Fake Amazon order confirmation email: how to spot it

"Thank you for your order. Your total: $649.99. If you did not place this order, click here to cancel." Your stomach drops. You didn't buy anything. This is a fake Amazon order confirmation, and it's built to make you panic.

How the scam works

1. You get an email that looks like an Amazon receipt, with a big price for a phone, a laptop or a gift card.
2. It says the order will ship soon, so you must act fast.
3. It offers a "Cancel order" button or a phone number for "customer service".
4. The button opens a fake Amazon sign-in page. If you type your email, password or card number, the scammers get them. The phone number leads to a fake agent who pressures you to "secure" your account.

Signs to look for

• An order you never made, often high-value.
• The sender's address: the name says "Amazon", but the address belongs to another domain or a free mailbox.
• A generic greeting: "Dear customer" instead of your name.
• A phone number to call to cancel. A real order email points you to your account, not to a number.
• A link that doesn't match: on a computer, hover over the button without clicking. If the address isn't an Amazon one, it's fake.
• Urgency: "cancel within 2 hours".
• Spelling mistakes, odd spacing or a blurry logo.

What to do

1. Don't click and don't call the number in the email.
2. Open the Amazon app, or type the address into your browser yourself. Look at "Your orders". No such order means the email is fake.
3. Delete it, or report it to the service that handles your mailbox as phishing.
4. In the US, report it at reportfraud.ftc.gov. In the UK, forward it to report@phishing.gov.uk.

What if I already clicked or paid?

• You typed your Amazon password: change it right away from the official site, and everywhere you used the same password. Turn on two-step verification.
• You gave your card number: call your bank, ask them to block the card and check recent charges.
• You installed software for a "support agent": disconnect from the internet, remove it and change your passwords from another device.
• You paid with gift cards: contact the card issuer quickly, then report it to the police.

To learn the general warning signs, read how to spot a phishing email. A similar trick uses a fake invoice: see the fake PayPal invoice scam.

Check it with Fishi

Forward the suspicious email to check@fishi.email, ideally as an attachment so the technical details are kept. Fishi looks at the sender, the links, attachments and the wording, then replies with a clear verdict and what to do next. It's free and needs no account. No tool is perfect: if in doubt, go to the official website yourself.