Amazon’s new order confirmation emails seen boosting phishing risk

Skip to Content News Archives Economy Energy Oil & Gas Renewables Electric Vehicles Mining Commodities Agriculture Real Estate Mortgages Mortgage Rates Finance Banking Insurance Fintech Cryptocurrency Work Wealth Smart Money Wealth Management Investor Personal Finance Family Finance Retirement Taxes High Net Worth FP Comment Executive Women Puzzmo Newsletters Financial Times Business Essentials More Innovation Information Technology FP500 Podcasts Small Business Lives Told Tails Told Shopping Financial Post Store Obituaries Place a Notice Advertising Advertising With Us Advertising Solutions Postmedia Ad Manager Sponsorship Requests Classifieds Place a Classifieds ad Working Profile Settings My Subscriptions My Offers Newsletters Customer Service FAQ News Economy Energy Mining Real Estate Finance Work Wealth Investor FP Comment Executive Women Puzzmo Newsletters Financial Times Business Essentials This advertisement has not loaded yet, but your article continues below.HomeNewsRetail & MarketingAmazon’s new order confirmation emails seen boosting phishing risk'It's never been safe to just click on random links in emails, even if it does look kind of like it comes from Amazon'Author of the article:Without directly addressing cybersecurity concerns, Amazon said the new email format was designed to make authentic messages from the company easily identifiable. Photo by DENIS CHARLET/AFP via Getty ImagesWhen Dan Landau ordered a portable photo printer from Amazon.com Inc., he expected the confirmation email to tell him what was on its way. Instead, he was notified that his “luggage” was coming. In another instance, the 38-year-old head of marketing for a venture capital firm ordered items to maintain his pool and was confused when the company labelled them three different ways: “Decor,” “Outdoors” and “Garden.”THIS CONTENT IS RESERVED FOR SUBSCRIBERS ONLYSubscribe now to read the latest news in your city and across Canada.Exclusive articles from Barbara Shecter, Joe O'Connor, Gabriel Friedman, and others.Daily content from Financial Times, the world's leading global business publication.Unlimited online access to read articles from Financial Post, National Post and 15 news sites across Canada with one account.National Post ePaper, an electronic replica of the print edition to view on any device, share and comment on.Daily puzzles, including the New York Times Crossword.SUBSCRIBE TO UNLOCK MORE ARTICLESSubscribe now to read the latest news in your city and across Canada.Exclusive articles from Barbara Shecter, Joe O'Connor, Gabriel Friedman and others.Daily content from Financial Times, the world's leading global business publication.Unlimited online access to read articles from Financial Post, National Post and 15 news sites across Canada with one account.National Post ePaper, an electronic replica of the print edition to view on any device, share and comment on.Daily puzzles, including the New York Times Crossword.REGISTER / SIGN IN TO UNLOCK MORE ARTICLESCreate an account or sign in to continue with your reading experience.Access articles from across Canada with one account.Share your thoughts and join the conversation in the comments.Enjoy additional articles per month.Get email updates from your favourite authors.THIS ARTICLE IS FREE TO READ REGISTER TO UNLOCK.Create an account or sign in to continue with your reading experience.Access articles from across Canada with one accountShare your thoughts and join the conversation in the commentsEnjoy additional articles per monthGet email updates from your favourite authorsSign In or Create an Account“The categories are very vague, and they seem to have little to do with what is actually being ordered,” he said.Breaking business news, incisive views, must-reads and market signals. Weekdays by 9 a.m.By signing up you consent to receive the above newsletter from Postmedia Network Inc.A welcome email is on its way. If you don't see it, please check your junk folder.The next issue of Posthaste will soon be in your inbox.We encountered an issue signing you up. Please try againLandau isn’t the only one expressing bafflement. In recent weeks, Amazon customers on TikTok and Reddit have also wondered why product names and images were replaced with labels such as “Household item” or “Essentials item” in order confirmation emails.An Amazon spokesperson said the company simplified the information to direct customers back to its app and website in an effort “to further improve” their privacy by reducing “customer information shared outside” of Amazon.But critics say the emails can be so vague, and sometimes so far removed from the actual product, that they become less useful for telling customers what’s being shipped, and more useful to scammers looking for a template to launch phishing attacks.Arun Vishwanath, founder of the Cyber Hygiene Academy, says the change is essentially asking shoppers to trade privacy for security and could spur impersonation attempts.“It’s definitely not in the best interest of customers,” said Vishwanath, who also advises the National Security Agency’s research-focused Science of Security & Privacy directorate. “If anything, it increases risk.”Phishing attacks often mirror official emails and trick people into clicking on a bogus link that might contain malware or request login credentials. Vishwanath says Amazon’s new confirmation emails could encourage users to click on links without verifying who sent them.Last year, Americans reported US$3.5 billion in losses from so-called imposter scams, according to the Federal Trade Commission. The agency said that in 2023 it received about 34,000 reports of scammers pretending to be Amazon, the second-most impersonated company after Best Buy/Geek Squad.Without directly addressing cybersecurity concerns, the Amazon spokesperson said the new email format was designed to make authentic messages from the company easily identifiable.But Erich Kron, an adviser to Knowbe4, a firm that trains people to avoid phishing and other attacks, said the change itself could attract scammers.“Anytime some change like this happens, bad actors are going to jump on it and they’re going to use that change and things that people aren’t used to, to help us make mistakes,” he said.This advertisement has not loaded yet.This advertisement has not loaded yet, but your article continues below.In cases where consumers don’t receive Amazon app notifications to corroborate their purchases, an email may be the only immediate indication that an order has shipped. But when the message no longer details what they ordered, they may be more inclined to follow email links — including ones sent by scammers, Kron said.“It’s never been safe to just click on random links in emails, even if it does look kind of like it comes from Amazon,” he said. Kron said it’s typical for phishers to practice “credential stuffing,” a method often used by Amazon scammers who feed purloined usernames and passwords in a tool that automatically searches banks, credit card companies and other large retailers for a match.Standard security practices can help spot phishing attempts, such as hovering over a link with a computer mouse if browsing from a desktop. But that safeguard is harder to use on a cellphone, where Amazon notifications are most likely to appear. On a phone, it is less likely that when clicking a link, a preview will pop up allowing users to confirm the link leads directly to Amazon’s platform.Abnormal AI, a security company that uses artificial intelligence to help companies prevent phishing attacks, said it has not yet seen conclusive data showing a spike in scams since Amazon stopped providing specific product information in its order confirmation emails. But, echoing other cybersecurity experts, the firm said the new format could make it easier to carry out such attacks.We apologize, but this video has failed to load.Notice for the Postmedia NetworkThis website uses cookies to personalize your content (including ads), and allows us to analyze our traffic. Read more about cookies here. By continuing to use our site, you agree to our Terms of Use and Privacy Policy.