Email scam - Wondering how they did this

Xraywolf

Silver Member
Feb 28, 2005
3,576
4,360
MI USA
Detector(s) used
Ace 400, AT Pro, equinox 800, Simplex,Vanquish 540
Primary Interest:
Metal Detecting
We've all gotten the emails
"Thank you for your order. We’ll send a confirmation when your order ships. Your estimated delivery date is indicated below. If you would like to view the status of your order or make any changes to it, please visit Your Orders on Amazon.com.

If you did not place this order please call us on 1-(800)-370-3927to report this to our fraud protection team."

Or similar, then they'll have links to "verify your order" ect, and you can see hovering the mouse over them that they lead to some screwball site.
This was for a Samsung TV BTW so it caught my attention, I did the mouse hover and it showed https://www.amazon.com, so I immediately went to my Amazon account and looked at my order history, thankfully not showing so its a scam

I've never seen the links lead back to the actual site though, there are no misspellings or extra letters. What could they gain posting legit domains ? The number doesn't appear to be a legit amazon number, not the best scam sleuth ,,, Maybe thats their game, hoping I'll call and give up some info.
 

billb

Silver Member
Sep 23, 2010
4,569
10,145
New York
🥇 Banner finds
1
Detector(s) used
Excalibur2,,silver sabre
Primary Interest:
All Treasure Hunting
​thank you very much for sharing this with us
 

SD51

Silver Member
Aug 24, 2016
4,829
9,950
MI
Detector(s) used
E-TRAC
Primary Interest:
All Treasure Hunting
Thanks for letting us know about this one...I would offer to help, but the last two days I received voice mails on my cell (didn't answer them) and I was informed there is fraudulent activity on my bank account, and I will soon be arrested! Dang, it was finally getting warm enough here to go detecting and now I'll be sitting in a cell somewhere!
 

jeff of pa

Super Moderator
Staff member
Dec 19, 2003
85,461
59,220
🥇 Banner finds
1
🏆 Honorable Mentions:
1
Primary Interest:
All Treasure Hunting
I'm sure if you Would have called them They would have asked for your Credit or Banking Info,
To confirm it wasn't you :tongue3:
They won't be able to share what info they Have, But Need yours !

I get Emails from Amazon all the Time saying they are Canceling my account.
Because My Info is Wrong.
Since I Don't & Never Have had an amazon account,
I'm still waiting for over a Year now For them to Finally cancel it :laughing7:

giphy.gif
 

Last edited:
OP
OP
Xraywolf

Xraywolf

Silver Member
Feb 28, 2005
3,576
4,360
MI USA
Detector(s) used
Ace 400, AT Pro, equinox 800, Simplex,Vanquish 540
Primary Interest:
Metal Detecting
I get the account being cancelled all the time, along with the ones stating a purchase has been made.
They have all had fraud links which is simple to confirm without clicking them, are are just deleted.

This is the first one I have even seen with legit links, so the more I think about it, they must be trying a different tack, knowing that most folks know how to check links, they post legit ones and try a phone number instead. I have never had amazon send an email after a purchase saying "if you suspect fraud, call this number" so that right there made me suspicious.
As always, best to manually log into your account and see whats going on, don't think fraud and scam attempts have ever been as rampant as these days.
 

Attachments

  • aaaUntitled.jpg
    aaaUntitled.jpg
    72.9 KB · Views: 75

jeff of pa

Super Moderator
Staff member
Dec 19, 2003
85,461
59,220
🥇 Banner finds
1
🏆 Honorable Mentions:
1
Primary Interest:
All Treasure Hunting
The Latest :

Dear customer,



Your Amazon Prime Membership is set to renew on April 5, 2021.

However, we've noticed that the card associated with your Prime membership is no longer valid.


To update the default card or choose a new one for your membership, Please find the document attached and follow the on-screen instructions.

To prevent interruption of your benefits, we will try charging other active cardsassociated with your Amazon account if we can't charge your default card.



