Don't Get Scammed While Prime Day Shopping

Amazon's annual Prime Day sale is about to kick off, but shoppers on the hunt for great deals need to be careful that they don't get scammed in the process. Cybercriminals will be looking to use the sale as a chance to swindle unwitting shoppers out of their money and account information.

Ahead of the massive sale, which starts Tuesday, researchers for the cybersecurity firm Check Point say they've spotted 1,230 new Amazon-related domains during the month of June and about 85% of those appear to be potentially malicious or scammy. 

Some of the fake sites are designed to look just like Amazon. Unwitting shoppers reach them when they click on links in phishing emails, SMS messages or ads posted on social media. In some cases, consumers are also increasingly receiving scam phone calls from people pretending to be Amazon, Amazon says.

That's not exactly shocking. Scam activity tripled during the days surrounding last year's Prime Day event and Amazon doesn't expect this year to be any different, says Scott Knapp, Amazon's director of worldwide buyer risk prevention.

"They say there's a problem with your Prime membership and if you'll just pay this money we'll fix it, or if you call us we'll work through it," Knapp said in an interview. "They'll say 'just give us [your] credit card and we'll make it go away.'"

Others messages might claim that there's a problem shipping an item or are designed to look like an order confirmation for a very expensive item that the customer didn't buy.

Regardless of their specific pitch, the objective of the scams is to steal payment card information or Amazon account usernames and passwords. And that could prove disastrous for shoppers who might not think before they click.

Amazon-related scams aren't relegated to just Prime Day and aren't a new thing. According to the Federal Trade Commission, Amazon was the second-most impersonated company in 2023. Scammers pretending to be Amazon accounted for 34,000 complaints and $19 million in losses reported to the commission.

And it's not just Amazon. Scammers also try to pass themselves off as tech support for companies like Microsoft, retailers like Best Buy, shipping companies such as UPS and officials from government agencies like the IRS.

It's Amazon's wide-spread popularity among consumers that makes it a top choice for scammers, says Tony Sabaj, Check Point's head of Americas channel engineering and office of the chief technology officer.

If a consumer gets an email that looks like it's coming from a bank they don't have an account with, they're probably going to delete it right away, he says. But just about everybody has an Amazon account these days, making scam emails featuring Amazon significantly more convincing.

"Online shopping scams are incredibly profitable, and there's no bigger platform for online shopping than Amazon," Sabaj said, adding that outside of the holiday season, Prime Day represents Amazon's biggest sales volumes of the year.

As a result, shoppers are going to need to be especially on guard as they look for deals next week, he said. Some Prime Day offers feature big price cuts and disappear fast, making it more likely that they will click before they think.

Ideally, that burden shouldn't be placed on shoppers, Knapp says. Amazon's goal is to stop the scams at the source, spotting the scam email campaigns and fake websites and getting them taken down before they reach large numbers of consumers.

Over the past 12 months, Amazon has initiated the takedowns of more than 40,000 phishing websites and 10,000 phone numbers being used to impersonate the company and scam consumers, Knapp said.

Artificial intelligence tools have been a big help in doing that quickly, Knapp says, allowing Amazon's security professionals to spot signs of fraud faster and take action.

"We're now able to do that at a pace we haven't before," Knapp said, noting that previously security professionals would have to go through mountains of data manually and "connect the dots" before reporting potential fraud. 

What once took hours can now be accomplished in minutes, he says.

All of that aside, a little common sense goes a long way, Sabaj says. Many problems can be avoided if shoppers just take a moment to think.

"There are some great deals, but some are just too good to be true," he said. "Nobody is going to give away an 80-inch TV for $20. It's a hoax."

Tips for safe Prime Day shopping 

Here are a handful of tips from Amazon and Check Point for how to stay safe while shopping for Prime Day deals.

Double-check domain names. If a site's address doesn't start with "Amazon.com," it could be a fake. The same goes for other online retailers. Look for misspellings, additional punctuation and anything else that might seem a little off in the address.

For Amazon purchases, stick to the company's website, app and stores. Amazon will never ask for payment over the phone, by text or by email. It also won't ask you to make them by bank transfer or through a third-party site.

Go straight to retailer websites. You're better off typing in the URL directly than clicking on a link that might be shady. If a message says you ordered something that you think you didn't, skip the link and just check "My Orders" in your Amazon account to see if that's true.

Use a good password and 2FA. Hard-to-crack passwords are musts for all retail sites. That means they need to be long, unique and random. Don't be tempted to recycle even a great password if you've used it for another account. And whenever possible, enable two-factor authentication. Adding this extra form of authentication could save your bacon if your password does end up compromised.

Treat urgency with suspicion. Yes, a lot of Prime Day deals are limited-time, but any offer that says you need to buy right away needs a closer look. Cybercriminals are banking on you clicking before you think.

Look for the lock. Any legitimate retail site uses SSL encryption by now. It's signified by a lock symbol at the start of the URL. If it's missing, shop elsewhere.

Use a credit card. If fraudulent charges show up, you won't be on the hook for the cost. 

Report scam messages. Most email programs have buttons that let you report spam or phishing. Scam text messages can be reported by forwarding them to 7726 (SPAM). Prime Day scams should be reported to Amazon through their app or website.

If it's too good to be true… Yes, we've heard this so many times it's officially a cliche, but any mind-blowingly amazing deal should be treated like a scam, because it probably is. If you can't verify it on the company's site, steer clear.