As holiday shopping picks up, so do fraudulent order confirmations, delivery notices, and refund emails. From now through the end of the year, be especially careful with unexpected messages claiming to come from major retailers or shipping companies.
A real-world example: a fake Amazon purchase
We recently reviewed an email designed to resemble an Amazon invoice. It claimed that $400 in Google Play gift cards had been purchased and repeatedly urged the recipient to call a support number to cancel or modify the order.
This is a common callback-phishing tactic. The goal is to alarm someone into calling the number in the message, where a fraudster may ask for payment details, account credentials, or remote access to a computer. The example has been anonymized: personal details and telephone numbers are removed or obscured.
Scammers impersonate more than Amazon
Be on the lookout for messages that appear to come from Amazon, Walmart, Target, Best Buy, UPS, FedEx, USPS, PayPal and other familiar retailers, carriers, and payment services. Common themes include:
- Unexpected order confirmations or expensive gift-card purchases.
- Package delivery failures, address problems, and small redelivery fees.
- Refunds, unauthorized transactions, and account-verification warnings.
- Holiday deals that lead to imitation shopping websites.
Professional formatting, logos, and order numbers do not prove a message is genuine.
Five ways to stay safe
- Don’t panic. Urgent language and large charges are designed to provoke a quick reaction.
- Don’t call numbers in suspicious messages. Find contact details independently through the retailer’s official website or app.
- Don’t follow unexpected tracking links. Check order and delivery status directly with the retailer or carrier.
- Be careful with attachments and QR codes. A convincing invoice can still be malicious.
- Report suspicious email. In Microsoft Outlook, use the Report Phishing option when available.
Businesses need to stay alert, too
Employees can receive fake vendor invoices, payment requests, shipping notices, and account alerts at work. Multifactor authentication, email security, and employee awareness help reduce the risk of account compromise and financial loss.
When in doubt, don’t click and don’t call. Verify independently. TMD Technology Services helps South Florida businesses and organizations nationwide protect their systems and Microsoft 365 environments. For assistance, call (561) 404-9251 or visit TMDTechnology.com.
