Fake Amazon order confirmation emails: how to spot them and check safely

"Your order of a $1,299 laptop has been placed." "Your account has been locked." "We couldn't process your Prime renewal." Emails like these work because so many people really do shop on Amazon, and a large charge you don't recognize triggers an instant reaction. This guide shows what the fakes look like, how to check in your real account without touching the email, and where to report them.

What do fake Amazon emails look like?

Amazon publishes its own scam trends. It says that of all Amazon impersonation scams reported by its customers globally in 2023, over two-thirds related to order issues or account issues (Amazon, March 2024).

Amazon describes order-issue scams as messages "containing details about a purchase you never made," and account-issue scams as ones that "involve fake billing issues, and may refer to unauthorized account access." In June 2025 it listed "fake order confirmations requiring payment" among the most common tactics used to impersonate Amazon. And in February 2025 it reported that "70% of fraudulent activities, reported by customers, targeted customer account information and payment details" in late 2024. In other words, the fake order is rarely the point. It's the bait that gets you to hand over a password or a card number.

Why the fake order often comes with a phone number

Many fake order emails contain no link at all, just a number to call "if you didn't make this purchase." That's callback phishing. The person who answers is the scammer. The FTC warns that callers may claim your account was used for fraud, tell you to keep it secret, or ask you to move money to "protect" it (FTC, March 2024). Some ask you to install remote access software. Amazon says it "will not ask you to download or install any software to connect with customer service" (About Amazon).

Amazon is a favorite disguise. The FTC said in 2021 that, since July 2020, "about one in three people who have reported a business impersonator scam say the scammer pretended to be Amazon" (FTC).

How do you check an Amazon order without clicking the email?

Never use a link, button or number in the email to check it. Go around it.

1. Open Amazon yourself. Use the Amazon Shopping app, or type amazon.com into your browser. Amazon's first tip is to "go to Amazon.com or the Amazon app directly to confirm purchase history and account information before taking any action."
2. Check Your Orders. Amazon says: "Only legitimate purchases will appear in your order history." If the order isn't there, the email is fake.
3. Check the Message Center. Amazon says that to find out if a message is really from Amazon, "visit the Message Center under 'Your Account'." Genuine messages appear there.
4. Check your payment method. Look at your card or bank app for the charge. A fake "you've been charged" email won't match a real transaction.
5. If something is wrong, contact Amazon through the app or website, not through anything in the email.

If the order really is in your account and you didn't place it, someone may have your password. Change it from the app, turn on two-step verification, and contact Amazon customer service through the app.

How do you spot a fake Amazon email?

The account check above is the reliable test. These signs help you decide not to engage in the first place.

• The sender's real address. Amazon says "Legitimate Amazon emails contain '@amazon.com.'" Look past the display name to the address, and watch for tricks like amazon-support.com or amazon.com.orders-help.net.
• The links. Amazon advises: "Review the link for misspellings or repeated characters. Legitimate Amazon websites contain 'amazon.com'." Hover over a link to see the real destination without clicking.
• Requests for payment or gift cards. Amazon says it "will never ask you to provide payment information, including gift cards," and "We will not ask for payment over the phone or email."
• Urgency. Amazon warns about scams "threatening account suspension unless the fake issue is resolved urgently."
• A phone number to call. Amazon says: "Do not call numbers sent over text or email, or found in online search results."

What about the Amazon logo next to the email?

Amazon says it "adopted a secure email capability that makes it easier for customers to identify authentic emails from Amazon" (Amazon). At the time of writing (October 2026), amazon.com publishes a BIMI record, which lets supporting mail apps show Amazon's logo next to authenticated mail, and a DMARC policy of p=quarantine. You can see both with our BIMI Checker and DMARC Checker. A logo next to a message is a good sign in supporting inboxes, but its absence doesn't prove fraud, because many mail apps don't show BIMI logos. Our guide to BIMI explains why.

Header details help when you're unsure. Paste the headers into the Email Header Analyzer and look for dmarc=pass with header.from=amazon.com. Our guide on checking SPF, DKIM and DMARC results walks through it.

How do you report a fake Amazon email?

Amazon's Trustworthy Shopping site says "Customers can report suspicious communications at amazon.com/reportascam" and "Even if you are not an Amazon customer, you can still report a suspicious message to us at reportascam@amazon.com." Amazon's Report a scam help page adds that "Sending the suspicious communication as an attachment is the best way for us to track it." The AWS suspicious email page adds: "You may also forward phishing emails and other suspected forgeries directly to stop-spoofing@amazon.com."

Use your mail app's report button too. Our guide on how to report a phishing email covers Outlook, Gmail and Apple Mail.

What if you already clicked, called or paid?

• You entered your Amazon password: change it immediately from the app or typed-in website, turn on two-step verification, and check your addresses, payment methods and recent orders.
• You entered card details: call your card issuer and ask for a new card.
• You called the number and gave remote access: disconnect the device from the internet, have it checked, and change passwords from a different device. The FTC warns never to give remote access to someone who contacts you unexpectedly.
• You bought gift cards for "Amazon": contact the gift card company right away. Amazon says it "will never ask you to purchase a gift card."
• You reused the password elsewhere: change it there too. For work accounts, follow what to do after clicking a phishing link.

Why do businesses need to care?

Fake Amazon emails don't only reach personal inboxes. Many companies order supplies through Amazon or Amazon Business, so a "your order has been placed" email looks plausible to purchasing, office managers and anyone with a company card. The steps below are general good practice, not Amazon policy.

• Agree where orders are checked. Staff who buy for the company should check the organization's account through the Amazon app or a typed-in address, or ask whoever administers it, never through an email link.
• Never pay or "cancel" by phone. Make it a rule that nobody calls a number from an order email.
• Separate work and personal accounts. A personal Amazon password reused on a work account turns a consumer scam into a company breach.
• Filter before it arrives. A mail filter that checks DMARC alignment quarantines or rejects most mail falsely claiming to be from amazon.com, though fakes from lookalike domains still need content and link checks.
• Watch shared inboxes. Addresses like orders@, purchasing@ and accounts@ receive a steady flow of genuine order mail, which makes a fake one easy to miss. Whoever monitors them should know the rule above.
• Make reporting easy, so one report helps the whole team. Our phishing awareness training guide covers how to build the habit.

Next steps

• Bookmark amazon.com, or use the app, so checking an order never starts from an email.
• Share the report table above with family and coworkers.
• Check how your own domain looks to receivers with the DMARC Checker.
• Read how to spot a phishing email for checks that work on any brand.
• iBlockSpam filters phishing and spoofed brand email before it reaches every mailbox on your domain, with a personal quarantine for each user. See how it works.

Browse our other phishing and threat guides.