangest scam: brushing

Brushing is a scam that has popped up fairly recently, and it’s a peculiar type of scam aimed at boosting merchants on e-commerce sites. To members of the public, it seems like a bizarre delivery, but to the brushers, it’s a means to a very specific end.

Here’s how it  works:

1. The random parcel delivery

A mysterious package is delivered to your doorstep via Amazon or another e-commerce site. It contains something you didn’t order — and something no one you know might have ordered as a surprise gift for you, either. In some early cases, the item delivered seemed quite bizarre, too: seeds, bricks, gravel, lumps of wood, and all kinds of other things carefully packaged and delivered to your door by an unknown person. Quite often that’s the end of it: The recipient assumes they’ve been the subject of a practical joke.

2. What’s the benefit to the scammer?

Here’s what the package is all about: The scammer can prove that a parcel was delivered to you via Amazon’s system, and the system knows it was of a certain weight — for example, something was delivered that was the same weight as a laptop PC (or in the victim’s case, a house brick). The scammer is acting on behalf of a merchant on Amazon Marketplace or is the merchant themself. The victim’s address and identity have likely been stolen and is being used to back up a legitimate-looking review of a nonexistent product the merchant can “prove” was shipped to the victim. It’s very difficult to find out where these reviews appear, unless your online identity and Amazon account have also been stolen. Far more often, the victim has no way of finding out where the scam review in their name appears.

3. What Amazon is doing about it — and what you need to do

Because the package is delivered via Amazon, the company can track the delivery and trace it back to the merchant’s account. But there’s a more urgent issue for the recipient: Their name and address are already in the hands of fraudsters. Follow our in-depth guide on protecting and locking down your identity both before and after it is stolen here.

If you received a mystery parcel that you (or your friends or family) didn’t order, go to your Amazon account, navigate to Help and customer service, then Security and privacy, and select Report unsolicited packages or brushing scams. You’ll be asked to check up to four boxes to indicate what the package contains, and you’ll need to put the parcel’s Tracking ID into a field on the page.

Amazon scam emails

Amazon scam emails imitate legitimate messages from the company, using duplicated Amazon email layouts, logos, and other design features. They’re designed to closely resemble legitimate messages from Amazon, but the attacker will try to direct the recipient to fraudulent login or payment pages, fake support numbers, or otherwise attempt to extract valuable information. They may also contain malicious documents as part of a phishing exercise. Even if it looks convincing, the counter to these messages is to log on to Amazon via the app or website to check messages there — scam emails won’t be mirrored on Amazon’s own sites.

Scam texts

In a similar vein, scam texts try to dupe users into believing there is a problem with a delivery, Amazon device, order, or other issue that creates an unexpected “problem” to con the user out of information. As with fake emails, the messages will push victims toward fake support numbers or websites.

Phone calls

Phone calls are another compromise vector: vishing calls impersonate Amazon employees, often claiming to be from the fraud or customer service department, and ask for privileged information. This can include the usual suspects (a one-time password, payment details, and so on) but also things like gift card codes or remote access to the victim’s phone or PC.

Fake websites and search ads

Fake websites and search ads are used to impersonate official Amazon web pages, offering products for sale or directing people to fake customer service contact details. The domains and addresses for some websites can look, at first glance, genuine. However, they can make use of the fact that some letters look similar — this is called a homograph attack, and some of the more easily spotted examples might include the use of numbers (e.g., amaz0n.com). More sophisticated variations use letters from different alphabets, such as the Greek and Cyrillic, which use similar letters (such as o) with a different Unicode character.

Dubious social media accounts

Dubious social media accounts and messages claim to be support profiles for Amazon and other major e-commerce brands; customers with genuine problems are often approached by scammers either impersonating Amazon or claiming to be able to help in other ways. Instead, they try to extract sensitive information like card details or account logins. Scam social media accounts also create fraudulent promotions, advertisements, or otherwise push links to fraudulent web pages.

