{
  "slug": "amazon-account-alert-phishing",
  "canonical_name": "Amazon \"account-alert\" phishing emails",
  "family": "account-suspension",
  "impersonates": {
    "brand": "Amazon",
    "disclaimer": "Amazon is not involved; criminals impersonate the brand.",
    "official_fraud_page": "https://www.amazon.com/reportascam"
  },
  "goal": [
    "credentials",
    "personal-data",
    "malware"
  ],
  "channels": [
    "email"
  ],
  "summary": "A 2019 wave of emails with a spoofed account-alert@amazon.com sender: \"your account settings have been changed\", a report ID, and a link to a fake Amazon login form. Some copies carried a Word attachment instead of a link.",
  "status": "dormant",
  "first_seen": "2019-08",
  "last_seen": "2019-08",
  "recognise": [
    "A \"statement\" or \"daily report\" you never subscribed to",
    "A report ID and a date in the subject to look official",
    "The link opens a login form that is not amazon.com"
  ],
  "variants": [
    {
      "subject": "[Statement from Amazon is available] [Daily Report Email] — Your account checking setting data has been changed on {date} {report ID}",
      "first_seen": "2019-08",
      "channel": "email",
      "sources": [
        "https://soft2secure.com/knowledgebase/account-alert-amazon-com-scam"
      ]
    },
    {
      "subject": "[Amazon Statement Report] [Automatic Daily Mail] — Verify your billing and/or shipping address using a web browser {report ID}",
      "first_seen": "2019-08",
      "channel": "email",
      "sources": [
        "https://soft2secure.com/knowledgebase/account-alert-amazon-com-scam"
      ]
    },
    {
      "subject": "[Daily Email Report] Latest: It appears that your account settings have been changed on other devices {date} / Number {report ID}",
      "first_seen": "2019-08",
      "channel": "email",
      "sources": [
        "https://soft2secure.com/knowledgebase/account-alert-amazon-com-scam"
      ]
    }
  ],
  "specimen": {
    "date": "2019-08",
    "channel": "email",
    "from": "account-alert@amazon.com (spoofed display address)",
    "reply_to": null,
    "subject": "[Statement from Amazon is available] [Daily Report Email]",
    "attachment": null,
    "body_text": null,
    "redactions": [],
    "image": "/wp-content/uploads/phishing-email-account-alert-amazon-com.png",
    "sources": [
      "https://soft2secure.com/knowledgebase/account-alert-amazon-com-scam"
    ]
  },
  "tells": [],
  "indicators": {
    "sender_domains": [],
    "senders": [
      {
        "value": "account-alert@amazon.com (spoofed)",
        "first_seen": "2019-08",
        "sources": [
          "https://soft2secure.com/knowledgebase/account-alert-amazon-com-scam"
        ]
      }
    ],
    "reply_to": [],
    "phone_numbers": [],
    "urls": [],
    "wallets": [],
    "attachments": [
      {
        "name": "Word document (.doc) attached to some copies",
        "sha256": null,
        "sources": [
          "https://soft2secure.com/knowledgebase/account-alert-amazon-com-scam"
        ]
      }
    ],
    "note": "Indicators change weekly; an empty list never means an email is safe."
  },
  "what_to_do": {
    "if_received": [
      "Do not open the link or the attachment",
      "Check your account by typing amazon.com yourself",
      "Report it through Amazon's scam page and delete it"
    ],
    "if_called_or_paid": [
      "Entered a password? Change it now, and everywhere else you used the same one",
      "Entered card details? Call your bank, ask them to block the card and reissue",
      "Entered a one-time code? Sign in to the real service now and check for changes to email, phone and payment settings"
    ],
    "report_links": [
      {
        "label": "Report to Amazon",
        "url": "https://www.amazon.com/reportascam"
      },
      {
        "label": "Report to the FTC",
        "url": "https://reportfraud.ftc.gov/"
      }
    ]
  },
  "malware_family": null,
  "timeline": [
    {
      "date": "2019-08-13",
      "type": "specimen",
      "title": "Specimen №1: the spoofed account-alert sender and three subject lines",
      "text": "The guide recorded three subject-line templates, a fake login form, and a Word-attachment variant.",
      "added": [],
      "removed": [],
      "sources": [
        "https://soft2secure.com/knowledgebase/account-alert-amazon-com-scam"
      ]
    },
    {
      "date": "2026-09-02",
      "type": "registry",
      "title": "Family created",
      "text": "Grew out of the 2019 guide, which stays online unchanged. No specimens since 2019 — dormant.",
      "added": [],
      "removed": [],
      "sources": []
    }
  ],
  "related": [
    "amazon-order-callback",
    "netflix-payment-failed"
  ],
  "sources": [
    "https://soft2secure.com/knowledgebase/account-alert-amazon-com-scam"
  ],
  "legacy_urls": [
    "/knowledgebase/account-alert-amazon-com-scam"
  ],
  "legacy_redirect": false,
  "created": "2026-09-02",
  "updated": "2026-09-02",
  "changelog": [
    {
      "date": "2026-09-02",
      "text": "Record created at the registry launch."
    }
  ],
  "url": "https://soft2secure.com/scams/amazon-account-alert-phishing",
  "licence": "CC BY 4.0",
  "generated": "2026-09-03"
}