Amazon Prime Renewal Scam Emails

Prime customers again targeted in phishing campaign

tl;dr

Watch out for fake emails claiming that your Amazon Prime membership has been deactivated or needs to be renewed. Amazon did not send them. Clicking opens a scam website designed to steal your personal and financial information. (See example in screenshot below.)

---

A new phishing campaign is currently targeting Amazon Prime customers. The emails, which have the subject line “Your Prime Membership is Renewing”, claim that your membership has been deactivated.

Emails Not From Prime

Despite appearances, however, Amazon did not send these emails, and they have no connection to your Prime account. They are scams designed to steal your personal and financial information.

Update Link Opens Phishing Site

The emails urge you to click a button to update your payment information and reactivate your account. Clicking the button opens a bogus website designed to look like it is a page on the Amazon site.

Like the email, the site has no connection to Amazon.

Once on the fake site, you will be asked to enter your Amazon account credentials. Next, you will be asked to enter your credit card details and other personally identifying information, ostensibly to fix the account renewal problem and reactivate your membership.

Credit Card Fraud and Identity Theft

Once you submit the requested data, scammers can then use it to:

• Hijack your Amazon account

• Use your credit card for fraudulent purchases

• Attempt to steal your identity

Don’t Click Links in Such Emails

Companies such as Amazon may well send you email notifications if there is a payment or other issue with your account. Criminals exploit this and formulate fake account notification emails that seem genuine at first glance.

The easiest way to avoid getting caught in such scams is to avoid clicking links in any emails claiming that you need to deal with a payment or account problem.

Instead, log in to your account by entering the address into your browser’s address bar or via an official app. If the supposed account problem is real, you will be notified after you log in and can then take the necessary steps to deal with it.

A screenshot of the scam email: