Update Your Amazon Account Phishing Scam

[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]

VERY IMPORTANT INFORMATION, READ THIS FIRST: The example and associated information published on this page are subject to the SHPAMEE Terms Of Use. Please familiarise yourself with these terms before viewing or using any information on this page.

Header:

by mta374.mail.re4.yahoo.com with SMTP; Tue, 01 Jul 2008 08:09:42 -0700
Received: from me-wanadoo.net (localhost [127.0.0.1])
        by mwinf2007.orange.fr (SMTP Server) with ESMTP id 9844B1C00097;
        Tue, 1 Jul 2008 17:09:41 +0200 (CEST)
Received: from User (LRouen-151-71-137-112.w193-253.abo.wanadoo.fr [193.253.255.112])
        by mwinf2007.orange.fr (SMTP Server) with SMTP id 2ABF31C00059;
        Tue, 1 Jul 2008 17:09:39 +0200 (CEST)
X-ME-UUID: 20080701150939175.2ABF31C00059@mwinf2007.orange.fr
From: "Amazon.com" <norelay@amazon.com>
Subject: Update Your Account
Date: Tue, 1 Jul 2008 17:15:48 +0200
MIME-Version: 1.0
Content-Type: text/html;
        charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
To: x
Content-Length: 1934

Body:

Dear Customer,

- Due to recent account takeovers and unauthorized listings, Amazon is requesting a new account verification procedure. From time to time, randomly selected accounts (seller and/or buyer)are placed under an advanced updating process based on merchant accounts/bank relationsand on-file credit cards. Amazon may also request in an email message scanned/faxed copies of one or more photo ID's. Your account confirmation may go wrong if your credit card/bank account has expired, or if you have changed/replaced your credit card without letting us know about the change.

Your account is not suspended, but if in 36 hours after you receive this message your account is not confirmed we reserve the right to terminate your Amazon subscription.
If you received this notice and you are not an authorized Amazon account holder, please be aware that it is in violation of Amazon policy to represent oneself as an Amazon user. Such action may also be in violation of local, national, and/or international law.
Amazon is committed to assist law enforcement with any inquires related to attempts to misappropriate personal information with the intent to commit fraud or theft.
Information will be provided at the request of law enforcement agencies to ensure that perpetrators are prosecuted to the full extent of the law.

To confirm your identity with us click the link bellow:

http://www.amazon.com/exec/obidos/sign-in.html

We apologize in advance for any inconvenience this may cause you and we would like to thank you for your cooperation as we review this matter.

Respectfully,
Amazon.com, Inc.

Comments:

We noticed the following differences between this e-mail and the Unusual Activity In Your Account-scam, published in September 2007. The scammers are probably chopping and changing the e-mail to avoid the spam filters. However, changing the order of the paragraphs is not substantial enough to fool the spam filters:

1. This one has a 36-hour deadline, instead of 24 hours.

2. The previous example started with the bulleted list followed by the paragraph : "Due to recent account takeovers and unauthorized listings...". Perhaps the scammers of the September 2007 example, got distracted while cutting and pasting.

3. The anchor text of the phishing link is a bit shorter in this e-mail.

4. The copyright statement and the short notification at the bottom of the e-mail is omitted from this example.

From: "Amazon.com" <norelay@amazon.com>

Perhaps they meant noreply@amazon.com. There is a huge difference between relaying and replying.

Amazon may also request in an email message scanned/faxed copies of one or more photo ID's

Send a faxed copy of your photo ID via e-mail? So they expect you to fax yourself a copy of your photo ID, scan the faxed copy to file and then e-mail it to them? Why can't you just scan the photo ID and e-mail it to them? (we know this is not what the scammers meant, but the sentence may easily be interpreted that way). The scammers only mention "one or more photo ID's" so we assume photos of your dog will also do.

All the hilarious ambiguities found in this e-mail clearly shows that a bunch of amateurs compiled this e-mail. Be vigilant and don't fall victim to such a lame phishing attempt.

Related Cyber Criminal Profiles:

No related profiles found.

Similar Spam Examples:

Amazon.com Malware Spam - Order report
PayPal Phishing Scam - Your Account Has Been Limited
NatWest Credit Card Services Banking Phishing Scam
Loan Offer Scam - Doing It The 419 Way
Orchard Bank Phishing Scam Account Alert Statement Available

Related Malware Samples:

No related malware samples found.

[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]