Amazon Issues a Warning to Over 300 Million Customers About Holiday Season Cyberattacks

Why Amazon Issued the Warning

Amazon has sent an urgent security notice to more than 300 million customers as the holiday shopping season ramps up. The company warns that cybercriminals are actively trying to steal personal, financial, and Amazon account information by posing as legitimate Amazon communications.

Hackers are attempting to obtain “sensitive information such as personal or financial data, or Amazon account details,” by impersonating Amazon in messages and notifications, including via browser alerts and third‑party push platforms.

How the Attacks Work

Attackers use brand impersonation: they craft emails, texts, browser pop‑ups, and support messages that closely mimic official Amazon style and branding. These messages often push users to click a link or respond quickly, creating a sense of urgency that leads people to reveal credentials or payment details.

Many of these scams direct shoppers to convincing phishing sites with domains that look almost identical to real retail or Amazon URLs, where victims are tricked into entering their login or card information.

Seasonal Risk and Growing Scam Infrastructure

Security researchers report a sharp rise in newly registered, holiday‑themed domains that reference events like Black Friday and Christmas, with hundreds to thousands of them confirmed as malicious. Many of these domains imitate major online retailers, including Amazon, using tiny spelling or formatting changes that are easy to miss.

Thousands of additional domains are designed to mirror well‑known brands more broadly, and a significant portion of those are also flagged as malicious, showing that the attack surface expands dramatically during peak shopping periods.

FBI Concerns About Account Takeovers

A recent public service alert from the FBI highlights account takeover schemes that rely on brand impersonation and social engineering across phone calls, SMS, instant messages, and email. Since early 2025, complaints about these schemes have led to reported losses of more than hundreds of millions of dollars, underscoring the financial scale of the problem.

According to that alert, criminals frequently pretend to be customer or technical support staff, persuading users to hand over login credentials, multi‑factor authentication codes, or one‑time passcodes, which are then used to reset and seize control of accounts.

Amazon’s Key Safety Recommendations

Amazon stresses that it will not ask customers to provide payment details or make payments over the phone, and it does not send emails requesting that users confirm their full account credentials.

The company urges customers to verify any suspicious communication by going directly to the official Amazon website or app, avoid clicking unexpected links, and review Amazon’s guidance on recognizing phishing and impersonation attempts before acting on any urgent‑sounding message.

Author’s Summary

Amazon is warning 300M+ users that sophisticated brand‑impersonation scams are surging this holiday season, urging strict vigilance with emails, pop‑ups and payment or login requests.

7XS — 2025-11-26