The Fake Amazon Order Email: Why That $599 Charge Is Not Real

An email lands in your inbox from "Amazon." The subject line says "Order confirmed — iPhone 16 Pro Max — $1,199." Or a MacBook. Or an Xbox. Something you definitely did not buy, at a price that makes your stomach drop. The email looks clean, the Amazon logo is there, and there is a big orange button that says "Cancel this order."

Your instinct is to click the button right now, before they charge your card. Please do not.

That button does not go to Amazon. It goes to a fake Amazon sign-in page designed to steal your password, or to a "customer service" phone number connected to a scammer who will try to talk you into installing remote-access software on your computer. As of April 2026, the fake Amazon order confirmation is the single most-reported phishing template to the FTC, according to their quarterly consumer-alerts data.

The 30-second test that ends every Amazon email scare

Never click a link in an Amazon email. Instead, open a new tab, type amazon.com directly, sign in, and click Your Orders. If the order is real, it will be there. If it is not there, it does not exist.

This single habit — never clicking an email link, always typing the website — defeats virtually every phishing email you will ever receive, not just Amazon's.

Let me walk through exactly why the scam works, the red flags to recognise, and what to do if you have already clicked.

How the fake Amazon order email is built

Scammers send out tens of millions of these emails each month, using lists of leaked email addresses. The email pretends to confirm a high-value order because:

A big dollar figure triggers panic.
Panic overrides your usual caution.
You rush to "cancel" before you slow down to verify.

The email will typically contain:

An Amazon logo (copied from the real site).
A realistic-looking order number, usually formatted like a real one.
A shipping address you do not recognise (often across the country).
A delivery date a few days out.
One or more call-to-action buttons: Cancel Order, Contact Seller, View Invoice, or a bolded phone number to call.

Every one of those links and phone numbers is controlled by the scammer. None of them go to Amazon.

When you click, one of two things happens:

Phishing version. You land on a fake Amazon sign-in page. Enter your password and the scammer captures it, along with any two-factor code you type in. Within an hour, they will be logged into your real Amazon account, ordering gift cards to an address they control, and using your saved payment method.
Phone-based version. The email's phone number connects you to a scammer who claims to be Amazon customer service. They will "need to verify" your identity, ask for your password, or — most commonly — ask to install "remote support software" on your computer to "reverse the charge." That software gives them control of your screen. From there they open your online banking and move money out.

Both versions are designed to feel like customer service. That is the trick.

The five red flags that identify the fake Amazon email

Any one of these is enough:

The "from" address is not from amazon.com. Look closely — "amazon-support@amzn-orders.com," "service@amazon-billing.net," or even just a number-heavy Gmail address. Real Amazon emails come from @amazon.com, @amazon.co.uk, or @amazon.com.au.
The order number appears only in the email, not on your Amazon Your Orders page. Real orders always show up in your account within seconds.
The delivery address is somewhere unfamiliar. Scammers often use generic US cities. Real Amazon shows your actual default address.
The email pressures you to act within hours ("Cancel within 24 hours or payment will be processed"). Amazon does not work that way — you can cancel orders directly from Your Orders at any time until they ship.
The email includes a phone number for customer support. Real Amazon does not print customer-service phone numbers in order confirmations. The only way to reach Amazon by phone is through the "Contact us" page in your account, which will call you back at your saved number.

How to verify any Amazon order in 60 seconds (the safe way)

This is the entire safety habit:

Do not click anything in the email.
Open a new browser tab.
Type amazon.com (or amazon.co.uk, amazon.com.au) directly into the address bar.
Sign in as usual.
Click Returns and Orders at the top right.
Scan your recent orders.

If the $599 order is real, it will be right there, with a big "Cancel items" button next to it. Click that. Real, done.

If it is not there — and it will not be, because the email is fake — you can confidently delete the email and move on. No charge is coming. No order exists. You did not buy anything.

