Not every scam tries to frighten you with a locked account or a missed delivery. Some arrive disguised as something far more believable: a product recall notice tied to a recent Amazon order. With an order number, formal language and the promise of a refund, it can look genuine at first glance. That is exactly what makes this scam so effective, and why it is appearing on phones across Australia and New Zealand.
How This Scam Works
Scammers send fake SMS messages designed to look exactly like official Amazon communications. The product description is intentionally vague, such as “an item from your recent order,” so almost anyone who has shopped on Amazon recently could believe it applies to them. A realistic-looking order number adds to the illusion.
Clicking the link doesn’t lead to Amazon. It takes you to a fake portal designed to look like an Amazon refund or support page. From there, it traps you in a never-ending survey loop: 10 multiple-choice questions about your shopping habits, then a “thank you” screen, then 10 more questions. Throughout this process, scammers are quietly collecting IP addresses, device details, browser identifiers, and behavioural data. That information gets sold on the dark web or used to target you in follow-up attacks. One variant even redirects to Amazon rainforest conservation pages first, a tactic designed to build trust in Amazon-branded links.
What These Messages Look Like
These attacks rely on a few consistent patterns:
- A realistic-looking order number
- Messages include specific IDs like “Order No.: 103-XXXXXXX-XXXX062” to make the recall feel tied to your actual account history.
- Messages include specific IDs like “Order No.: 103-XXXXXXX-XXXX062” to make the recall feel tied to your actual account history.
- Vague but alarming product language
- The recalled item is described in general terms so it could apply to almost any purchase, regardless of what you actually bought.
- The recalled item is described in general terms so it could apply to almost any purchase, regardless of what you actually bought.
- A full refund with no return required
- This is designed to lower hesitation by making the offer seem low-effort and generous.
- This is designed to lower hesitation by making the offer seem low-effort and generous.
- A professional, formal tone
- Phrases like “please discontinue use immediately” and “your safety is our top priority” mirror the language we might expect of real product safety communications.
- Phrases like “please discontinue use immediately” and “your safety is our top priority” mirror the language we might expect of real product safety communications.
- Shortened links that hide where they’re actually going
- Scammers use URL shortening services to disguise the final destination. If you expand the link, you’ll find it leads somewhere that has nothing to do with amazon.com.
Red Flags Worth Knowing
Here’s what to watch for:
- Unexpected texts about product recalls
- Amazon doesn’t typically reach out about recalls through unsolicited SMS messages.
- Amazon doesn’t typically reach out about recalls through unsolicited SMS messages.
- Shortened or unfamiliar links
- Scammers use URL shorteners to hide the real destination URL so that you’re more likely to click the link.
- Scammers use URL shorteners to hide the real destination URL so that you’re more likely to click the link.
- Vague product descriptions
- Real recall notices identify the specific item, not just “an item from your recent order.”
- Real recall notices identify the specific item, not just “an item from your recent order.”
- Survey-style “verification” pages
- Legitimate refund processes don’t involve multi-page shopping habit questionnaires.
- Legitimate refund processes don’t involve multi-page shopping habit questionnaires.
- Urgent language about safety risks
- Scammers use safety concerns to push you to act quickly in the hopes you won’t take the time to verify the message first.
- Scammers use safety concerns to push you to act quickly in the hopes you won’t take the time to verify the message first.
- Local-looking numbers from unknown senders
- These messages often come from local numbers to appear more credible.
What You Can Do
- Go directly to Amazon. If you’re concerned about a recall, open the Amazon app or visit amazon.com.au and check your order history there. Don’t use the link in any text message.
- Close the page without responding. If you’ve already clicked, close it without answering any questions.
- Check your accounts. If you did interact with a fake page, review your Amazon account and any linked payment methods for unusual activity. To be safe, change your account password.
- Report the message. Report it to Scamwatch in Australia and the Department of Internal Affairs in New Zealand. Even if no money was lost, reporting helps authorities track scam activity, identify patterns, and work to shut these operations down.
- Block and delete. Once you’ve reported, block the sender and remove the message.
- Use scam detection tools. Tools like Trend Micro ScamCheck can detect and block scam texts before they reach you, and can analyse suspicious links and messages to identify threats that look legitimate on the surface.
You’re Already Ahead
These messages are crafted to feel legitimate, and even careful, experienced shoppers can find them convincing. Knowing the patterns these tactics rely on puts you in a much stronger position. Take a moment to verify before clicking anything unexpected and trust your instincts if something feels off.
Already a Trend Micro Customer?
Visit your Trend Micro Account to see if Trend Micro ScamCheck is included in your subscription.