Recruitment scams

Recruitment scams are a little more exotic: Recipients are presented with what looks like a job opportunity at Amazon and asked for personal information, sometimes even payment. As with other identical recruitment scams for other well-known brands, the fraudster is looking to collect personal information for the purposes of identity theft, as well as trying to steal money from victims.

FBA and Marketplace get-rich-quick schemes

Words like “drop shipper” and “reseller” are becoming more common on the internet these days. Both describe the process of buying a lot of items from a manufacturer and offering them for sale elsewhere to the public. In the past, this might have required the company or individual to make an upfront payment for those goods, shipping to get them delivered to a warehouse, and storage payments to keep them there before packaging and postage charges for getting them into the hands of customers.

Modern logistics removes a lot of this friction. Drop shippers can market a product, receive payment, and then have the manufacturer fulfill the order directly from their factory or warehouse. A second option is to set up a merchant account on Amazon Marketplace. Sellers can either have the products sent straight to an Amazon warehouse, using the FBA (Fulfilled by Amazon) service to handle all of the logistics, or store and deliver the product themselves, something Amazon calls Fulfilled by Merchant.

So far, so clear. But there are a number of investment scams out there that aim to convince members of the public to contribute their cash to “dead certain” reselling or drop-shipping opportunities that rarely if ever turn a profit. Often these schemes are advertised on social media by outwardly successful-seeming people showing off tokens of their success — supercars, executive jets, and other glitzy signals of wealth. The jets and cars are often rented by the hour, and the money these people make is from conning people with investment scams and dubious “courses” — not from selling smartphone accessories on Amazon or any other online marketplace.

On-platform scams

The last examples we’ll give are ones that happen inside Amazon’s environment. These are often short-lived because Amazon holds a great deal of data on every transaction and can use it to combat fraud and recognize patterns that suggest a merchant is acting fraudulently. It’s worth noting that just about every e-commerce brand has this problem, and just about all go to significant efforts to counteract it.

Amazon Marketplace

Amazon Marketplace allows third-party merchants and Amazon customers to communicate directly with each other. Fraudsters can compromise merchant accounts (or set up fake accounts themselves) and will try to move communications about sales and also payment for goods outside Amazon and onto other channels. This removes the protection Amazon provides for such communications and transactions.

Another risk is that Amazon advertises products sold by Amazon Marketplace merchants alongside those sold by vendors, specialist distributors, and manufacturers as certified brand-new. Merchant sales do not have to be of brand-new products, and merchants can also be fraudulent or have had their credentials stolen by a fraudster. A result of this is that some customers might receive an item that has clearly already been used, is broken, or entirely missing. When buying, it’s worth checking whether the item is from a known merchant, certified brand-new, and whether the merchant has a number of positive reviews — although that may also be the result of a brushing scam, so look for a longer timeline of interactions, sales, and reviews if possible.

Finally, fraudulent sellers can create listings for fake products or items at implausible discounts to attract buyers before asking for payment or personal information off-platform, where Amazon cannot protect buyers.

Theft in transit

You’ve ordered a new smartphone, received a one-time passcode from Amazon, and received a package from your local friendly delivery driver. Unfortunately, the box is empty. What just happened? Somewhere in the supply chain, between the manufacturer, reseller, Amazon, the delivery network, and your front door, your product has been stolen. Amazon — as well as the courier services it uses alongside its own couriers — dedicates a lot of time to reducing this type of fraud. One example is the use of one-time passcodes for high-value items, but other measures such as package inspection and tamperproof packaging are also involved.

What scammers claim

The general methods are familiar to anyone who’s spent time looking at social engineering scams, but there are some specific angles that are more specific to Amazon than other merchants or websites. Scammers will talk about unauthorized orders, often of high-value items to increase the shock value and urgency, but they’ll also contact you about fake refunds, Prime renewals, account suspension, gift card payments, and more. There are also messages about or from fake sellers. Another common scam promises huge profits from reselling goods via Amazon’s FBA service, or Amazon Marketplace. This scam is not new — the US Federal Trade Commission prosecuted the company behind one such scheme as long ago as 2018 — but it’s effective enough that fraudsters continue to promote get-rich-quick schemes around it.

With that said, let’s get into a few more specifics about some of the scam types:

• Unauthorized order or refund scam: According to the scammer, your account has been used to order something expensive — usually a premium laptop or mobile device. Alternatively, a refund is available for some other purchase. This is used as a pretext to ask for specific login or payment details to “verify” your identity or initiate a refund. The scammer might ask for payment details, a OTP for your Amazon account, or remote access to your device.
• The Amazon Prime renewal that isn’t, and the “account locked” alert that is anything but. The potential victim receives a message — email, SMS, or call — saying their Prime subscription will renew but at a shocking monthly or annual cost. In a variation on the same theme, they’re sent a fake alert claiming their account is locked or restricted. The next step will direct victims to a fraudulent link or phone hotline to steal their banking or account details or other personal information like their address or date of birth.
• Amazon delivery scam: A message claims that a package could not be delivered because of an incorrect address, unpaid redelivery fee, customs charge, failed inspection, or similar problem. The recipient is directed to a phishing page that requests personal or payment information.
• Amazon (or other) gift card scam: The scammer pressures their victim to purchase Amazon gift cards and disclose the card numbers or claim codes. Gift cards may be presented as a way to cancel an order, protect an account, pay a fee, or resolve an alleged debt.

Scam comparison table

Scam type	How it presents to you	Scammer motivation	How to spot/verify
Brushing	Unsolicited parcel delivered to you	Uses your stolen identity to fake a delivery and review	You didn’t expect to receive the order. Go to your Amazon account to report
Phishing	Email mimics Amazon content/layout	Steal your login or card details	Log in directly to your account via app/website to check for messages and ignore the email
Smishing	SMS or other text about a delivery, device, or order problem	Sends you to fake website or phone line	Verify via your Amazon account instead
Vishing	Phone call	Steal OTPs, card details, or gift card codes. Demand remote access to devices	End the call and go to your Amazon account
Fake website/web ad	Homograph attacks/look-alike web address	Steal payment details or connect to fake “support” service	Check URL carefully, and put all links into ESET link checker
Fake social media	Fake customer support profile or scam ad	Card detail theft, login credential theft, fake promotions	Amazon won’t DM you from social media. Verify accounts or avoid altogether
Recruitment scam	Fake job ads/offers	Identity theft, spurious upfront “fees”	Employers don’t demand fees. Verify postings using Amazon’s career page at https://www.amazon.jobs
FBA/reseller get-rich-quick scheme	Social media ads touting easy returns on cash investments	Sells expensive course or costly investment schemes that rarely generate a return	Be skeptical of lifestyle flexing by advertisers and guaranteed returns
On-platform merchant fraud	Fake or stolen Marketplace accounts list goods at suspiciously low prices	Buyers pushed off platform to complete payment or steal personal data	Always stay in Amazon’s messaging and payment systems. Be cautious of merchants with low/suspicious-looking reviewer counts
Theft in transit	Package is empty or contains something of similar weight to stolen item	Theft in the supply chain	Report immediately to Amazon. Before accepting package, check for tampering and refuse delivery if suspicious
Unauthorized order/refund scam	Message claiming item ordered fraudulently or refund owed	Theft of OTP, credentials, payment details, request for remote access	Amazon will never ask for your OTP. Check orders directly in app/website
Prime renewal/lockdown	Alerts to costly renewal or restricted account	Directs to fake hotline/web page to steal data	Check account status directly on the Amazon app/web page
Delivery fee or customs scam	Delivery or customs fee is needed to release a package	Steal payment and personal information	Check for delivery issues in your Amazon account
Gift card scam	Pressure to buy gift cards to resolve a fee or protect your account	Theft of gift card codes	No legitimate company, Amazon included, will ever ask for payment via gift card

 

 

How to verify Amazon emails, sender domains, and links

First things first: Don’t click on that link. Take a moment, and then look into whether the communication is genuine or not.

