Everyone loves online shopping, it’s the easiest way to order everything you need (and don’t need) from the comfort of your couch. But it was only a matter of time until cyber criminals turned the wonderful Amazon order receipt into a scam.
Another day, another scam warning from your friends at PC Pitstop. Today we’re taking a look at a scam based around everyone’s favorite activity: online shopping. Normally when you complete a purchase online, especially at Amazon, the order confirmation email hits your inbox before you can close your web browser. This morning I woke up to one of those order emails in my spam folder. The first feeling is a little bit of excitement, maybe I forgot shopping a little too late last night and bought something I’ve always wanted. But alas, it was another sad attempt by your unfriendly neighborhood cybercriminals to scam me out of something. They’ll take the things you love the most and leverage them against you in the scam to hopefully get you to see past the flaws that jump out with a little careful investigating.
The Signs of a Scam
We’ll start with the first thing I saw and what most others would see as well, the small window of details before you expand the message. Now right away this message doesn’t raise too many red flags for me except that it went to my junk folder. I get Amazon order emails all the time and they never end up in junk, so we’ll count that as +3 points on our scam scale (The scam scale goes up to 10, and I just made it up right now). Now with a score of 3, we’re not looking at anything that’s obviously a scam, but it should be enough to raise suspicion and look a little deeper than usual.
Beyond being in the junk folder, the only thing that jumped out at me was a small typo that could be written off to my email client formatting. After the order number, the email begins with “Hi , Thank you f…”. Notice the spacing on either side of the comma, typically there wouldn’t be a space before a comma.
The Devil is in the Details
Now that we are already at a 3/10 on the world-renowned scam scale, it’s time to dig into the details. Right at the start of the email, we get a look into the biggest clue for scam emails; who was this actually sent from. When expanded out it can no longer hide under a false amazon.com name so we’re able to see this was sent to us from a strange email address that Amazon would never use. In reality, this is a +10 on the scam scale. Once you see a strange email that pretends to be something else, we have verified this is a scam. But for the sake of the scam, we’re going to look further.
Looking at the main content at the top of the message, the typos begin to shine through and add to our scam scale total. First, we can again see the double space around the comma after “Hi”. This is a small flag because in almost all cases Amazon isn’t making typos in their order emails. But we can then pair this with the typo in sentence three: “Your order details are available on link below.” Our order details are on link? Amazon certainly wouldn’t have that in their official emails (+2 to the scam scale).
Hover Over Everything
One place we’re always checking in emails or messages we think are scams: links. Hyperlinks can tell you a lot without actually having to click on them and visit the link. This is where our next tip comes into play; hover over everything. Hovering your mouse cursor over a blue hyperlink will give you the actual link behind the words. This email’s intent is to get us to visit either the order invoice link, or the order details link to go and see what we “ordered”. The rest of the links in the email actually point to valid Amazon sources to try and legitimize the message. However, once we start to hover around and check out what’s behind order invoice and order details, we can see it’s trying to link us to a completely different website then it should be. With these strange domains in the email, we should probably add more points to the scam scale. We’ll go with +5.
This above all; to thine own emails be vigilant
After a complete dissection of this email, it’s obviously a poor scam attempt that left our scam scale maxed out at 20/10. The key here is to always be vigilant when it comes to emails and general online activity. If something seems to good to be true, it probably is. If you notice small typos in an email, especially from a corporation, look a little further. Even if after a small typo or small item raised your suspicion you’re still not seeing the other factors to bring your scam scale up to 10, just go straight to the source. In this case, I could quickly open my browser and go to www.amazon.com, log into my account and review my orders to ensure this order is indeed an imposter.
PC Matic users, don’t forget that your PC Matic subscription comes with free Cyber Security Awareness Training from KnowBe4 to help you and your family brush up on the typical things to look for in a scam and general good practices to use online. Contact our customer service team for details on gaining access to your included training course: www.pcmatic.com/help
Have you caught other types of scam attempts recently? Let us know in the comments!
