{
  "slug": "amazon-order-callback",
  "canonical_name": "Amazon \"order confirmation\" callback scam",
  "family": "fake-invoice-callback",
  "impersonates": {
    "brand": "Amazon",
    "disclaimer": "Amazon is not involved; criminals impersonate the brand.",
    "official_fraud_page": "https://www.amazon.com/reportascam"
  },
  "goal": [
    "callback",
    "remote-access",
    "payment"
  ],
  "channels": [
    "email",
    "call"
  ],
  "summary": "A confirmation for an expensive order you did not place — a phone, a laptop — with a \"fraud department\" number to call if it was not you. The number leads to a script that asks for remote access or payment \"to reverse the order\".",
  "status": "active",
  "first_seen": null,
  "last_seen": null,
  "recognise": [
    "An expensive item you never ordered",
    "The email offers a phone number instead of an order page",
    "No order history when you check your real account"
  ],
  "variants": [],
  "specimen": null,
  "tells": [],
  "indicators": {
    "sender_domains": [],
    "senders": [],
    "reply_to": [],
    "phone_numbers": [],
    "urls": [],
    "wallets": [],
    "attachments": [],
    "note": "Indicators change weekly; an empty list never means an email is safe."
  },
  "what_to_do": {
    "if_received": [
      "Do not call; open your orders by typing amazon.com yourself",
      "Report it through Amazon's scam page",
      "Delete it"
    ],
    "if_called_or_paid": [
      "Gave remote access? Disconnect from the internet, uninstall the tool they had you install, change passwords from another device",
      "Paid by card or bank transfer? Call your bank now and dispute it. Gift cards? Call the card issuer with the card numbers",
      "Expect a call-back from a \"refund department\" — that is act two of the same scam. Hang up"
    ],
    "report_links": [
      {
        "label": "Report to Amazon",
        "url": "https://www.amazon.com/reportascam"
      },
      {
        "label": "Report to the FTC",
        "url": "https://reportfraud.ftc.gov/"
      }
    ]
  },
  "malware_family": null,
  "timeline": [
    {
      "date": "2026-09-02",
      "type": "registry",
      "title": "Family created",
      "text": "Opened at launch; no dated specimen on record yet — send yours.",
      "added": [],
      "removed": [],
      "sources": []
    }
  ],
  "related": [
    "amazon-account-alert-phishing",
    "geek-squad-renewal-invoice",
    "paypal-invoice"
  ],
  "sources": [
    "https://www.amazon.com/reportascam"
  ],
  "legacy_urls": [],
  "legacy_redirect": false,
  "created": "2026-09-02",
  "updated": "2026-09-02",
  "changelog": [
    {
      "date": "2026-09-02",
      "text": "Record created at the registry launch."
    }
  ],
  "url": "https://soft2secure.com/scams/amazon-order-callback",
  "licence": "CC BY 4.0",
  "generated": "2026-09-03"
}