If we can't process the charge for your membership fee, your Amazon Primebenefits will be suspended


the One before That expired April 2nd :laughing9:

Dear customer,



Your Amazon Prime Membership is set to renew on April 2, 2021.





However, we've noticed that the card associated with your Prime membership is no longer valid.






To update the default card or choose a new one for your membership, Please find the document attached and follow the on-screen instructions.







To prevent interruption of your benefits, we will try charging other active cards associated with your Amazon account




if we can't charge your default card. If we can't process the charge for your membership fee, your Amazon Prime benefits will be suspended.


Sincerely,

 

Last edited:

jeff of pa

Super Moderator
Staff member
Dec 19, 2003
85,461
59,220
🥇 Banner finds
1
🏆 Honorable Mentions:
1
Primary Interest:
All Treasure Hunting
BTW Another way to Know they are scams, Every time I get one I block the senders Email Address as spam.
Every time they Send one, It's a different email address

the last 2

Amαzoɴ Priⅿë <noreplyn0repply-notificationattachments-3642534@gia039yt328hjo.com>

and

Amαzoɴ Рrіⅿė <[email protected]>
 

Last edited:

GeoW

Hero Member
Jul 12, 2005
527
568
Coastal Georgia
Detector(s) used
XP Deus II, XP Deus, XP ORX, Nautilus DMCllBa, Troy X5 Shadow, Tesoro Vaquero, Tesoro Outlaw
Do not log in to any entity from an email link received. Initiate any communication straight to the business and not through an email sent to you with a login link attached.
 

Chadeaux

Gold Member
Sep 13, 2011
5,512
6,408
Southeast Arkansas
Detector(s) used
Ace 250
Primary Interest:
Cache Hunting
I've never seen the links lead back to the actual site though, there are no misspellings or extra letters. What could they gain posting legit domains ? The number doesn't appear to be a legit amazon number, not the best scam sleuth ,,, Maybe thats their game, hoping I'll call and give up some info.

Works better that way. What showed as a link was actually a link that lead somewhere else, easily done by giving the link a title with the phony address as the title.

If you want to know where they were trying to take you, right click on the link and choose copy link address then paste it into notepad or another text editor to see where they wanted you to go. Don't do it in Word or any word processing program because it will turn it back to a link.

Another way to do it is to place an image that looks like a button, and again give it a title that shows the fake url. You won't know until you click it.

Many fake emails are in html format which allows you to fake these addresses. Set your email to show messages in plain text if you aren't sure.

You did the right thing by going to amazon and checking your account.
 

OP
OP
Xraywolf

Xraywolf

Silver Member
Feb 28, 2005
3,576
4,360
MI USA
Detector(s) used
Ace 400, AT Pro, equinox 800, Simplex,Vanquish 540
Primary Interest:
Metal Detecting
Works better that way. What showed as a link was actually a link that lead somewhere else, easily done by giving the link a title with the phony address as the title.

If you want to know where they were trying to take you, right click on the link and choose copy link address then paste it into notepad or another text editor to see where they wanted you to go. Don't do it in Word or any word processing program because it will turn it back to a link.

Another way to do it is to place an image that looks like a button, and again give it a title that shows the fake url. You won't know until you click it.

Many fake emails are in html format which allows you to fake these addresses. Set your email to show messages in plain text if you aren't sure.

You did the right thing by going to amazon and checking your account.

As per the OP, I check links by hovering the mouse over them, where they lead to show up in the bottom of the page - They all led back to amazon.com
 

Chadeaux

Gold Member
Sep 13, 2011
5,512
6,408
Southeast Arkansas
Detector(s) used
Ace 250
Primary Interest:
Cache Hunting
As per the OP, I check links by hovering the mouse over them, where they lead to show up in the bottom of the page - They all led back to amazon.com

It's a simple script -- and one I wouldn't share. Called "URL Masking" as well as "Domain Masking" and not hard to do.

https://en.wikipedia.org/wiki/Domain_masking

As I said before, set your email to display as text only.
 

