A convincing new text message scam is targeting Amazon shoppers. Cybersecurity researchers are warning users about highly targeted SMS phishing attacks—often called smishing—designed to steal login credentials and drain Amazon account balances.
Claim Free Amazon Gift Card here
The scam relies on a clever psychological trick. Instead of claiming your account is locked, the fraudulent messages warn that your Amazon gift card balance has been compromised or is running out. This specific angle bypasses the typical security filters in people’s minds. Nobody wants to lose free money.
How the Smishing Scam Works
It starts with a simple text message. The notification looks official, sometimes even appearing in the same thread as legitimate Amazon delivery updates. This happens when scammers spoof the sender ID, tricking your phone into grouping the messages together.
The text usually contains an urgent warning. It might claim that a high-value gift card is about to expire, or that suspicious activity was detected on your gift card balance. A link is always included, urging you to secure your funds immediately.
If you click the link, you are taken to a fake website. This lookalike page is designed to mimic the genuine Amazon login screen perfectly. The attackers use convincing domain names that look official at a quick glance, often containing words like secure, login, or balance update.
The Multi-Factor Authentication Trap
What makes this campaign particularly dangerous is how it handles security features. Many people believe that having two-factor authentication (2FA) active on their accounts makes them immune to phishing. Unfortunately, these modern phishing kits are smart.
When you enter your username and password on the fake site, the scammers pass those details to the real Amazon website in real-time. If Amazon requests a one-time verification code, the fake site prompts you to enter it too. Once you type that code into the spoofed page, the attackers grab it and instantly log into your real account.
Within seconds, you are locked out. The scammers quickly change the password, update the associated email address, and unlink your phone number. They then proceed to spend any stored gift card balances on digital codes, electronics, or high-value items that can be easily resold.
How to Protect Your Account
Staying safe requires a mix of skepticism and good digital habits. Security experts recommend following these essential rules to keep your Amazon account secure:
- Never click links in text messages. If you receive an alert about your Amazon account or gift card, close the message. Open your web browser, type Amazon’s web address manually, and log in from there.
- Check the Message Center. Amazon stores copies of all official communications in your account dashboard. You can find this by navigating to Your Account and looking for the Message Center. If the text warning isn’t listed there, it is a scam.
- Examine the URL closely. Before entering any login information, check your browser’s address bar. Official Amazon pages will always end with amazon.com or its regional equivalents like amazon.co.uk. If you see spelling variations or extra words in the domain name, leave the site immediately.
- Report suspicious messages. You can forward scam text messages to 7726 (SPAM) on most mobile networks. This helps cellular carriers block the malicious senders.
Phishing attacks are becoming more personal and harder to spot. By taking an extra moment to verify urgent alerts directly through official channels, you can keep your personal data and your wallet safe from online thieves.