The first and easiest way to do this is to log in to your Amazon account from a trusted device. If Amazon is trying to contact you, the message will be in your account’s messaging section, as well as sent to you via email, SMS, or other means.

Secondly, look for immediate signs of fraud: Does the email, for example, come from a legitimate Amazon domain? The domain might contain the word Amazon, but that’s no sign it’s legitimate. Chances are better if the sender address is @amazon.com, but even this can be spoofed.

Legitimate sender	Example phishing variants
@amazon.com	@amaz0n.com, @amazon-security.com, @amazon-support.net, @amazon-verification.com, @amazon-account-help.com
store-news@amazon.com	store-news@amaz0n.com, store.news@amazon-support.com, store-news@amazon-security.net, storenews@amazon-mail.com, store-news@amazon-update.com
cb-info@amazon.com	cb-info@amaz0n.com, cb-info@amazon-security.com, cbinfo@amazon-support.net, cb-info@amazon-alerts.com, cb-info@amazon-verification.com

 

 

Check any links in the email you’re prompted to click on. First, hover over them with your mouse to see if they’re obviously suspicious. Better yet, copy the link and paste it into ESET’s free online link checker to see if it’s legitimate or not.

What about other communications? Well, if it’s an SMS, then check your account in the app. A voice call is more than likely to be a scam, so explain you’ll hang up and contact them via Amazon’s app or website. If they object to that, it’s 100% a scam, by the way.

While we’re on the subject of logging in to your account, make sure you’ve chosen a properly random password that you’ve not used elsewhere, consider changing it regularly, and ensure you have switched on multifactor authentication (MFA) to add a layer of security to your Amazon account.

What to do if you clicked an Amazon scam link or shared information

Depending on what you (and the scammer) have done, there are a number of options. The most important thing is not to panic; often scammers rely on their victims reacting without thinking. So take a deep breath, and then work out what you can do.

If you clicked a link but entered nothing:

Close the page, check your browser’s downloads folder, and remove any unexpected files without opening or running them. Then check for unfamiliar browser extensions. Run a security scan with your chosen security software. Finally, keep an eye on your Amazon account and bank account for any unusual activity or payments.

If you entered your Amazon password on a site that isn’t Amazon

Go to the Amazon web page by entering the address in your browser manually. Alternatively, open the app. Change your password immediately, preferably using a generated password. If you see other devices connected to your account, sign out any unfamiliar devices or sessions where the option is available: This is generally presented as an option during the password reset process.

If you’ve used your Amazon password on any other account, change that, too: Using a password on more than one account is something you need to avoid in general.

If you haven’t already, enable MFA.

On your Amazon account, check recent orders, your stored address and payment methods, any devices connected to your account, and general account activity.

If you shared a one-time passcode

Treat the account as potentially compromised and immediately change your password from a PC or smartphone you trust. Follow the steps above, but also contact Amazon through an official channel — found via navigating to Customer Service in your Account page.

If you shared card or bank information

This is a problem for your bank: Contact your card issuer using the phone number printed on the physical card, or by navigating to the issuer’s official website and looking for contact details for lost or stolen cards. Follow the provider’s process of handling stolen card details. Keep any emails, screenshots, or transaction records, and treat them as evidence for fraud investigators.

If you installed remote-access software

This may be more problematic. First, disconnect the affected device from the internet or network, and do not use that device to change passwords. From a different, trusted device, change your account passwords for email, banking, Amazon and other e-commerce sites, and any other sensitive accounts that might have been accessed.

If you think any banking or payment details were exposed, contact the relevant financial institutions immediately, preferably via the phone number printed on the back of your physical payment cards.