OP
OP
Xraywolf

Xraywolf

Silver Member
Feb 28, 2005
3,576
4,360
MI USA
Detector(s) used
Ace 400, AT Pro, equinox 800, Simplex,Vanquish 540
Primary Interest:
Metal Detecting
chad, I didn't share anything, I simply manually typed amazon.com
I tried pasting the copied link in notepad to see if it was any different than what I was seeing, it wasn't. The links lead back to a legit domain. Maybe I'm missing something but no, I like the ability to click links when they are legit so would not want them as text to keep my fingers from doing something stupid, I use my brain for that.
 

OP
OP
Xraywolf

Xraywolf

Silver Member
Feb 28, 2005
3,576
4,360
MI USA
Detector(s) used
Ace 400, AT Pro, equinox 800, Simplex,Vanquish 540
Primary Interest:
Metal Detecting
Oh sheesh just got another one, check out the Engrish on this one ,,


Macfee Secure Antivirus

4/8/2021
4:19 PM

76 Riddle Street,
Fairmont, New York,
New York 14430,
United States

Hey user,

Your support to Macfee is faithful and your subscription pack is renewed of 399.00 USD for 3 years. This is automated invoice which is generated on 4/8/2021,4:19 PM .Your order no is 1570657843 and order Id is ( pl0tfi7odno7zua ) If you want to abandon this subscription pack. You can call us on (800) 359 1252 within 24 hrs. We are available 24\7 at your service.

We like to listen about your problem. There is an invoice attached with this mail. As per our research by listening carefully we can solve almost every problem of your easily. We always try to give more services and help that we can provide. We are providing you anti-virus package, vpn service and anti-security package. We have a technology and service that is easy to use. As per our research by listening carefully we can solve almost every problem of your easily.
 

OP
OP
Xraywolf

Xraywolf

Silver Member
Feb 28, 2005
3,576
4,360
MI USA
Detector(s) used
Ace 400, AT Pro, equinox 800, Simplex,Vanquish 540
Primary Interest:
Metal Detecting
Well if they did, now you know don't click and don't call - You already knew that, I am semi savvy and have never seen a scam email with links leading to a legit site, now everyone who reads this will know its possible.

I don't see throwing it in the shade as any type of solution - In fact, the more light you shine on a cockroach, the quicker it will scurry away or be stomped into the ground.
 

danloop

Full Member
Feb 16, 2014
195
198
Kentucky
Detector(s) used
Unicorn Treasure Master Pro
Modes:
Dowsing
Pulse Induction
Multi-Frequency
Ground Penetrating Radar
Beat Frequency Oscillation
Aural Target Identification
Primary Interest:
Metal Detecting
I'm waiting for the extended warranty call about my soon to expire plan. "I'm glad you called. I have a claim to make." <crickets>
 

jeff of pa

Super Moderator
Staff member
Dec 19, 2003
85,461
59,220
🥇 Banner finds
1
🏆 Honorable Mentions:
1
Primary Interest:
All Treasure Hunting
I'm waiting for the extended warranty call about my soon to expire plan. "I'm glad you called. I have a claim to make." <crickets>

lol speaking of warranty call's my warranty on my last 3 Cars is about to Run out for the last 6 years yes they still don't know non of my cars
is new enough to have a factory warranty :tongue3:

the one I drive now is a 96 the one before a 99
i never drove anything newer that I remember,
and my guess they don't even know my name and maybe not even my sex since the messages are recorded

why renew ? It apparently never runs out completely :laughing7: at least not til I need it. Right ?
 

Last edited:

Kj Upton

Greenie
Feb 21, 2021
17
30
Primary Interest:
All Treasure Hunting
Yo Da internet will be shutting down for maintenance this Saturday. To continue to enjoy all the porn click here.

Scamyou.cm
 

Top Member Reactions

Users who are viewing this thread

Top