Don’t fall for this phishing scam warning of overdue bills

October 12, 2019

By Kim Komando

One of the most frustrating things about phishing scams is the fact that we’re tricked into falling for them. That’s why they’re some of the most popular hacking methods on the web, and why hackers put so much emphasis on building convincing emails and sites to steal your personal info.Thankfully, with enough diligence you can usually spot a phishing email or webpage from a mile away. They’ll often have broken English, sloppy designs and complicated URLs that give up the game right away. But what if hackers are able to accurately spoof a trusted email address and website so we can’t detect it? How dangerous would it be for our data?As it turns out, hackers are already a step ahead of security-conscious users. A new phishing scam masquerading as a major web service has been fooling people with warnings of overdue bills. If you fall for the scam and enter your information, your personal data can be compromised. Here’s how they’re getting away with it, and what you can do to avoid falling victim:

Amazon Web Services scam tricking users with overdue bill notifications

According to new reports from security analysts at BleepingComputer, a phishing scam outbreak is tricking users into revealing their info with a fake unpaid bill notice. The scam is spreading via email, and has already managed to deceive plenty of people with how convincing their bogus material looks.The scam email claims to be from Amazon Web Services and uses a realistic logo and font to inform users their “services have been suspended.” The overdue amount is a middling $4.95, and clicking the link to take care of it transports you to a landing page with space to enter your Amazon account information. Once entered, you’re kicked to the real Amazon.com.By then, hackers already have your Amazon username and password.While this seems like a fairly run-of-the-mill scam, it has two frightening components that make it hard to ignore: First, the emails successfully spoof the sender as a legitimate Amazon email address. Second, the fake landing page features a URL that contains Amazon’s actual domain. It’s not a real Amazon web address, but the characters in the URL are laid out in such a way that it appears to be one.

How can I protect myself? How can I tell a real alert like this from a false one?

You can’t blame people for falling for such a deceptive scam. To beat this one, you’ll need to use your best judgement and keep in mind a lesser-known red flag.The biggest tip-off that the page is not what it seems is the fact that it’s not secure. Any company like Amazon — which handles millions of users’ data each day — uses encryption to protect visitors. You can tell if a page is encrypted by the lock icon on the left-hand side of the URL. If you see “Not secure,” like in the image above, you should leave the page.In addition to that, most big-name platforms won’t send emails like this unless you’re subscribed to a paid service. If you receive an email about unpaid debts and aren’t sure what to make of it, call the company to verify its legitimacy. DO NOT click on the “Contact Us” option in the questionable email. Go to the actual company website and log in through their secure site to find the correct phone number.As an example, if you received this AWS email, calling Amazon is one of the first steps you can take to get to the bottom of things. Google Amazon’s phone number or check your account from Amazon.com They can track the emails they’ve sent to your account and will inform you of any real cancellations or billing issues associated with it.The realism of this scam email should be a stark warning about the state of our inboxes. Emails are not exclusively beneficial and any message you receive should be treated with caution and skepticism; otherwise you end up running the very real risk of data and financial compromise — and nobody can afford to suffer that.