Forum Topic

Amazon Spoof Emails?

Yesterday I received two emails in very quick succession from Amazon which look dodgy to me so I have c&p'd them below:AMAZON 22.41     "Password assistanceTo verify your identity, please use the following code:883830Amazon takes your account security very seriously. Amazon will never email you and ask you to disclose or verify your Amazon password, credit card, or banking account number. If you receive a suspicious email with a link to update your account information, do not click on the link—instead, report the email to Amazon for investigation.We hope to see you again soon." AMAZON 22.41"Thanks for visiting Amazon.com! Per your request, we have successfully changed your password.Visit Your Account at Amazon.com to view your orders, make changes to any order that hasn't yet entered the shipping process, update your subscriptions, and much more.Should you need to contact us for any reason, please know that we can give out order information only to the name and e-mail address associated with your account. Thanks again for shopping with us."I did not ask Amazon at any time for assistance with my password (or anything else) and forwarded both of these emails to stop-spoofing@amazon.com to ask if they are genuine or not, but I just received generic replies basically advising me to be careful! I am now reluctant to use Amazon, or even change my password in case that triggers something horrible.🙀Has anybody else received these emails and what did you do? Mtia.

Sue Hammond ● 2803d36 Comments

Any website that asks you to verify your identity, unless you have started the login process, is dodgy.  Emails asking this are definitely dodgy.Never, ever click on a link on one of these emails, they will enable all sorts of dodgy hacking things.

Bunny Payne ● 2803d

Bunny, I was caught out many years ago clicking on a PayPal link so have never done it since, and there were no links in these emails anyway.  What really puzzles me is the verification code, what purpose is that for I wonder?

Sue Hammond ● 2803d

I've not seen these before. Main concerns is not to follow any links in these emails. I am not aware of Amazon changing any passwords without a user initiating it. I would recommend logging onto your account using a browser and keying in the Amazon URL (www.amazon.com) into the address bar, just to check your account is OK and there are no orders you don't recognise. Probably a good idea to change your password. I did once investigate a dodgy looking email from Amazon for a colleague. It turned out it was valid, it had been sent because it turned out their credit card had reached its expiry date - the email just looked very unprofessional! Amazon are introducing two factor authorisation using a verified code but my understanding is that uses SMS.

Michael Ixer ● 2803d

Sue, don't be nervous of ordering from Amazon, as long as you have a strong password and never disclose it to anyone.Scams tend to come on emails, NEVER EVER, believe them or reply to unknown emails, or click on their links. Reputable websites will contact you if you have an account with them, but not on email.  My advice is make sure you have an account with websites you want to trade with and have very strong passwords (and keep a record of them).

Bunny Payne ● 2803d

Hi Michael, I just did what you advised and when I tried to sign in it said my password was incorrect!🙀 I tried it again just in case I had typed the wrong password but I got the same result.😐What should I do next?

Sue Hammond ● 2803d

In my opinion, email is the most dodgy and problematic, anyone can get your email, and they do.  I have a talktalk email from years ago when I had my phone and broadband with Talktalk.So pleased that over the past few years, having changed by broadband provider twice since, I was able to keep my original email address.You would not believe how many crappy, boring fraudulent phone calls I receive saying that I am a Talktalk customer.  Emails addresses get sold on all the time.

Bunny Payne ● 2803d

Sue, go into your Amazon account, put in your email address, try your password, if it doesn't work click on forgot password (or whatever it says).  They will then send you a link to your email which will be safe, best to keep looking over the next 10 mins, then they will show you how to set a new password which you will have to do.  Then make sure you write it down.  Good luck!!

Bunny Payne ● 2803d

I am always logged into my account on the Amazon app so just accessed my account that way and everything looks normal with my orders. I suspect if I log out of the app I won't be able to get back in that way either. I don't really want to start mucking about with passwords in case my account is being tracked by hackers waiting to steal my 'new' password.

