Amazon "account-alert" phishing emails
A 2019 wave of emails with a spoofed account-alert@amazon.com sender: "your account settings have been changed", a report ID, and a link to a fake Amazon login form. Some copies carried a Word attachment instead of a link.
- Impersonates
- Amazon
- Arrives by
- First seen
- 2019-08
- Last seen
- 2019-08
- Specimens
- 1
- Updated
- 2026-09-02
Right now the only version we have seen
How to recognise it
- A "statement" or "daily report" you never subscribed to
- A report ID and a date in the subject to look official
- The link opens a login form that is not amazon.com
What to do
- Do not open the link or the attachment
- Check your account by typing amazon.com yourself
- Report it through Amazon's scam page and delete it
Already called, clicked or paid? what to do in the next hour
- Entered a password? Change it now, and everywhere else you used the same one
- Entered card details? Call your bank, ask them to block the card and reissue
- Entered a one-time code? Sign in to the real service now and check for changes to email, phone and payment settings
How it changed
nothing to compare yet · one wave on record2019-08the spoofed account-alert sender and three subject lines
Got a different version? A new subject line, sender, number or domain becomes the next point on this line. Redacted before publication. Send it →
02 Sept2026
Registry
Family created
Grew out of the 2019 guide, which stays online unchanged. No specimens since 2019 — dormant.
13 Aug2019
Specimen
Specimen №1: the spoofed account-alert sender and three subject lines
The guide recorded three subject-line templates, a fake login form, and a Word-attachment variant.
From
account-alert@amazon.com (spoofed display address)
Subject[Statement from Amazon is available] [Daily Report Email]
Channelemail
Same trick, other brands
- Amazon "order confirmation" callback scamactive · 2026-09
- Netflix "payment failed / account suspended" phishingdormant · 2026-09
Indicators · 2
- account-alert@amazon.com (spoofed)sender · 2019-08
- Word document (.doc) attached to some copiesattachment
Indicators change weekly; an empty list never means an email is safe. Defanged: replace [.] with a dot.
In other streams
- Guide · Account-alert@amazon.com scam – phishing emails on the rise2019-08
- 3 subject lines on record: “[Statement from Amazon is available] [Daily Report Email] — Your account checking setting data has been changed on {date} {report ID}” · “[Amazon Statement Report] [Automatic Daily Mail] — Verify your billing and/or shipping address using a web browser {report ID}” · “[Daily Email Report] Latest: It appears that your account settings have been changed on other devices {date} / Number {report ID}”
Registry data
- Machine-readable
/scams/amazon-account-alert-phishing.json- Timeline feed
/scams/amazon-account-alert-phishing/feed.xml- Sources
- 1 · 1 change logged
- Licence
- CC BY 4.0 · attribution required
- Created / updated
- 2026-09-02 / 2026-09-02