Baitaphish
Security intelligence
SearchLatest briefing
Phishing guide

Is this Amazon email or text message real?

Verify Amazon delivery, refund, Prime renewal, order, and account-lock messages without trusting the message itself.

By

Content reviewed
Short answer

Do not decide from the logo, tone, or sender name alone. Open Amazon from your own bookmark or its official app and check your orders, account, and Message Center. Do not use the message’s link or phone number.

01

What you may be seeing

Messages impersonating Amazon commonly use an unexpected order, delivery problem, refund, membership change, or account warning to create a reason to act.

A real brand name, logo, order-like details, or polished layout can be copied. Those features do not establish who sent the message or where a link goes.

02

Signals to inspect—and why they matter

Strong evidence

The actual destination is not an Amazon-controlled domain

A button label can say “Amazon” while opening a different domain. The registrable domain—not a brand word elsewhere in the address—is the useful part to verify.

The message requests a password, one-time code, or gift-card payment

Amazon’s guidance says to protect account credentials and verify communication through official channels. The FTC says a demand to buy gift cards and share their numbers is a scam.

The order, refund, or account event is absent from the official app or site

An independently opened account is a better source of truth than the message. An absent event strongly contradicts the message’s story, although recently initiated actions can take time to appear.

Contextual signals

Urgency, a generic greeting, or awkward wording

Pressure can be a manipulation tactic, but legitimate messages can be urgent or imperfect and sophisticated scams can be polished. Treat these as reasons to slow down, not proof.

Contextual signals can justify caution, but they do not authenticate or condemn a message by themselves.

03

Safe verification steps

  1. Do not tap the link, call the supplied number, reply, or open an unexpected attachment.
  2. Open the Amazon app yourself or type amazon.com in a new browser tab.
  3. Check Your Orders, account settings, and Message Center for the claimed event.
  4. If you still need help, start customer support from the official app or site.
04

What to do next

  • Use Amazon’s official reporting route for a suspicious communication; this is Amazon’s instruction, not a Baitaphish reporting channel.
  • If you disclosed an Amazon password, change it from Amazon’s official site and change any other account that reused it.
  • If you disclosed payment information or sent money, contact the card issuer or payment provider using a known number and ask about protective steps.
Evidence

Authoritative references

Reporting instructions on linked pages belong to the named organization. Baitaphish does not receive or process reports.

Limitations and uncertainty

What this guide cannot establish

  • A message’s absence from Message Center is useful context, not universal proof: some service, seller, or delivery communications may appear through other legitimate channels.
  • Sender addresses and display names can be forged or compromised. A familiar address alone does not make the request safe.
  • Amazon changes products and support flows; the authoritative links below were reviewed on the date shown.

Baitaphish is not affiliated with or endorsed by Amazon.

Continue
All phishing learning →
ExerciseAmazon refund text: decide before you tapEvaluate a synthetic refund message using the destination, payment request, and independent account verification—not polish or grammar.GuideHow can I inspect a sender, link, attachment, or QR code safely?Safely evaluate sender addresses, destination domains, attachments, QR codes, and login pages without supplying sensitive data.GuideWhat should I do after clicking a phishing link?Use a calm, evidence-based response after a suspected phishing click, credential entry, download, consent grant, or payment.