Sue Hammond ● 2803d

Sue. When you go to the login screen there should be a link above the right of the password entry box after you've entered your email address. Click on that and follow the instructions. You should be able to enter a new password. I can't remember exactly how the Amazon system works - it should email you a link to do the actual change or verify the change. I'm concerned about how you Amazon account's been compromised, you probably should consider changing your email password as well in case that's been compromised as well. I can't be too specific as I don't know the details of your set up.

Michael Ixer ● 2803d

Fair enough. Just keep an eye on your orders to see none have been added!

Michael Ixer ● 2803d

@Michael 21.50Hi Michael. The only option was the usual 'forgot password?' which I am wary of using atm so I will call Amazon customer service tomorrow and ask to be put through to their security department.

Sue Hammond ● 2803d

Sue. The "forgotten password" was the link I meant, I didn't explain it well. I think you should do what you feel comfortable with but as I said above keep an eye on any new orders. And if the app locks you out I would suggest changing your password, but I agree someone could be monitoring you Amazon app or, more likely, email.

Michael Ixer ● 2803d

You might want to check if you email address has been compromised using this site:https://haveibeenpwned.com/It's not necessarily an issue if it's listed if you know your email password has been changed since the compromise. (One of my addresses was compromised in the 2012 LinkedIn hack but the password the hackers have hasn't been used since just after that!)

Michael Ixer ● 2803d

Sue. If you're getting bored with Amazon have a look at Ken Munroe's latest escapade (he owns a securing company):https://www.bbc.co.uk/news/technology-47485731

Michael Ixer ● 2803d

Sue. If you're getting bored with Amazon have a look at Ken Munroe's latest escapade (he owns a securing company):https://www.bbc.co.uk/news/technology-47485731

Michael Ixer ● 2803d

Ive had innumerable spoof emails, including SUe's Amazon phish. There's almost always a clue: misplaced space or comma, odd grammar, or signed by Mr Nelson Blessed Spirit N'Kwekwe.Most of the text and links will be directly from the official site so you do need to look carefullySome email services are end to end encrypted, like Protonmail. Worth using these if signing up to a site where you'll be buying stuff. Wont protect you from data leaks but at least your safer than Gmail!

Peter Miles ● 2802d

Peter, it's true, some of the grammar and general sentence structure is hilarious!!  Always a huge give away, and a good laugh!!

Bunny Payne ● 2802d

Worth a look, I love this :)https://www.youtube.com/watch?v=wWIwlfo9_OM

Bunny Payne ● 2802d

Peter. Interesting, have you actually found a way to send end-to-end encrypted emails to providers such has Amazon using this service? I've evaluated similar services for financial services (granted not this one) and found that security filtering and regulatory and forensic logging requirements block or inhibit such services. But if this one doesn't I'd like to know.

Michael Ixer ● 2802d

Micheal I havent needed to so far, many if not most online shops use their own email system. I know financial services AML rules are so tight that it probaby wouldn't. Try it, sign up is so quick and simple - no long forms, unpleasant bending, blood samples or a piece of skin off the back of the scalp.

Peter Miles ● 2802d

Most people's email addresses have been filched but that doesn't necessarily mean you are compromised unless you haven't changed your (email account) password in the lat five years. If you've never changed it you really must though. Best practice is to change it regularly. A bore but extremely important.They don't 'know' you have an account at Amazon. They are making a guess. A percentage of the time they will strike lucky. Especially so with Amazon, iTunes, Ebay and the like as they are almost universally used by a great swathe of the population. These 'spoofs' - faked emails that visually imitate a company's genuine emails - are trying to trick you into giving them your password to whatever company they are pretending to be by telling you there is some sort of problem. If you click on the link in the email, which you should be extremely cautious about doing, you will be directed to the fraudster's own page, not Amazon's, which will most likely ask for your 'old' password before it asks you to offer e 'new' password. What you will have just done is given a criminal access to your account where at the bare minimum, he can change your account email address (locking you out of being able to stop them), make purchases of whatever he likes and possibly other dodgy stuff related to the fact he can use the account for financial gain through access to your card. The same scam works for any online site where your credit card or bank details are involved, whether it be Inland Revenue, the AA/RAC, parcel service etc.

