The email came to my personal account.
The subject line said: [ Alert ] Your amazon has been locked [Case #113-3735842254]
I realized pretty quickly it was a phishing attempt.
We figured it was worth sharing with you with the holiday shopping season upon us, the fakers and phonies will be out in full force. We don’t want you to fall for a scam.
Let’s unpack this email.
For starters, the Amazon name in the subject line started with a lowercase letter. That’s not likely to be done by the real Amazon.
Opening the email showed the actual Amazon logo, and it shows the same kind of font legitimate Amazon emails have.
That was really the scammer’s best work. It went downhill from there.
The email said:
“Your Amzon will Be Locked, need authenticate Because of Some Violated Policies in Account .”
Note the misspelled Amazon name. Then note the poor use of the English language. Then the pretty unusual choices for which words were capitalized and which were not.
And that was only the first sentence.
The email instructed me to log in to my Amazon account “and follow the steps.”
It said I would be asked to enter my billing address to verify the account.
Next, it noted to allow two hours for “these actions to take effect.”
That part, I imagine, is so the scammers could have some time with all your personal information before you’d start to get suspicious.
Nice try.
The email closed with: “Just Log in update and follow the instructions in you account notifications to see what information you need to provide.”
More creative use of the English language.
Then it offered an “Update Now” button that I could click to make the needed updates.
Before getting to where that button wanted me to go, I took a look at the sending email address.
It appeared to be from “account-alert@amazon.com” but right clicking with my mouse found it wasn’t from an Amazon email address.
I was curious about what would happen if I clicked on the “Update Now” button, but I was chicken. I feared my laptop could be infected with malware or worse if I actually clicked.
But I wasn’t chicken about trying on my smart phone.
So I did.
It brought me to a website that looked a whole lot like it could be an Amazon page. But the actual site was: http://ainzsmacurenvetive.servequake.com/?onichan
I did a little digging but the site’s registration is private, according to Whois. I did learn that “oni chan” could be, misspelled in Japanese, a respectful and affectionate term for “older brother.” And that Onichan is also the name of an episode of “Miraculous: Tales of Ladybug & Cat Noir,” a cartoon about teenage superheros.
The site asked for my email and Amazon password.
I created a fake email — I didn’t want to inadvertently use a real person’s email — and I made my password “scammers1234.”
I was in.
The next screen asked me to fill in a host of personal information: My name, date of birth, address. country, phone number and yes, Social Security number.
So I faked that info too. (I chose George Washington as my new identity and made the new me a few years younger.)
The next screen wanted me to verify my credit card, asking for the cardholder name, card number, expiration date and CVV code.
I obliged with a bunch of meaningless numbers, but that’s where I hit a snag. It seemed to know the credit card number wasn’t real — depending on which numbers I entered, I’d see a MasterCard or Visa logo — but when I hit enter, the field was cleared.
So were the scammers hooked up with technology to verify credit card numbers? Could be.
After trying several times, I gave up on the experiment.
Had the scammers been successful, they would have had all the information needed to do some serious damage to my privacy.
Which brings us to our lesson, dear readers.
While scammers can strike at any time, the holiday season is a favorite. People will receive lots of legitimate emails about online orders, shipping and more as they shop for their loved ones. Scammers are hoping they can slip in their nefarious and tricky emails with the real ones.
To help customers stay informed, Amazon, and most other retailers, offer information about phishing on their websites.
For example, Amazon says: “Amazon will never send you an unsolicited email that asks you to provide sensitive personal information like your social security number, tax ID, bank account number, credit card information, ID questions like your mother's maiden name or your password.”
So take care with your emails, and happy shopping!
Research Editor Vinessa Erminio contributed to this report.
Have you been Bamboozled? Reach Karin Price Mueller at Bamboozled@NJAdvanceMedia.com. Follow her on Twitter @KPMueller. Find Bamboozled on Facebook. Mueller is also the founder of NJMoneyHelp.com. Stay informed and sign up for NJMoneyHelp.com’s weekly e-newsletter.