New phishing attacks in the form of impersonated Amazon order confirmation emails cause potential victims to make phone calls and give up credit card details.
If you’ve been to a mall in the last few weeks, you already know the holidays have started. Whether it’s simply a coordinated effort to get us in the holiday spirit or in response to people wanting to get ahead of potential shortages in inventory come December, we’re fully in holiday mode here in the U.S.
That has traditionally meant more phishing attacks attempting to take advantage of unwitting victims. According to anti-phishing security vendor Avanan, a new campaign impersonating Amazon launched in October and is taking victims for credit card details, as well as harvesting phone numbers for potential text-based scams in the future.
The email does have elements of an actual Amazon email, but a scrutinizing look at the presentation tells those with a keen eye that something is amiss:
Recipients that press the “View or Manage Order” button are taken to the actual Amazon website (where, of course, the order in question does not exist). The confusion alone may be enough to cause victims to call the number in the email (which is far more readily available to the email recipient than navigating through Amazon’s site to find the actual customer service number.
We’ve seen this Amazon impersonation attack before earlier in the year, using the very same tactics with the same goal of getting the victim to call online. The only difference with that attack was that the “View or Manage Order” button did not work, forcing victims to call. This new attack feels more legitimate since you can be taken to the Amazon site by clicking the button in the emails used.
Given organizations can equally fall prey to such scams (as they, too, purchase items from Amazon), this should warrant some attention by those vigilant against phishing attacks. Employees that undergo Security Awareness Training are best prepared to spot this scam (and those like it) as a fake, rendering the attack useless.
Here's how it works:
