Amazon Phishing Attacks Increase 188% Around Prime Big Deal Days

Key Takeaways:

• Amazon identity impersonation attacks increased 188% ahead of Prime Big Deal Days, and AI-generated messages are making these scams harder to detect than in past years.
• Fraudsters registered 1,284 Amazon-themed domains in September, and Check Point Research classified 6.5% as malicious or suspicious.
• Multi-factor authentication and direct navigation to official sites remain the most effective defenses against attacks for both shoppers and sellers.

Amazon’s Prime Big Deal Days on October 6 and 7 rank among the year’s largest shopping events. For sellers who depend on this traffic increase, it also marks a period when fraudsters intensify efforts to exploit brand trust. KnowBe4 reports a sharp rise in Amazon impersonation attacks timed to coincide with the event, and the tactics behind them have grown harder to flag.

How Widespread Are Amazon Phishing Attacks This Year?

Amazon-themed phishing attacks increased 188% between late August and September, KnowBe4 reported. Check Point Research documented a similar trend, recording 1,284 newly registered Amazon and Prime-related domains in September alone. Roughly 6.5% of those domains were flagged as malicious or suspicious. The volume points to deliberate infrastructure-building ahead of peak shopping season, predicated on opportunism.

Poor grammar and clumsy phrasing used to be reliable phishing warning signs. That safety net has largely disappeared. Generative tools now produce natural, well-localized messages alongside convincing replica checkout and login pages. KnowBe4 found that 75% of analyzed Amazon-themed attacks varied sender names, subject lines, and domains to evade detection filters. More than 95% included links to fake credential or payment pages, and some campaigns used hidden characters to confuse security scanners.

What Should Sellers and Shoppers Do to Stay Protected?

Direct navigation remains the strongest defense. Open the official Amazon app or type the known web address directly into a browser instead of clicking links in emails or texts. Scrutinize URLs for extra words, unusual punctuation, or unfamiliar domain endings. Enabling multi-factor authentication or passkeys adds a second layer of protection even if login credentials are compromised. After the event, review bank and card statements for unauthorized charges, especially if you entered payment details on an unfamiliar page.

Check Point Research noted that financial services organizations faced thousands of attacks per organization weekly in September, with retailers and consumer-service companies seeing comparable increases. For sellers building their brand on Amazon, the data signals that platform trust is now a shared responsibility. Verifying communications before acting, and encouraging customers to do the same, protects both reputation and revenue during high-traffic sales events.