Bitdefender Antispam Lab warns of Prime Day phishing campaigns; How to remain safe on your summer shopping haul

With e-commerce giant Amazon kicking off its summer Prime Day discounts on July 11, scammers are getting ready to catch eager shoppers off guard.

This year’s annual Prime Day sale is likely to attract millions of consumers hunting for great deals, as well as fraudsters who want to steal their money and personal information. Before, during and after the big sales event, Amazon shoppers should expect opportunistic scammers to attack on all fronts, including email, phone, and text.

In fact, Bitdefender Antispam Lab has spotted phishing campaigns leveraging the retail giant’s name since at least July 5. Users in Italy, Spain, Germany and the UK have been targeted with fraudulent offers to create Amazon Business accounts ahead of Prime Day, and receive 50% off their first orders.

The bogus emails are designed to steal credentials and payment data from victims.

Our researchers also spotted fraudulent messages warning users of billing issues on their Amazon accounts and unprocessed orders. Recipients are urged to log in to their accounts and update their payment methods.

All of the above campaigns are currently active and targeting users in the US, the UK, Ireland, Canada, Australia and Germany.

Close inspection of the bogus emails reveals many red flags:

• Messages are not sent from an official Amazon domain
• Recipients are urged to take immediate action and update payment methods or risk losing access to their Amazon account
• Messages contain odd phrasing and typos

Shoppers in Japan were also targeted with Amazon-themed phishing emails similar to those targeting recipients in Europe and North America.

“Your Amazon Prime membership will renew on 06 July 2023. In order to maintain your account, we need to verify your Аmazon account information. Please log in to your account below to update your information,” a digital translation of the bogus email reads.

How to protect your data and money from Amazon Prime Day–themed swindles and malicious attacks:

• If your password is insecure (reused on other online accounts or created with predictable combinations of letters and numbers), change it immediately and enable any additional layer of security such as two-factor authentication
• Remain vigilant against any unsolicited correspondence, including phone calls regarding suspicious activity on your Amazon account, as scammers often impersonate Amazon employees to trick you into downloading malicious software onto your devices
• Be wary of requests to provide personally identifiable information. Amazon will never ask for credit card information or other sensitive data via phone, Never provide login information or financial data via phone, text or emails
• Don’t click on unsolicited Amazon-themed links you receive via email, text or instant messages. Scrutinize all messages that offer too-good-to-be-true deals, gift cards and confirmation orders for products you did not purchase.
• Expect emails saying that something is wrong with your Prime membership and that you need to update payment information or re-enter your credentials. Whenever you receive urgent messages, don’t click on any embedded links or attachments (they may contain malicious software designed to steal your credentials and credit card info). Instead, head to your account directly from your browser to check for any notifications or security issues.
• Beware of counterfeit products and fake reviews. Many third-party retailers sell their products on Amazon. Research the product and reseller before making any purchases.
• Exercise caution when dealing with messages claiming unauthorized purchases, lost packages, refunds and fake confirmation emails
• Install a security solution on your device and use a VPN to secure your device and prevent you from accessing malicious or fraudulent links

Safe shopping everyone!