A reasonably convincing set of faked Amazon Prime Video renewal notices is circulating widely and tricking users. Here's what to look for, and how to avoid getting taken by them.
A new phishing campaign is hitting an AppleInsider staffer's inbox with forged Amazon billing notices for a supposed Prime Video renewal. The polished invoice and urgent support pitch are designed to push victims into calling a scam hotline.
The messages impersonate Amazon's billing system and arrive with a PDF that looks like an official receipt. The document lists a fake order ID, a fabricated invoice number, and a renewal charge that customers never authorized.
It also repeats the same out-of-state phone number and tells recipients to call within a short window if they did not approve the payment.
Several versions of the scam pretend to come from Signaturely, a legitimate electronic signature service. The emails ask users to "Review & Sign" a subscription agreement and then present a fake Prime Video receipt inside the attached PDF.
The document uses an email address that does not belong to the recipient and a domain that is unrelated to Amazon.
New tactics mimic trusted services
Scammers are now combining fake invoices with borrowed branding from real business tools. The Signaturely theme gives the message a sense of authenticity because it looks like a routine signature request for a digital contract.
The layout mimics an Amazon receipt, but the details break down quickly once you look closely. First, Amazon does not send billing notices from random domains.
The company also does not use off-brand PDF invoices that ask you to call a phone number to resolve charges. Finally, Amazon does not ask customers to confirm activity through external signature services.
Why these scams are spreading
The presence of outside domains and repeated hotline numbers is a strong sign of fraud.
Phishing groups have increased Amazon-themed attacks because the brand is familiar and widely trusted. Activity also rises during the holiday season, since online shopping surges and people expect frequent order updates.
That fast-paced environment gives scammers more cover, and forged subscription renewals become harder for users to dismiss at a glance. Security researchers say these emails work because they trigger a quick panic response.
Messages that claim a large charge has already gone through push people to call the number in front of them, which is exactly what the attackers want. Victims who call the hotline are pressured to hand over bank information, Amazon login details, or remote access to a device.
Some groups urge callers to install remote desktop software to "process a refund," which can lead to full account takeover and financial loss.
Amazon's official guidance
Amazon warns customers to ignore any message that demands urgent action or asks them to verify account information through a phone number included in the email. The company reminds users that its support phone numbers are listed only on the Amazon website or in the official app.
The company also states that real order confirmations always appear in the Your Orders page. Messages that do not appear there should be treated as fraudulent.
Amazon publishes updated advice on current scam trends on its security help page.
How to stay safe from phishing emails
Consumers can protect themselves by watching for a few clear signs of phishing. Emails with unexpected invoices, high-dollar subscription renewals, or requests to call a support number should be treated with caution.
Next, messages that come from unfamiliar domains or include attachments you did not expect are also warning signs.
Avoid clicking links or opening PDFs if you suspect a scam. Do not call any phone number listed in the message.
Open the Amazon app or visit Amazon.com directly and look for activity on your account. If no charge appears in Your Orders, the email is a scam.
Finally, people who want extra protection can enable two-factor authentication for their Amazon account. They can also report suspicious emails to Amazon at [email protected].