Freddie Francis ● 2801d

@Freddie. The spoof Amazon emails didn't contain links. It implies another attack vector, like a compromised email account. I've seen similar attacks used to carry out financial frauds. Email is inherently insecure and unreliability. Two factor is more secure (engine time SMS passcodes is more secure), except SS7, the signalling system used on the phone network is also old and has security issues...

Michael Ixer ● 2801d

Sorry but then what is the purpose of the email? There must be some sort of call to action, i.e. to click on to somewhere else. Otherwise what is the point?

Freddie Francis ● 2801d

As I understand in the OP about this is that it was a ruse to get them to change their amazon password. The copied content gives no clues as to the original format so it may well have had hyperinks.

Freddie Francis ● 2801d

This might be helpful: https://sellercentral-europe.amazon.com/forums/t/that-was-close/83850/30

Freddie Francis ● 2801d

Just going back to Barbara's enquiry, I have had them from HSBC, Lloyds, Barclays, BT, BT Openreach, Talktalk, HMRC, the DVLA and numerous others, quite often telling me I either am due a refund, or that my services are about to switched off.At work at Pepsi we would get hundreds of people phoning in to say they'd been told they'd won a prize and I know this happens with all other relevant companies.  It's HUGE business and you need to be vigilant at all times.  If in doubt, don't click on it, just delete.

Bunny Payne ● 2801d

Thanks Freddie. I'm wandering if there's a weakness in the app or somewhere in Amazon's process that's being exploited. They're unlikely to admit that. NarWest had to come clean on the problem with their app because they're regulated:https://www.bbc.co.uk/news/business-19897527In that instance the fraudsters acquired personal and bank details of the targets and set up facilities to use the app on the victims' accounts! I believe the Tesco credit card frauds a couple of years ago was done by someone exploiting a weakness in the card issuing process not a "technical" hack.

Michael Ixer ● 2801d

Hi Freddie.  It's weird that there were no links to click on, just a verification code, which as I later discovered is Amazon's own method used if you forget your password or need to set a new one, as I had to after being hacked. I also had to change my email password on all devices which was a pita but essential. Fortunately my account was not compromised with bogus orders, and now I don't store any card details, just add them at checkout. I could c&p the instructions I received from Amazon's security department but they are rather long and I didn't want to bore💤 everybody.

Sue Hammond ● 2800d

One possibility is that these were legitimate Amazon emails triggered by actions of those attempting the fraud, but one could only ascertain that by studying the internet path in the emails' headers and that's not always easy to find in some apps. The main thing is Amazon seem to have resolved this in a satisfactory manner and the attempted fraud has been thwarted?

Michael Ixer ● 2799d

@MichaelAll too technical for me🧐but I get your drift Michael. I found Amazon to be very helpful and their response times were fast, so no harm done. I'd had the same email password for over 20 years so it was about time it was changed to a stronger one. I've had to write this one down though.😊

Sue Hammond ● 2799d

Tut tut, for not changing :-) with passwords, think of a phrase you might remember,  then add a few random characters and just write down the random characters:Thequickbrownfox!Ad@34&/For example

Michael Ixer ● 2799d

I just received another one!😡 Password assistanceTo verify your identity, please use the following code:481658Amazon takes your account security very seriously. Amazon will never email you and ask you to disclose or verify your Amazon password, credit card, or banking account number. If you receive a suspicious email with a link to update your account information, do not click on the link—instead, report the email to Amazon for investigation.We hope to see you again soon.😡😡😡😡

Sue Hammond ● 2798d

Back to Amazon ...

Michael Ixer ● 2797d

No I didn't contact them this time Michael. I just changed my password using your tip, and I'll carry on monitoring my account.

Sue Hammond ● 2797d

Good. One thing I forgot to add was make sure it's a phrase that people who know you well won't guess. I once used a old  registration number from the early 70s as the base for some passwords. Imperial College decided to put old copies of the student magazine Felix on line sometime in the 2000s. In the 70s successful applications for students' college parking permits were published in Felix, along with name and the car's registration number, etc ... A long time before the GDPR!

Michael Ixer ● 2797d

My password prefix is a completely random word that has nothing to do with cats.😸😉

Sue Hammond ● 2797d