« Beneath the Latest Blasts | Main | Make a Christmas Phish »

December 19, 2008

Amazon Prime is a subscription service from amazon.com that lets you get "free" two-day shipping with every order. I say "free" in quotes because Amazon Prime does have an annual cost, but one that frequent Amazon customers certainly recoup fairly quickly.

And so, consider the Amazon Prime customer who receives the following message:

From: Amazon.com Customer Service
Subject: Your Amazon.com Prime Cancellation Confirmed

Hello from Amazon.com.

Your Amazon Prime membership has been cancelled, per your request.

Our records indicate that you haven't used your Amazon Prime membership benefits, so I've requested a full refund of $79 for the membership fee. The refund should be processed within the next 2-3 business days and will appear as a credit on your next credit card billing statement.

Please know that we value your business, and we hope to see you again soon at Amazon.com.

We always strive to provide a high level of service, and we would appreciate your feedback. Please let us know if we resolved your inquiry.

If yes, click here:

Please note: this e-mail was sent from an address that cannot accept incoming e-mail.

To contact us about an unrelated issue, please visit the Help section of our web site.

Best regards,

http://www.amazon.com

Of course, if the recipient was concerned and did the right thing—log onto amazon.com through normal means—there would be no change to Prime status. But clicking the link would lead to a lookalike login page, where one's username and password credentials would be lifted. Minutes later, their Amazon accounts (and associated credit cards) will have been hijacked.

Thankfully for the phishing message I saw, the phony site (hosted in Russia) was taken down. But the template is set. It will be used again with a different web site destination. Amazon Prime customers: Beware.