The next step is to run a full security scan on the affected device; if it does not have ESET Home Security or a comparable cybersecurity package installed, you’ll have to download one to a USB device and install it from there. Find and remove any remote access software using the security software.

If you sent money

Contact your bank or card issuer to flag the transaction as fraudulent. Follow the issuer’s instructions. Card payments can often be stopped or reversed if they are identified as being part of a scam.

If you disclosed gift card codes

Contact the company issuing the gift card and your payment provider immediately, and ask if the payment or redemption can be stopped. Contact your local law enforcement authorities and report the fraud. Any contact from services that offer to recover money on receipt of a further payment should be ignored and reported.

How and where to report Amazon scams

Depending on the scam, different organizations will benefit from you reporting to them. The types of organizations that need to know about attempted or successful scams vary according to the nature of the scam itself.

It’s difficult to provide direct links to Amazon’s customer service pages because these vary by country of origin, but the typical path for both web browsers and dedicated apps is via your Account page, then selecting Customer Service and looking for reporting tools for suspicious activities.

Amazon uses a catchall email address (reportascam@amazon.com) to field general scam reports regardless of whether the sender has an Amazon account. An email to this account will receive an automated reply confirming receipt. Additionally, Amazon provides multiple options depending on the scam type. As mentioned, Amazon does not have a central website for scam reporting but offers country-specific services instead. Search for “report a scam to Amazon” in your favorite search engine, and follow the link to Amazon’s dedicated page for reporting scams in your country. By choosing one of the scam types listed below, you’ll be able to complete a short questionnaire to report the issue and, where relevant, receive information on which other organizations you should contact.

Reporting table:

Scam type	What evidence to preserve	Where to report
Phishing email	Full email, headers, sender, links	Verified Amazon reporting channel and email provider
Scam text	Screenshot, sender number, URL	Your mobile or telecoms provider reporting and verified Amazon channel
Scam call	The number the scammer used for the call, time, voicemail, stated purpose	Your telecoms provider, relevant regulator, and verified Amazon channel
Brushing scam	Label, tracking number, photographs, any paperwork included in the package, and the package contents	Follow Amazon’s unwanted-package process; look into potential identity theft
Fake seller or listing	Seller name, ASIN or listing URL, messages	Amazon Marketplace reporting tools
Unauthorized transaction	Order details and payment record	Bank/card issuer, Amazon
Reseller investment scam	Contract, ads, invoices, communications	Relevant consumer protection or financial authorities in your country

 

 

How to avoid Amazon scams

Here’s a quick checklist to filter out the vast majority of Amazon-related scams:

1. Use strong security for your account: a strong, unique password and MFA, preferably using a mobile authenticator app instead of SMS to create a one-time password.
2. Never share an OTP with anyone else.
3. Log in to your Amazon account to check orders, refunds, messages, and customs charges if you received an email, SMS, or voice call you think might be genuine. Don’t feel obliged to continue a voice call — only a scammer will pressure you to stay on the line.
4. Never pay for purchases outside Amazon’s own system.
5. Never install software at the request of a caller claiming to be from Amazon (or anyone else, for that matter).
6. Use a link checker before clicking on a link you’re sent.
7. Check payment methods and order history in your Amazon account regularly.
8. Keep your devices and software up to date.
9. Be wary of investment opportunities that sound too good to be true.
10. Report any suspicious activity promptly, both to Amazon and the authorities.

Scammers are successful if their approaches look convincing, so it’s hardly surprising scams involving well-known and trusted brands are increasingly sophisticated. Staying alert and using extra layers of protection are recommended.

Fake delivery alerts, phishing links, fraudulent sellers, and account takeover attempts can put your payments, personal data, and identity at risk. ESET HOME Security Ultimate helps block known phishing websites, protect your online payments, and monitor your identity for signs of misuse.

