Amazon Account Takeover Scams Are Surging — Here’s How Scammers Are Piling Up Real-World Chaos and Digital Chaos

The real danger isn't in the fine print of a Terms of Service agreement. It's in the front yard of a 79-year-old disabled woman in Elgin, Illinois, where a mountain of boxes has piled up for over a year. Pat Hurley didn't order any of them. She doesn't even have an Amazon account. Yet, since last summer, more than 100 mysterious packages have been delivered to her doorstep, with some days seeing as many as 20 arrive.

The situation became a physical hazard and a deep source of distress. Boxes blocked her door, forcing her to lift and move them despite her disability. "If somebody's going to show up... I'm disabled... Alone in the house. And all this is happening. I'm getting a little nervous," she told reporters. The sheer volume of deliveries, each showing her address but someone else's name, created a feeling of unease and vulnerability that no security system can fix.

This isn't just a bad delivery glitch. It's a stark symptom of a broader scam epidemic that Amazon itself is warning its 300 million customers about. The company finally picked up the unwanted packages last weekend, apologized, and said it is investigating. But the story of Pat Hurley illustrates the very real human cost when account takeover scams go unchecked. It's the opposite of porch piracy, where someone steals packages. Here, someone is ordering them, and the delivery system is blindly following the address, piling up a dangerous and distressing burden on an innocent, vulnerable woman.

The Scam Playbook: How They Work and Why They're Convincing

The playbook is simple, sneaky, and designed to work on anyone. Scammers don't need a PhD in hacking; they just need to exploit common human reactions-fear, urgency, and the simple trust we place in a familiar brand. The case of Mary Ellen Strange is a textbook example of the fear-based tactic. In June 2024, a caller claiming to be from Amazon's "fraud detection unit" told her her name was linked to a $94,000 money laundering scheme and even child pornography charges. The sheer weight of those accusations, delivered with a fake official tone, was meant to paralyze her into compliance. The goal wasn't to sell a product; it was to get her to hand over her password before she could think.

That's the core of the scam: impersonation. Attackers use fake websites, fake alerts, and fake customer support to mimic Amazon's look and feel. They'll send a text or email about a "delivery issue" or an "account problem," hoping you'll click the link. That link leads to a spoofed Amazon site, often created with AI to look real. As one expert notes, "With AI, it's a very simple matter for even less sophisticated criminals to create a phony Amazon website." Once you type in your username and password, you've just given them the keys to your account.

A common variation is the "you're owed a refund" scam. A message says you've been overcharged or qualify for a credit, with instructions to call a number or click a link. This preys on the hope of getting money back. But the real payoff for the scammer is getting you to reveal your login details or grant remote access to your device.

The timing is no accident. These attacks spike during the holiday shopping season, when Amazon's 300+ million customers are online more than ever. Cybercriminals register thousands of fake domains each month, including 19,000+ that impersonate major brands like Amazon. They cast a wide net, knowing that even a small percentage of clicks can yield hundreds of compromised accounts. The scammer's job is just to get you to click that link or answer that call. Once they have your credentials, they can reset your password, lock you out, and start using your account to order goods or steal your payment info. It's a digital version of a front-yard scam, but the damage is done online, often before you even realize what happened.

The Smell Test: What to Do Right Now to Protect Yourself

The bottom line is simple: if it feels off, it probably is. You don't need a cybersecurity degree to spot a scam. Just kick the tires on your own security with these three common-sense checks.

First, the golden rule: never click on a link in an unsolicited text or email claiming to be from Amazon. That includes any message about a "delivery issue," "account problem," or "refund." The scammer's goal is to get you to click. Instead, go directly to Amazon.com or open the official app. Type the address yourself. This is the single best way to avoid a fake site.

Second, be stingy with your personal information online. Bookmark Amazon's official login page so you can't be tricked by a spoofed site. And remember, Amazon will not ask for payment or account updates via unsolicited phone calls, texts, or emails. If you get a message urging you to "confirm payment info," ignore it. Go directly to your account to check for any real issues.

Third, do a quick audit of your account. Look at your recent orders and payment methods. Did you really order that $200 gadget from a seller you've never heard of? If something looks wrong, act fast. Then, and this is critical, enable two-factor authentication (2FA) or passkeys for an extra layer of protection. It adds a step that scammers can't easily bypass.

These steps aren't complicated. They're just the kind of practical, no-nonsense checks that keep your digital front yard secure.

What to Watch: The Red Flags That Mean Action is Needed

The bottom line is this: if you get a call or message that makes you nervous, it probably is a scam. The key is knowing the red flags and what to do. The FBI reports that online crooks have stolen nearly $300 million by taking over victims' accounts so far this year, with over $262 million in losses from account takeover fraud. These aren't rare glitches; they're widespread and serious.

Here are the three clear signs to watch for and the actions to take:

1. The Unexpected Demand: If you get an unsolicited call or message demanding your password or payment information, hang up and call Amazon back. Use the number on your official statement or the one in your account settings, not any number provided in the message. This is the most common trap. As the FBI and Amazon warn, attackers send texts, emails and make phone calls designed to fool you into giving away your username and password. The real Amazon will never ask for this via an unsolicited message.

2. The Suspicious Link: If you see a strange link in a text or email about a "delivery issue" or "account problem," report it. Don't click. Report the message to Amazon and to your phone carrier. This helps stop the scam from spreading. The scammer's goal is to get you to click a link to a fake Amazon site that looks real. As one expert notes, "With AI, it's a very simple matter for even less sophisticated criminals to create a phony Amazon website." Your report can help shut down these fake pages.

3. The Fear-Based Tactic: Pay attention to messages that create a sense of urgency or fear. The case of Mary Ellen Strange is a prime example. A caller claiming to be from Amazon's "fraud detection unit" told her her name was linked to a $94,000 money laundering scheme and even child pornography charges. The sheer weight of those accusations was meant to paralyze her into compliance. If a message tries to scare you into acting fast, it's a major red flag. The real Amazon will never threaten you with criminal charges over a payment issue.

The setup is simple for the scammer: they want you to click a link or answer a call. Once they have your login details, they can reset your password and lock you out. The bottom line is to stay calm, verify directly with Amazon through official channels, and never give out your information on demand.