Overview

• Scammers place fake orders using stolen or leaked address data and ship low-value items to generate positive reviews under unsuspecting customers’ names
• A current phishing campaign notifies victims of a €963 charge and directs them to a fraudulent site at amazon02atonline32.online to harvest login credentials
• Customers receiving unrequested packages are advised to keep the items, photograph the contents and report the incident to Amazon rather than discarding the parcels
• Security experts recommend enabling two-factor authentication and using unique passwords for every service to guard against account takeover
• Amazon says it is combating brushing abuses but warns that fake identities and overseas accounts make it difficult to fully eliminate the practice