Tips from an ESET expert

“Without even having to hack Amazon itself, scammers can exploit the trust people already have in the brand using convincing emails, text messages, and phone calls to create a false sense of legitimacy. This can be extremely believable, and with AI, this can be designed and implemented at scale very rapidly. With it being a numbers game, cybercriminals can now target more at once and make a lot of money.

The biggest mistake people make is reacting too quickly to messages that claim there’s a problem with an order or account without verifying the origin of the message. Taking just a minute to stop and think and verify it through the official Amazon app or website is one of the simplest and most effective ways to stay safe. Criminals constantly rely on urgency, so slowing down takes away their biggest advantage and keeps you in control.”

-          Jake Moore, Global Security Advisor

Conclusion

Most Amazon scams succeed not because they break Amazon’s security, but because they exploit human trust. Whether the lure is a fake refund, a delivery problem, an account alert, or a too-good-to-be-true investment opportunity, the goal is usually the same: to pressure victims into handing over money, personal information, login credentials, or access to their devices.

The good news is that a handful of simple habits will stop the vast majority of these attacks. Scammers constantly adapt their tactics, but the fundamentals remain unchanged. A healthy dose of skepticism, strong account security, and prompt reporting of suspicious activity can help keep your shopping, finances, and personal information safe, whether the scammer is impersonating Amazon or any other trusted brand.

Frequently asked questions

How can I avoid Amazon scams?

Avoid communicating or paying for anything related to Amazon that isn’t routed directly via the company’s own site. To do this, access your Amazon account only through the official Amazon app or by typing the Amazon website address directly into your browser. Avoid clicking links in unsolicited emails or text messages, and verify any unexpected account or order notifications within your Amazon account. Treat any communication that is not visible via your Amazon account as a scam, and follow the steps above to report it.

Is Amazon a secure website?

Yes. Amazon is a secure and legitimate e-commerce platform that uses multiple security measures to protect customer accounts and transactions, and invests significant resources in preventing fraud.

However, account security is a shared responsibility, so shoppers should use strong passwords, enable multifactor authentication (MFA), and stay alert for phishing attempts that impersonate Amazon.

Can I get scammed on Amazon?

Yes. Amazon itself is a trusted platform, but scammers use fake sellers, counterfeit listings, misleading product offers, or requests to complete payments outside Amazon. To stay protected, review seller ratings, keep all transactions on Amazon, and be cautious of deals that seem too good to be true.

What is an OTP scam?

A one-time password (OTP) scam occurs when a fraudster tries to get their intended victim to reveal confidential account information. Like many other internet services, service providers, and secure organizations, Amazon uses OTPs to add a layer of security to significant account changes and large purchases, typically sent to your trusted mobile number or email address. These are used to validate your identity or confirm delivery of expensive items. If successful in getting a victim to hand over an OTP, the scammer uses the code to gain access to the victim’s account. Amazon and other service providers will never ask customers to disclose an OTP over the phone, by text message, or via email.

What should I do if I clicked an Amazon scam link?

Close the page, avoid downloading files, change any password entered on the site, enable multifactor authentication, review account activity, and contact the relevant financial institution if payment information was disclosed.

Does Amazon call about unauthorized charges?

Amazon may contact customers in a very limited number of situations, but unexpected calls claiming there is an unauthorized charge, account compromise, or urgent problem should be assumed to be scam calls until you have verified the call is genuine by contacting Amazon through your own account. Amazon states that it will never ask for passwords, OTPs, gift card numbers, bank account details, payment information, or remote access to your device over the phone. If you receive such a call, hang up and verify the claim directly through the official Amazon website or app.

Can I keep an unsolicited Amazon package?

It depends on local laws around unsolicited items delivered to you. Unexpected deliveries via Amazon’s fulfillment network can be linked to Amazon brushing scams, which may indicate that your personal information has been misused elsewhere. If the package appears to be the result of a shipping error or is addressed to another person, contact Amazon for instructions on what to do with the package. In all cases, do not use, consume, or install an unknown product if you cannot verify its safety or origin.