As Amazon Prime Day approaches with promises of deals and dopamine, cybercrooks are already circling like vultures.
Amazon Prime Day lands on July 8th this year, and while shoppers are prepping for discounts and deals, hackers are busy spinning up fake websites, phishing emails, and domain traps. A big shopping holiday often means potential for chaos, and criminals know that chaos is profitable.
In just the first few weeks of June, security researchers at Check Point spotted more than 1,230 new domains trying to impersonate Amazon. About 87% of them are sketchy at best, and outright malicious at worst.
Nearly 1 in 81 of these domains contained the term “Amazon Prime,” designed to trick users into clicking and leaking their credentials.
Researchers warn that scammers are sending out phishing emails that look like Amazon customer service, with subject lines referring to “Refund Error” or “Account Issues.”
The emails are engineered to trigger reactions of urgency in victims. Once they click the link, they’re taken to a fake Amazon login page that looks nearly real, but it’s fake. Instead of updating required information, the victims give away their Amazon credentials to threat actors.
Some of the fraudulent websites observed in the campaign:
- Amazon02atonline51[.]online
- amazon-2025[.]top
A successful attack of this kind can lead to unauthorized purchases, identity theft, or gift card abuse. A similar increase in scam threats is witnessed during Black Friday and Cyber Monday, or prior to Valentine’s Day, with experts warning shoppers to stay extremely vigilant.
Security experts warn to stay cautious
Cybersecurity experts remind that it’s not just retailers prepping for Prime Day, cybercriminals are, too.
“The surge in promotional emails, limited-time offers, and high-volume online activity creates ideal conditions for phishing, malware delivery, and fraudulent transactions,” said Dr. Darren Williams, founder and CEO at BlackFog.
He reminded that the retail sector saw a 96% increase in ransomware attacks last year, as well as year-over-year growth in spoofed domains and malicious apps impersonating Amazon and its delivery partners. This underscores how aggressively threat actors are targeting consumer-facing industries.
“Most of us have seen at least one suspicious or fake email. These used to be easier to spot. Now, they’re evolving,” said Julien Richard, VP of InfoSec of Lastwall.
“The next wave of phishing is more subtle. A short note saying your package has arrived might not raise any red flags, especially around Prime Day. But it still gets the click,” he added.
Experts advise being cautious of emails from unfamiliar or slightly altered domains, avoiding clicking on promotional links directly from messages, and verifying the legitimacy of apps before downloading.
How to stay safe on Amazon Prime Day?
- Don’t trust weird URLs: If you’re about to click on something that ends in .top or .online or has hyphens and extra numbers, stop. Plan your purchases and go directly to Amazon’s website or app. If you are using a browser, always type amazon.com manually.
- Avoid clicking email links: If you get an email that screams about account issues, open a new tab and go to Amazon yourself. Don’t follow the digital trail scammers set for you.
- Check the lock, but verify anyway: HTTPS and that padlock icon help, but even fake sites can spoof it. The real giveaway is the domain itself. If it’s fishy, it probably is phishy.
- Use two-factor authentication and strong passwords: Set up two-factor authentication on Amazon. While you're at it, use a password manager, as recycling passwords is a big threat to being hacked.
- Urgency = scam energy: If it’s screaming at you to act now, take a breath. Scammers always weaponize urgency. If it’s real, it’ll still be there in 10 minutes.
- Too good to be true? It probably is: If that iPhone is 85% off on a random site that isn’t Amazon, it’s a trap. The only thing you’ll be unboxing is regret.
- Use smart payments: Virtual cards, payment apps, anything with extra protection is a good choice for online purchases. Avoid wiring money or using direct bank transfers.
Your email address will not be published. Required fields are markedmarked