You can also forward the suspicious email to stop-spoofing@amazon.com, Amazon's official reporting address, and then delete it. Amazon uses these reports to take down the scam domains.

What to do if you already clicked

Do not panic. A clicked link is not the end of the world — your information is only at risk if you also typed your password on the page that opened.

If you only clicked, but typed nothing

You are almost certainly fine. Close the tab. Clear your browser cookies for good measure (Settings → Privacy → Clear browsing data → Last hour → Cookies). Run a quick scan with Windows Security (Windows) or built-in XProtect (Mac) just in case.

If you typed your Amazon password

Move fast, in this order:

Change your Amazon password immediately. Go to amazon.com directly, sign in, click Your Account → Login and security → Edit password. Use a brand-new password you have not used anywhere else.
Check Your Orders for anything you did not place. Cancel any you see.
Turn on two-step verification in the same "Login and security" screen if you have not already. This makes your account much harder to take over.
Check any linked bank or credit card for fraudulent charges.

If you installed any "support software" someone asked you to install

Disconnect from the internet immediately (unplug Wi-Fi, pull out the cable).
Uninstall the program (AnyDesk, TeamViewer, LogMeIn, SupRemo).
Run Malwarebytes Free to clean anything left behind.
Change your Amazon, email, and bank passwords from a different device — your phone or a family member's computer.
Call your bank's fraud department (number on the back of your card).
File a report at reportfraud.ftc.gov (US), actionfraud.police.uk (UK), or scamwatch.gov.au (Australia).

Why scammers pick Amazon

Amazon has more than 200 million customers worldwide. When a scammer sends a million fake Amazon emails, a huge percentage of recipients genuinely have Amazon accounts — which means the email feels plausible. Compare that to a fake "Best Buy" email, which only lands in the inbox of people who shop at Best Buy. Amazon is the largest possible net.

The scam will not disappear. Every few months the email design is refreshed — a new order template, a new product, a new amount. The method is the same. So is the defence: never click; always check Your Orders directly.

Pass this habit on to your family

Sit with anyone in your family who orders from Amazon — your spouse, your parents, your grandchildren — and walk through these three steps together:

Show them what a real Amazon email looks like, side-by-side with a fake one.
Walk them to the Amazon Your Orders page and show them where real orders appear.
Agree on the rule: "If it is not on the Your Orders page, it is not real."

Five minutes of this conversation can save thousands of dollars and hours of cleanup later.

Frequently Asked Questions

Why am I suddenly getting fake Amazon emails?

Your email address has likely appeared in a data breach (most adults' addresses have, and that is not your fault). Scammers buy these email lists and blast Amazon-themed phishing to everyone on them. It does not mean your Amazon account has been breached — only your email address is on a spam list.

Can Amazon actually charge me for an order I did not place?

No. The email is not from Amazon — it is from a scammer. There is no order and no charge. If you ever see an unexpected charge on your actual card, dispute it with your bank, not via any link in an email.

What does the real "from" address look like for Amazon?

Real Amazon emails come from auto-confirm@amazon.com, shipment-tracking@amazon.com, or order-update@amazon.com, depending on the message. The domain is always @amazon.com (or @amazon.co.uk for UK, @amazon.com.au for Australia). If the domain is anything else, it is a scam.

Should I reply to the email to tell them they have the wrong person?

No. Do not reply. Replying confirms your email address is active and often triggers more scam emails. Just forward it to stop-spoofing@amazon.com and delete.

What if I click the cancel link but leave without typing anything?

You are almost certainly safe. A simple click does not expose your password. Clear your cookies, close the tab, and move on.

Keep reading

External resources:

Amazon's official phishing report page: amazon.com/gp/help/customer/display.html?nodeId=GRGRY7AQ3LMPXVKL
FTC phishing guidance: consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams

✅ Reviewed by Eleanor Shaw — techfor60s editorial desk, last verified 2026-04-18.