Amazon issues attack alert: 300 million customers are at risk

Updated November 25 with details of a new report confirming seasonal dangers as Amazon issues warning that all 300 million users should heed.

There’s no escaping the annual Black Friday sales, which seem to last longer every year. Likewise, there is no denying that Amazon is the leader both in the event itself and as a target for cybercriminals. With approximately 310 million active users in 2025, Amazon has historically been prime prey for scammers, hackers, and other highly targeted cybercrime activities. The online retail giant has now issued a stern warning that every customer must take seriously in the face of the attackers’ attack. Here’s what you need to know and do.

ForbesDon’t Download These Windows Security Updates, Experts WarnBy Davey Winder

Amazon Sends Attack Warning to Users – What You Need to Know

On the heels of a new report confirming that cybercriminals are targeting major brands including Netflix and PayPal using an impersonation process involving browser notifications and the Matrix Push crime platform, Amazon sent me a warning email, but all 300 million users should take note and remain vigilant against impersonation fraudsters. These cybercriminals target Amazon users by trying to gain “access to sensitive information such as personal or financial information, or Amazon account details,” Amazon said in a Nov. 24 email.

Of course, such attacks are not rare or new, but they are evolving, and warnings like this one from Amazon are a timely reminder to be especially vigilant this time of year.

The Amazon email warns of the following attacks:

• Fake delivery or account problem messages.
• Third-party advertisements, including those on social media, offering amazing deals.
• Messages sent through unofficial channels requesting account or payment information.
• Same, but via unknown links.
• Unsolicited technical support phone calls.

ForbesHackers bypass WhatsApp signal, telegram and encryption to read messagesBy Davey Winder

Amazon’s seasonal attack warning is timely and necessary

A new report from FortiGuard Labs, released on November 25, confirmed that Amazon was absolutely correct in sending hack attack warning emails. Citing domain registration as a clear indicator of pre-holiday attack intent, FortiGuard Labs said it had “identified more than 18,000 holiday-themed domains registered over the past three months, including terms such as Christmas, Black Friday and Flash Sale,” and that “at least 750 of these have been confirmed malicious.”

The report also reveals an increase in the number of registered domains imitating major retail brands, with more than 19,000 observed and 2,900 confirmed to be malicious. “Many imitate well-known names,” like Amazon, for example, “often with slight variations that are easy to miss when shoppers move quickly,” the researchers said.

“This year, we’re sure to see ever more sophisticated scams,” according to Anne Cutler, cybersecurity evangelist at Keeper Security, “mostly powered by artificial intelligence, from convincingly spoofed order confirmations to spoofed retailer sites and even AI-generated customer service messages designed to steal login or payment information.”

ForbesNetflix and PayPal users warned after attack by Matrix HackersBy Davey Winder

Amazon’s tips for protecting yourself from these attacks

Amazon has offered its customers the following tips to protect themselves from these continued attacks, not only at this time of year but throughout the year.

• Use only the Amazon mobile app or website for customer service, account changes, delivery tracking, and refunds.
• Configure two-factor authentication when available for your online accounts to prevent unauthorized account access.
• Use a password. It’s a more secure way to sign in than using passwords, and it works with the same face, fingerprint, or PIN you already use to unlock your device.

Please remember that Amazon will never ask you to make payments or provide payment information over the phone, nor will it ever send emails asking customers to verify their account credentials. Stay safe out there! You can read more advice from Amazon on phishing attacks here.

ForbesInternet Domain Name Registration Attacks Confirmed: What You Need to KnowBy Davey Winder