A convincing Amazon Prime phishing assault is utilizing a pretend membership cost downside to steer victims by a multi-page web site designed to gather their Amazon login, private info and full cost card particulars.
Hackread.com obtained the phishing electronic mail on September 29, 2026, and adopted the assault utilizing dummy info to doc every stage with out offering the operators with real credentials or monetary information.
The marketing campaign reproduces a number of components of Amazon and Prime Video’s branding and takes the sufferer by a sequence that resembles a respectable account restoration and billing course of.
The e-mail begins with a well-known downside for subscription prospects: a failed cost. Beneath the topic “Your Prime Membership On Maintain,” it tells the recipient that Amazon was unable to course of their newest cost and that Prime Video entry has been briefly suspended.
Victims are then given 48 hours to replace their cost methodology or threat what the e-mail describes as everlasting cancellation of the membership. A outstanding “Resume My Membership” button directs them away from Amazon and into the phishing website.
Faux Amazon Web page Begins the Knowledge Assortment
After following the hyperlink, the sufferer arrives at a web page designed to resemble Amazon’s web site. It claims that an issue has been detected with the Prime membership cost and asks the consumer to replace billing info to revive entry.
The web page additionally introduces an uncommon two-step course of, telling the consumer to substantiate their id and signal out of apps, units and internet browsers.
Regardless of Amazon logos, acquainted navigation parts and yellow buttons, the browser tackle bar exposes one of many clearest indicators of fraud. The area seen throughout Hackread.com’s testing begins with wording resembling primevideo-manage-account-payment however just isn’t an Amazon-owned area.
That distinction can simply be missed by somebody concentrating on the web page itself, notably as a result of the operators have recreated sufficient of Amazon’s interface to make the encircling content material look acquainted.
Phishing Website Asks for Amazon Login
The subsequent stage shows a Prime Video-branded sign-in web page asking for an electronic mail tackle or cell phone quantity.
After an tackle is submitted, one other web page requests the Amazon account password. It consists of acquainted parts equivalent to “Forgot password?”, Amazon’s Situations of Use and Privateness Discover hyperlinks, and the usual yellow sign-in button. The credentials entered into these pages give the operators the sufferer’s Amazon username and password.
Victims Are Requested for Deal with, Telephone Quantity and Date of Beginning
After the login stage, the pretend Amazon interface tells the sufferer that their Prime membership has been paused due to a billing situation.
A kind headed “Enter billing particulars” requests the sufferer’s full title, road tackle, ZIP or postal code, metropolis, state or area, nation, telephone quantity and date of start.
Accumulating these particulars alongside account credentials makes the stolen info significantly extra helpful for fraud. A felony acquiring the finished kind would have figuring out info that may very well be related to the submitted Amazon credentials and later cost info.
The web page proven to Hackread.com was additionally localized for the UK, displaying “United Kingdom” because the nation and +44 within the phone-number subject.
Full Fee Card Particulars Come Subsequent
As soon as the id kind is accomplished, the sufferer is taken to a different Amazon-themed web page headed “Add a credit score or debit card.” This stage requests the title on the cardboard, card quantity, expiration date and CVV. Visa, Mastercard, American Specific, Uncover and JCB logos seem above the shape.
The shape additionally performs enter validation, displaying pink error messages beneath invalid fields, together with warnings about card-number format, expiration date and CVV size. Such validation could make a phishing web page really feel extra genuine whereas additionally serving to operators receive information in a usable format.
After the knowledge is accepted, the positioning shows a “Submission Acquired” web page claiming the knowledge will probably be reviewed and that the sufferer will obtain an electronic mail inside 24 hours. A “Proceed to sign-out” button continues the looks of a accomplished Amazon account-recovery course of.
By that stage, nevertheless, a sufferer following your complete sequence might have already got submitted their Amazon login, password, title, residence tackle, telephone quantity, date of start and cost card info.
Amazon Warns About Prime Membership Scams
The method carefully matches a class Amazon itself identifies as Prime Membership scams. Amazon says these scams declare {that a} membership charge is due or that one thing is flawed with a membership, then try and receive cost or financial institution info beneath the pretext of restoring the service.
Amazon additionally warns prospects about account suspension messages that strain recipients into following fraudulent hyperlinks and submitting login credentials or cost info. Real Amazon communications will be checked by the Message Middle related to an Amazon account.
The timing can be notable. Amazon not too long ago stated experiences of email-based impersonation scams elevated by 68% per day in the course of the busy 2025 procuring interval, with pretend account safety alerts, suspension notices and login verification requests among the many techniques reported to the corporate.
Amazon this month additionally launched further methods for purchasers to test suspicious communications. Messages will be forwarded to [email protected], whereas U.S. prospects may ask Alexa for Purchasing whether or not an electronic mail, textual content or name matches Amazon’s data.
Anybody receiving a Prime cost warning ought to keep away from utilizing hyperlinks contained within the message and test the membership straight by Amazon’s web site or app. Amazon advises prospects who’ve already disclosed account info to alter their password, whereas those that submitted banking info ought to contact their monetary establishment and report the rip-off.
