Fraudsters manipulate our natural human behaviour to get us to do their bidding and they use lots of tricks to do so. One of the ways they suck you into their game is by using a trusted brand, one that is used every day by countless millions, a brand like Amazon.
Another useful device that cybercriminals like to use to make sure a scam work, is to piggyback off events and occasions. We’ve seen a few of these types of scams on The Defence Works blog. For instance, the “Game of Thrones” scam earlier this year used fans excitement about the new series to encourage downloads of the show; these downloads infected the victims computer with malware.
This week’s scam uses both a well-known brand (Amazon) to make a victim feel confident, along with an exciting event, Amazon Prime Day.
Amazon Prime Day…The Scam
Amazon Prime day launches on the 15th and 16th July 2019. There are promises of mega deals; it is being compared to Black Friday. If you are an Amazon Prime member and looking for a bargain, get your browsing finger skates on and get on down to the Amazon website sharpish, so the hype goes.
It is this urgency to get a good deal with a well-known brand that the fraudsters behind this week’s scam are relying on. Here is what the Amazon Prime Day Scam is all about.
The Amazon Prime Day Scam Phishing Email
The email received will look exactly like it has come from Amazon. This email has been prepared by fraudsters using a ‘phishing kit’. The kit is available from darknet marketplaces and it can be used to create phishing emails that are highly plausible. Because these ‘DIY’ phishing kits are relatively easy to use, chances are that many cybercriminals will use them during occasions like Amazon Prime Day.
Security firm, McAfee, has found that the Amazon Prime Scam is related to an earlier phishing fraud which targeted Apple users. Both scams are email-based. The email received contains a PDF attachment. The attachment contains links. If the recipient clicks on a link, they are taken to a site that looks like Amazon but is, in fact, a spoof site. This spoof site requests the visitor logs in – showing the “Amazon login” screen. If they do, their credentials will be sent to the fraudster behind the scam. The login credentials will then be used to hijack your Amazon account.
What to Do if You Receive an Amazon Prime Email
The best thing to do if you receive an Amazon Prime email this week is to not open it; certainly, do not download or open any attachments in such an email.
Amazon offers instructions on reporting a suspicious email to the company on their website.
The Amazon Prime day scam will come and go, but one thing is sure, scams are here for the duration. To keep ahead of the scammers, stay aware by using security awareness training.
Why not help your colleagues stay safe and send them this little reminder. Feel free to edit, copy/paste the advice below:
The Amazon Prime Scam
The 15th and 16th of July are Amazon Prime Day and scammers are taking full advantage of shoppers wishing to bag a bargain. A scam email that looks like it is from Amazon Prime is doing the rounds. This is a phishing email and may contain a PDF attachment.
DO NOT download any attachments from this email or click any links in the email or the attachment. The link will take you to a site that looks exactly like an Amazon login screen. DO NOT attempt to log in or your login credentials will be stolen and used to hijack your Amazon account.
Don’t forget to share this with your colleagues and friends and help them stay safe.
© 2023 . The Defence Works. All rights reserved.