As millions of online shoppers eagerly await the start of Amazon Prime Day, now less than a week away, with sales scheduled to begin on July 8, security researchers have dropped a warning bombshell: the discovery of 120,000 fake Amazon websites waiting to trap users and steal their money. Comprised mostly of phishing, but also malware, threats, the domains in question have been created by cybercriminals seeking to benefit from the high media profile of Prime Day and the anticipated flood of consumers eager to grab a bargain. How do we know that’s the aim? These domains were all created within the last two months in the run-up to Amazon Prime Day, a massive magnet for hackers around the globe. Here’s what Amazon is doing to protect you and what you can do to protect yourself.
The Amazon Prime Day Threat
Everyone and their auntie Ethel knows that cybercriminals will follow the money trail, and follow the crowd that leads them there. Attacks against Gmail users are evidence of this, as access to a Google account opens the doors to a world of data and financial riches. The crowd will be heading to the annual phenomenon that is Amazon Prime Day between July 8 and July 11. I have already warned that scammers and hackers would already be making their nefarious plans, off the back of an 80% increase in attacks between 2023 and 2024. Now, security researchers at NordVPN have uncovered thousands of new fake Amazon websites.
Using data accumulated through NordVPN’s Threat Protection Pro platform, Vilius Kardelis from Nord Security confirmed that “cybercriminals have set up over 120,000 malware, phishing, and scam websites impersonating Amazon in the last two months.” The security researchers have seen 92,000 phishing sites with an Amazon name, with 21,000 fake Amazon websites attempting to install malware. 11,000 sites selling fake goods were also blocked. I have approached Amazon for a statement.
“Scammers know that shoppers’ excitement and urgency around limited-time deals make them more susceptible to clicking on malicious links or sharing personal information without proper verification,” Marijus Briedis, chief technology officer at NordVPN, said. “People should maintain good cyber hygiene even when looking for the best deals.”
Amazon Prime Day Scams Protection Advice
I was recently targeted ahead of Amazon Prime Day by scammers trying to get my Amazon login credentials, an incident that started and ended with a phone call. Dear reader, I was rather rude and then hung up. “Impersonation scams via phone calls,” an Amazon spokesperson told me, “more than doubled during Prime Day.” This shows that it’s not just fake websites that you need to worry about. The good news is that Amazon has you covered. Here’s how, according to an Amazon spokesperson:
- Verify purchases directly on Amazon, do not respond to a message, click on a link or give account information over the phone.
- Amazon will only ever ask for payment in its app or on the website, and never by email or phone.
- Do not be fooled by scammers creating a sense of false urgency. Count to ten and apply the advice at the top of the list.
- Amazon will never ask you to purchase a gift card.
You can find out more about how Amazon protects customers from scams and the best way to report an incident here.
“Always shop directly through Amazon’s official website to protect yourself from Amazon Prime Day scams,” Marijus Briedis said, adding that “fundamentals of cybersecurity can sometimes be forgotten during major online shopping events.” For example, not clicking on links in unsolicited emails, even if they are branded to appear to come from Amazon itself. “When in doubt, log into your Amazon account or contact customer support through official channels to verify suspicious communications,” Breidis concluded.
