Even though Black Friday and Cyber Monday have come and gone, shoppers are still making last minute purchases ahead of the holidays. Unfortunately though, the holiday season is also one of the busiest times of the year for scammers.
As reported by Lance Ulanoff at TechRadar (who dodged this particular scam himself), scammers are using text messages in an attempt to steal the credentials of Amazon shoppers.
These text messages claim that an expensive product was ordered from a recipient’s account though the scammers also include a phone number that they can call in case they think there was a mistake. This creates a sense of urgency as shoppers don’t want to be charged for an expensive product they didn’t buy at a time when money is already tight.
While this scam first appeared back in March of this year according to the Beaufort County Sheriff’s Office, it makes sense that scammers would want to revive it during the holiday shopping season and they could do so again during other big shopping days like Prime Day. Although it’s currently being distributed by SMS, it could also be sent over email. However, email security filters might detect that it’s spam before it even reaches the inboxes of potential victims.
Amazon Secure Server
In Lance’s case, the scammers claimed he ordered a $649 XGIMI Elfin Mini Projector and since he knew it was a scam due to spelling and grammatical errors in the text message, he decided to play along in order to show others how to avoid having their Amazon accounts stolen.
He called the number in the text message above and waited for the scammer behind the campaign to answer. As the scammer explained to him that “there have been multiple orders from Ohio” from his Amazon account, Lance logged into his account to see if this really was true. It wasn't, which is why he then asked the scammer about not seeing the orders on his account. The scammer calmly explained that “they’re all on hold” even though this clearly wasn’t true.
From here, the scammer tried to coax Lance into opening the app store and downloading an app called AnyDesk. However, he referred to this app as Amazon Secure Server multiple times during their conversation and when it came time to download it onto Lance’s phone, the scammer spelled out the app letter by letter instead of just saying it outright. This way, he would be less likely to catch onto the scam.
For those unfamiliar, AnyDesk is actually a remote desktop service that allows anyone to control your PC or smartphone from anywhere in the world. While it’s great for tech support or helping an older relative, it can also be abused by hackers and cybercriminals in scams like this one.
Eventually, Lance told off the scammer spelling out exactly what he wanted to say to him letter by letter in the same way the scammer had tried to trick him into downloading AnyDesk to steal his Amazon account.
How to stay safe from shopping scams
Lance’s story is just one example of the types of shopping scams that always seem to be prevalent during the holiday shopping season. In this instance, the fake text message was impersonating Amazon but we’ve also seen fake texts impersonating other retailers as well as delivery scams preying on holiday shoppers.
To avoid falling victim to this shopping scam and others like it, you first need to carefully scrutinize any texts you receive from unknown senders claiming to be from major brands. Are there spelling or grammar errors? Does the text message appear genuine? If there are, you can safely ignore the text and delete it. Calling any phone number included in a suspicious text message isn’t worth doing and like Lance did, you should login to a retailer’s site on your smartphone or computer and confirm whether or not any unknown orders were placed from your account.
In a support document on its site, Amazon provides even more information on how to identify whether an email, phone call, text message or even a web page belongs to the ecommerce giant. The company also suggests that you enable two-step verification to protect your account which is certainly worth doing for additional security.
At the same time, you might also want to consider investing in one of the best identity theft protection services as they can help you deal with fraud as well as recovering your identity. Likewise, installing one of the best antivirus software solutions on your computer as well as one of the best Android antivirus apps on your smartphone can help you avoid having your devices infected with malware and other viruses.
In a statement to Tom's Guide, a XGIMI spokesperson provided further insight on this scam impersonating the company's brand, saying:
"XGIMI takes our customers' security and privacy very seriously. We were alarmed to hear of this scam, that is fraudulently impersonating our company and using our company name. We can confirm, these texts and messages did not come from our company, and encourage customers to follow the advice of the staff at Tom's Guide and do not call the phone number, and report any such instances to their local authorities. We confirm that we have not had any data breaches, and we will take legal actions to protect our customers and our brand. Should our customers have any questions about their orders, they can reach out to us through their Amazon accounts or from our website.
When it comes to staying safe while shopping online, the one thing you really need to remember is not to let your emotions get the best of you. Scammers rely on this for their phishing campaigns to be successful and if you keep a clear head, you’re way less likely to fall for their tricks.
