Phishing Attacks Impersonating Amazon Continue, Raising Concerns on the Cusp of Black Friday
New phishing attacks in the form of impersonated Amazon order confirmation emails cause potential victims to make phone calls and give up credit card details.
If you’ve been to a mall in the last few weeks, you already know the holidays have started. Whether it’s simply a coordinated effort to get us in the holiday spirit or in response to people wanting to get ahead of potential shortages in inventory come December, we’re fully in holiday mode here in the U.S.
That has traditionally meant more phishing attacks attempting to take advantage of unwitting victims. According to anti-phishing security vendor Avanan, a new campaign impersonating Amazon launched in October and is taking victims for credit card details, as well as harvesting phone numbers for potential text-based scams in the future.
The email does have elements of an actual Amazon email, but a scrutinizing look at the presentation tells those with a keen eye that something is amiss:
Recipients that press the “View or Manage Order” button are taken to the actual Amazon website (where, of course, the order in question does not exist). The confusion alone may be enough to cause victims to call the number in the email (which is far more readily available to the email recipient than navigating through Amazon’s site to find the actual customer service number.
We’ve seen this Amazon impersonation attack before earlier in the year, using the very same tactics with the same goal of getting the victim to call online. The only difference with that attack was that the “View or Manage Order” button did not work, forcing victims to call. This new attack feels more legitimate since you can be taken to the Amazon site by clicking the button in the emails used.
Given organizations can equally fall prey to such scams (as they, too, purchase items from Amazon), this should warrant some attention by those vigilant against phishing attacks. Employees that undergo Security Awareness Training are best prepared to spot this scam (and those like it) as a fake, rendering the attack useless.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW