Fake Deals, Real Risk: How to Spot Email Scams This Shopping Season

Customer security advisory | October 2026

Big sales events are great for shoppers, and even better for scammers. With Amazon's October Prime Day sale running October 6 and 7, security researchers are already warning that criminals are flooding inboxes, phones, and search results with convincing fakes. The tricks aren't limited to Amazon, and they don't stop when the sale ends. The same playbook gets reused for every holiday promotion, shipping notice, and "account problem" alert you'll see in the coming months.

Here's what's happening, why it's harder to spot than it used to be, and the simple habits that shut most of these scams down.

What's happening right now

Boston 25 News reported on October 6 that cybersecurity company Check Point recently blocked a fake message posing as an Amazon fraud alert, telling the recipient there was a problem with their account. The goal of messages like this is to get you to click a malicious link.

Check Point researcher Aaron Rose told the station that criminals are now using widely available AI tools to clone real websites in minutes. Registering a new domain and copying a trusted site can take anywhere from 30 seconds to a couple of minutes, and the fake pages can show up in search results right next to legitimate stores.

The scale is significant. In research published ahead of the June Prime Day, Check Point counted 6,843 new Amazon-themed domains registered between December 2025 and May 2026, with registrations peaking at 1,446 in April. About 9% were flagged as malicious or suspicious, and by early June roughly one in every 13 newly registered domains was already flagged. TechRadar's coverage of the same research summarizes why shopping events are such a draw: a trusted brand, a ticking clock, and a huge number of people ready to buy.

This is bigger than shopping season

Phishing is the most-reported internet crime in the country. According to the FBI's 2025 Internet Crime Report (as summarized by SpyCloud and dmarcian):

• Phishing and spoofing generated 191,561 complaints, more than any other crime type, and reported losses from these attacks climbed from about $70 million to $215.8 million in a year.
• Business email compromise (BEC), where criminals impersonate a vendor, executive, or coworker to redirect payments, cost victims more than $3 billion.
• For the first time, the FBI tracked AI-related fraud as its own category: roughly 22,000 complaints and nearly $900 million in losses. AI helps scammers write flawless, personalized messages, which means the old advice to "look for typos" no longer protects you on its own.

These are only the incidents that were reported. The real numbers are higher.

Red flags that still give scammers away

The FTC's phishing guidance describes the stories scammers tell to get you to click. Watch for messages that:

• Claim suspicious activity or a problem with your account or payment information.
• Ask you to confirm personal or financial details.
• Include an invoice or order confirmation for something you never bought.
• Ask you to click a link to make a payment or update billing details. The FTC is clear that legitimate companies won't email or text a link for you to update your payment information.
• Offer a coupon, refund, or freebie out of nowhere.
• Use a generic greeting or create pressure to act immediately.

Amazon's own guidance adds a few more tells. Sender addresses with swapped or added characters are a warning sign, and any message about an order you didn't place is almost certainly not from Amazon. Amazon says it will never ask for your password, a one-time passcode, payment details (including gift cards), or for you to install software.

Seven habits that stop most scams

1. Go to the source instead of clicking. This is the single best rule, and consumer advisor Clark Howard gave the same advice in the Boston 25 report: type the retailer's address yourself or use a bookmark rather than following a link from an email, text, or social media post.

2. Don't trust the top search result. Fake sites can appear right alongside real ones in search results, so bookmark the stores and accounts you use most.

3. Verify inside your account. Amazon says legitimate communications appear in the Message Center in your account. If the "urgent" message isn't there, it didn't come from Amazon. Other companies have a similar page or app inbox. Check there, or call the number on your card or the company's real website, not the one in the message.

4. Inspect the sender and the link. Look at the full sender address, not just the display name. On a computer, hover over a link to preview where it really goes. On a phone, press and hold. A lookalike domain with an extra word, a swapped letter, or an unusual ending is a giveaway.

5. Treat urgency as a warning. "Your account will be closed in 24 hours" and "limited-time refund" are designed to make you act before you think. Slow down.

6. Turn on multi-factor authentication. The FTC recommends it because even if a scammer gets your password, they still can't easily log in. Pair it with automatic updates for your computer and phone, and with security software.

7. Back up your data. The FTC also recommends backing up your computer and phone, so that if something does go wrong, you aren't starting from zero.

A note for business owners and finance teams

Business email compromise rarely uses a suspicious link at all. It relies on a believable request: a vendor with "new bank details," an executive who needs a gift card purchase, an invoice that looks routine. The defense is a process rather than a filter. Confirm any change in payment instructions by phone, using a number you already have on file, and require a second person to approve unusual payment requests. Busy seasons are exactly when these requests slip through.

If you already clicked

It happens to careful people. Act quickly:

• Changed nothing yet? Close the page, don't enter anything, and run a security scan after updating your software.
• Entered a password? Change it right away on that account and anywhere else you reused it, and turn on multi-factor authentication.
• Shared a Social Security, card, or bank number? Visit IdentityTheft.gov for step-by-step recovery instructions based on what was exposed, and contact your bank or card issuer.
• At work? Tell your IT provider immediately so they can check for further exposure.

Report it

Reporting helps shut the scammers down, and it takes less than a minute:

• Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org.
• Forward phishing texts to 7726 (SPAM).
• File a report with the FTC at ReportFraud.ftc.gov.
• If you lost money, also report it to the FBI's Internet Crime Complaint Center at ic3.gov.

When in doubt, ask us

If a message looks off and you aren't sure, don't click, don't reply, and don't open the attachment. Forward it to our team or contact us, and we'll take a look before you do anything else. A quick question is always cheaper than a compromised account.

Sources: Boston 25 News; Check Point Research; TechRadar; FBI Internet Crime Complaint Center 2025 Internet Crime Report (via SpyCloud and dmarcian); Federal Trade Commission; Amazon customer help guidance.