Email scam - Wondering how they did this

[Xraywolf]

We've all gotten the emails
"Thank you for your order. We’ll send a confirmation when your order ships. Your estimated delivery date is indicated below. If you would like to view the status of your order or make any changes to it, please visit Your Orders on Amazon.com.

If you did not place this order please call us on 1-(800)-370-3927to report this to our fraud protection team."

Or similar, then they'll have links to "verify your order" ect, and you can see hovering the mouse over them that they lead to some screwball site.
This was for a Samsung TV BTW so it caught my attention, I did the mouse hover and it showed https://www.amazon.com?tag=treasurenet01-20, so I immediately went to my Amazon account and looked at my order history, thankfully not showing so its a scam

I've never seen the links lead back to the actual site though, there are no misspellings or extra letters. What could they gain posting legit domains ? The number doesn't appear to be a legit amazon number, not the best scam sleuth ,,, Maybe thats their game, hoping I'll call and give up some info.

 

Amazon Forum Fav 👍

Treasure of Victoria Peak - Grab it through Amazon!

[billb]

​thank you very much for sharing this with us

 

[SD51]

Thanks for letting us know about this one...I would offer to help, but the last two days I received voice mails on my cell (didn't answer them) and I was informed there is fraudulent activity on my bank account, and I will soon be arrested! Dang, it was finally getting warm enough here to go detecting and now I'll be sitting in a cell somewhere!

 

[jeff of pa]

I'm sure if you Would have called them They would have asked for your Credit or Banking Info,
To confirm it wasn't you
They won't be able to share what info they Have, But Need yours !

I get Emails from Amazon all the Time saying they are Canceling my account.
Because My Info is Wrong.
Since I Don't & Never Have had an amazon account,
I'm still waiting for over a Year now For them to Finally cancel it

 

[Xraywolf]

I get the account being cancelled all the time, along with the ones stating a purchase has been made.
They have all had fraud links which is simple to confirm without clicking them, are are just deleted.

This is the first one I have even seen with legit links, so the more I think about it, they must be trying a different tack, knowing that most folks know how to check links, they post legit ones and try a phone number instead. I have never had amazon send an email after a purchase saying "if you suspect fraud, call this number" so that right there made me suspicious.
As always, best to manually log into your account and see whats going on, don't think fraud and scam attempts have ever been as rampant as these days.

 

[jeff of pa]

The Latest :

Dear customer,



Your Amazon Prime Membership is set to renew on April 5, 2021.

However, we've noticed that the card associated with your Prime membership is no longer valid.


To update the default card or choose a new one for your membership, Please find the document attached and follow the on-screen instructions.

To prevent interruption of your benefits, we will try charging other active cardsassociated with your Amazon account if we can't charge your default card.



If we can't process the charge for your membership fee, your Amazon Primebenefits will be suspended


the One before That expired April 2nd

Dear customer,



Your Amazon Prime Membership is set to renew on April 2, 2021.





However, we've noticed that the card associated with your Prime membership is no longer valid.






To update the default card or choose a new one for your membership, Please find the document attached and follow the on-screen instructions.







To prevent interruption of your benefits, we will try charging other active cards associated with your Amazon account




if we can't charge your default card. If we can't process the charge for your membership fee, your Amazon Prime benefits will be suspended.


Sincerely,

 

[jeff of pa]

BTW Another way to Know they are scams, Every time I get one I block the senders Email Address as spam.
Every time they Send one, It's a different email address

the last 2

Amαzoɴ Priⅿë <noreplyn0repply-notificationattachments-3642534@gia039yt328hjo.com>

and

Amαzoɴ Рrіⅿė <noreplyn0repply788123njasjjaf388138-2817297@6--------.com>

 

[GeoW]

Do not log in to any entity from an email link received. Initiate any communication straight to the business and not through an email sent to you with a login link attached.

 

[Chadeaux]

I've never seen the links lead back to the actual site though, there are no misspellings or extra letters. What could they gain posting legit domains ? The number doesn't appear to be a legit amazon number, not the best scam sleuth ,,, Maybe thats their game, hoping I'll call and give up some info.

Works better that way. What showed as a link was actually a link that lead somewhere else, easily done by giving the link a title with the phony address as the title.

