As I had mentioned in the Tech Support and Refund Scams post, many of these scams start with an email claiming to be from e legitimate company. This morning I had several emails from ‘Billing Team’ in my junk folder. Here is one of them below (click the image for full-size). Note: the formatting including highlights is how the email appeared and were not added by me).
Besides ending up in my junk folder there were several things I noticed within a few seconds to indicate this was fake and a scam:
- The return address was ‘Billing Team’ from a gmail.com address. This combination is what triggered the email to be flagged as ‘Junk’.
- The entire email is a .PNG format image (which also may have caused it to be flagged as ‘Junk’ . There is no text and (surprisingly) no links in the email.
- The header is just ‘AMAZON’. Did not have the amazon logo (which is the word ‘amazon’ in all lower case with an arrow below pointing from the first a to the z).
- It is a ‘Billing Invocie‘. They did managed to spell ‘Invoice’ correctly on the next line with ‘Invoice Number’. I bet most people wouldn’t have even noticed this typo.
- A quick san of the email shows for the most part other than the typo mentioned above the grammar seems fairly good. However, looking at the email more closely little things start to stand out. The wording about the payment is weird (Your payment will reflect in your statement in 24 hours). Also, towards the bottom things are a bit off “Contact on our number’ and then notice the phone number both the area code and prefix are in parentheses. A Google search of that phone number shows it is associated with Seattle, WA (which is where Amazon is based ) but not associated with any businesses. Then there is ‘if you want to cancel the subscription‘. The Billing Invocie is for a product not a subscription.
- Date is in DD/MM/YYYY format instead of the US standard of MM/DD/YYYY format.
- Iphone X is incorrect it should be iPhone X or even Apple iPhone X. $900 is about $500 more than the current retail price. Also which model of the iPhone X?
- The copyright is rather odd. They didn’t even use the copyright symbol © or at least ‘(c)’. I am thinking they tried to update the template for 2022 but messed up and deleted part of the year. Hlonon is an actual Amazon 3rd-party seller based in China, but they sell holiday décor and craft items plus calendars. ‘AU’ is the country code for Australia. May be they meant to say ‘All Rights Reserved’?
- Very generic. Most Billing Invoices will have part of your name and address, this had none. Note: Genuine Amazon order confirmations will have your first name and City/State.
I’ll give these scammers some credit, they did put some effort into the template by having a Seattle, WA phone number to go along with the fake AMAZON header. Using the name of a business which does sell on Amazon (though not this type of product) was an interesting touch. Looking at the real emails I get from Amazon they all say ‘This email was sent from a notification-only email address that cannot accept incoming email. Please do not reply to this message.’ There is no link or phone number provided in the ‘real’ email from amazon (which always come from an amazon.com address NOT a GMAIL.COM.
Sadly, people who don’t know what to look for are going to see this email and think they’ve been charged $900 by Amazon for an iPhone they didn’t order. They’ll call the number (which I am sure re-routes to India) and fall into the scammers trap then hours later would be out more than just $900. Again as mentioned in the previous post these scammers are going after the older population and those who are less tech savvy. They don’t know what a real Amazon email looks like or the correct stylization of ‘iPhone’ or even the correct price. They don’t know to pay attention to (or look at) the return address.
