Amazon text message scams on the rise: how to identify a phoney text

Scammers are looking to steal your details by sending fake text messages claiming to be from the retailer Amazon.

These phoney texts tell you to follow a link to secure your account following an attempted login.

They're examples of phishing texts, which are designed to steal your personal data in order to scam you either now or in the future. We’ve recently seen fraudulent texts like these from scammers impersonating the government to offer non-existent discounts on energy bills and fraudsters pretending to be your adult children to coerce you into transferring money.

Recently, Amazon has repeatedly been targeted by scammers looking to catch out unsuspecting customers. Many people have take to Facebook to warn others about these scams, and searches for ‘Amazon login scam text’ have surged on Google.

Read on to discover how to spot, report and avoid this scam.

Sign up for free Which? scam alert emails to find out about the latest scams news and advice.

How Amazon scam texts work

One of the texts reads:

‘Amazon: We detected a login into your account from a new device on 27/09/2022 at 15:10:08 UTC. If this wasn’t you, you can terminate that session via: [https://checkup-amazon.com].'

This text tempts you to click on a link in order to stop unknown activity on your account, a typical tactic used to incite panic. By checking the website database Who.Is, we can see the site linked to in the text was registered on 21 September, a giveaway that fraudsters are using dodgy new websites they make with the intention of scamming you.

Another text says: 

‘From Amazon - A new login has been attempted from IP address: 82.966.81.27 (Ipswich).If this was NOT you, secure your account immediately. [amazon-logins.com].'

This URL was also registered on 12 September 2022. Both phone numbers sending these texts have been linked to similar Amazon impersonation scams on Who Called Me, a website where you can look up suspicious phone numbers.

Another text includes the link [login-amazon-account.com]. This website was created on 10 October 2022. When you click on the link, you are taken to a convincing fake Amazon webpage where you are prompted to enter your login details. 

When we entered details for the purpose of this investigation, we were taken to another convincing fraudulent webpage asking for our name, date of birth, mobile number, home address and email address.

This is where your personal information will be stolen, making you vulnerable to having money taken from your account or being the victim of a future scam. The links on both pages to ‘Conditions of Use,’ Privacy Notice’ and ‘Need Help?’ all led led nowhere - the clearest sign that these websites aren’t genuine. 

One of the biggest telltale signs with these texts are the website URLs used - Amazon's genuine URLs are 'Amazon.co.uk' and 'Amazon.com'. Which? has reported the above URLs to the National Cyber Security Centre (NCSC).

Amazon's response 

An Amazon spokesperson told Which?: ‘These messages were not sent by Amazon. Scammers that attempt to impersonate Amazon put our customers and our brand at risk. Although these scams take place outside our store, we will continue to invest in protecting customers and educating the public on scam avoidance.

‘We encourage customers to report suspected scams to us so that we can protect their accounts and refer bad actors to law enforcement to help keep consumers safe. Please visit our help pages to find additional information on how to identify scams and report them.’

Amazon said scam texts will often claim there is a problem with a customer’s account, ask for sensitive information such as passwords, or state that the recipient is owed a refund. Amazon confirmed it will never ask for a customer’s password or personal information by text message or ask customers to make a payment outside of its website.

How to report scam text messages and websites

You can report scam texts by forwarding them to 7726. Make sure you delete and block the number and never click on any links given in the text message. Scam websites can be reported to the NCSC.

Contact your bank straight away if you enter your personal details into websites linked to from scam texts to secure your account. If you do lose money to a scam like this, read our guide about how to get your money back after being scammed.