If you want to know where they were trying to take you, right click on the link and choose copy link address then paste it into notepad or another text editor to see where they wanted you to go. Don't do it in Word or any word processing program because it will turn it back to a link.

Another way to do it is to place an image that looks like a button, and again give it a title that shows the fake url. You won't know until you click it.

Many fake emails are in html format which allows you to fake these addresses. Set your email to show messages in plain text if you aren't sure.

You did the right thing by going to amazon and checking your account.

 

[Xraywolf]

Works better that way. What showed as a link was actually a link that lead somewhere else, easily done by giving the link a title with the phony address as the title.

If you want to know where they were trying to take you, right click on the link and choose copy link address then paste it into notepad or another text editor to see where they wanted you to go. Don't do it in Word or any word processing program because it will turn it back to a link.

Another way to do it is to place an image that looks like a button, and again give it a title that shows the fake url. You won't know until you click it.

Many fake emails are in html format which allows you to fake these addresses. Set your email to show messages in plain text if you aren't sure.

You did the right thing by going to amazon and checking your account.

As per the OP, I check links by hovering the mouse over them, where they lead to show up in the bottom of the page - They all led back to amazon.com

 

[Chadeaux]

As per the OP, I check links by hovering the mouse over them, where they lead to show up in the bottom of the page - They all led back to amazon.com

It's a simple script -- and one I wouldn't share. Called "URL Masking" as well as "Domain Masking" and not hard to do.

https://en.wikipedia.org/wiki/Domain_masking

As I said before, set your email to display as text only.

 

[Xraywolf]

chad, I didn't share anything, I simply manually typed amazon.com
I tried pasting the copied link in notepad to see if it was any different than what I was seeing, it wasn't. The links lead back to a legit domain. Maybe I'm missing something but no, I like the ability to click links when they are legit so would not want them as text to keep my fingers from doing something stupid, I use my brain for that.

 

[Xraywolf]

Oh sheesh just got another one, check out the Engrish on this one ,,


Macfee Secure Antivirus

4/8/2021
4:19 PM

76 Riddle Street,
Fairmont, New York,
New York 14430,
United States

Hey user,

Your support to Macfee is faithful and your subscription pack is renewed of 399.00 USD for 3 years. This is automated invoice which is generated on 4/8/2021,4:19 PM .Your order no is 1570657843 and order Id is ( pl0tfi7odno7zua ) If you want to abandon this subscription pack. You can call us on (800) 359 1252 within 24 hrs. We are available 24\7 at your service.

We like to listen about your problem. There is an invoice attached with this mail. As per our research by listening carefully we can solve almost every problem of your easily. We always try to give more services and help that we can provide. We are providing you anti-virus package, vpn service and anti-security package. We have a technology and service that is easy to use. As per our research by listening carefully we can solve almost every problem of your easily.

 

[Chadeaux]

chad, I didn't share anything, I simply manually typed amazon.com.

I meant I would not share that script or any of its variations here. Some spammer might pick it up and try to use it on me.

 

[Xraywolf]

Well if they did, now you know don't click and don't call - You already knew that, I am semi savvy and have never seen a scam email with links leading to a legit site, now everyone who reads this will know its possible.

I don't see throwing it in the shade as any type of solution - In fact, the more light you shine on a cockroach, the quicker it will scurry away or be stomped into the ground.

 

[danloop]

I'm waiting for the extended warranty call about my soon to expire plan. "I'm glad you called. I have a claim to make." <crickets>

 

[jeff of pa]

I'm waiting for the extended warranty call about my soon to expire plan. "I'm glad you called. I have a claim to make." <crickets>

lol speaking of warranty call's my warranty on my last 3 Cars is about to Run out for the last 6 years yes they still don't know non of my cars
is new enough to have a factory warranty

the one I drive now is a 96 the one before a 99
i never drove anything newer that I remember,
and my guess they don't even know my name and maybe not even my sex since the messages are recorded

why renew ? It apparently never runs out completely at least not til I need it. Right ?

 

[Kj Upton]

Yo Da internet will be shutting down for maintenance this Saturday. To continue to enjoy all the porn click here.

Scamyou.cm