Amazon Prime Day is nearly upon us, and crooks and cybercriminals are getting ready to rip you off.
Israeli security firm Check Point and Silicon Valley company Bolster, which spots fake websites, both have seen major upticks in domain registrations that relate to "Amazon," "Prime" or both.
- The best early Prime Day deals right now
- The best identity theft protection services
- New: iPhone 12 colors just leaked — here's what to expect
"Make no mistake: In the same way you will be hunting for bargains, hackers will be phishing for victims on Amazon Prime Day," reported Check Point in a blog post today (Oct. 9).
The crooks lure you in with phishing emails, instant messages or texts that promise deals that are too good to be true, or hope you misspell "Amazon" or the names of other popular retailers who will also be having sales.
Check Point said it saw "a 21% increase in domains registered containing the word 'Amazon' compared to the previous month" in the past 30 days. "The number of domains registered containing the words 'Amazon' and 'Prime' has doubled within the last 30 days, with 20% of those domains being malicious."
Beware of fake Amazon sites
Bolster reported a similar ramp-up in fake Amazon sites beginning in August, and even found and analyzed two bogus websites.
One, called AmazonCustomerSupport.net (no longer live), copied Amazon's graphics and branding and offered refunds on cancelled Amazon orders. But, as Bolster's Young-Sae Song explained in a blog post yesterday (Oct. 8), there were several tip-offs that this was not real.
"The form requests bank or credit card information," Song wrote. "Amazon always offers refunds to original form of payment or gift cards."
The fake site also prominently featured a phone number you could call for quick assistance, which many frequent Amazon shoppers might see as unusually helpful.
"Amazon does not encourage customer service by phone, and [it] takes a great effort to find phone support on the real Amazon site," Song dryly noted.
Surprisingly, the site doesn't ask you for your Amazon username or password. It might be that the crooks behind it are making enough money from stealing your credit cards and don't need to hijack your Amazon account.
The $1 iPhone 11 Pro scam
The other site Bolster found is still up, and it's a variant on the "iPhone giveaway" scam that's been texted to many Americans in the past several months.
The site claims to be part of an "Amazon loyalty program" and tells you that you've been given a chance to win an iPhone 11 Pro. There's even a list of fake positive testimonials from people who claim to have received their free iPhones.
You just have to answer a quick but pointless survey (sample question: "Are you male or female?") and then play a game in which you are always the winner.
"You have it! You won an iPhone 11 Pro!" the page says after you play the game. Then it tells you "Click on 'OK' to visit our sponsors page" and "Enter your address and pay $1 shipping to get your iPhone 11 Pro."
You're taken to a different site that asks you for your name, address, email address and phone number, then a second page where you, yup, fill out your credit card information to make that $1 "shipping fee."
"Despite the glowing reviews, the $999 phone will never arrive, and the shopper begin to see strange charges on the credit card number provided," Bolster's Song writes.
How to avoid being fooled by Prime Day scams
Both firms have advice on how to avoid being fooled by Prime Day scams. Bolster recommends just going directly to Amazon.com and other known retail websites to look for deals, rather than clicking on links in emails.
It also advises looking for blurry images or logos, and urges you to get familiar with the Amazon "purchase experience" so that you'll be quicker to spot deviations from the regular procedure.
"For example, saved payment information should not be re-entered during the purchasing process," Bolster's Song wrote. "If you are asked to reenter, the likelihood that the site is fraudulent is extremely high."
Check Point advises checking the URL for misspellings of "Amazon" or domain names ending in items other than ".com."
It also suggests using a credit card instead of a debit card for purchases (debit cards have weaker fraud protection), to avoid using public Wi-Fi networks, to make sure your Amazon password is strong and unique, to be wary of offers that seem just too good, and to remember that no online retailer needs to know your date of birth or your Social Security number.
For more online shopping advice, check out our guides to how to shop safely on Black Friday and our tips for safe Cyber Monday shopping.
