Yes, the Amazon Prime renewal scam is real—but the best-documented PDF campaign dates to January 2025, not a newly verified August 2026 outbreak. Attackers sent Amazon-branded emails with PDF attachments claiming a Prime membership had expired or was about to expire. Links in the PDFs redirected victims to imitation Amazon sites that requested login credentials and payment-card details. Similar renewal, refund, account-lock, recall and Prime Video lures have appeared since.
If you received one, do not click its link, open its attachment or call its phone number. Open Amazon independently, check your account and Message Center, then follow the response steps below based on what you did.
What the documented Prime phishing campaign looked like
Reporting on Palo Alto Networks Unit 42 findings described a January 2025 operation that began with an unsolicited email. The message claimed the recipient’s Prime membership had expired or was about to expire and included a PDF made to resemble an Amazon notice. A link in the document sent the victim through redirects to an Amazon-imitating website, where the attacker requested an Amazon username or email address, password and card information. Candid Technology’s report said researchers identified up to 31 PDF variants and more than 1,000 Amazon-themed domains reportedly registered from at least June 2024; those figures describe the reported infrastructure, not a live count of active sites.
The PDF was a clickable wrapper, not necessarily a file that installed malware by itself. Unit 42 has documented phishing PDFs whose links redirect to attacker-controlled websites and can use cloaking to frustrate automated scanners. Unit 42’s analysis explains why opening a PDF does not make its links trustworthy.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Amazon branding, a threatened loss of Prime benefits and an urgent payment request are designed to make the recipient act before checking the account through a safe channel.
Same tactic, different story
Scammers change the explanation while keeping the same goal: move you from a message they control to a fake sign-in or payment page.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
| Lure | Typical action requested | What is established |
|---|---|---|
| Unexpected Prime renewal price | Click “Cancel Subscription” or dispute a large renewal | Amazon warned about this pattern in July 2025. The warning audience was roughly 200 million Prime members, not 200 million confirmed victims. Malwarebytes reported the warning. |
| Account hacked or locked | Call a supplied number or “secure” the account through a link | Receiving the message does not prove your account was hacked; verify independently. |
| Refund offer | Provide credentials, card details, a fee or gift-card codes | Impersonators may pose as Amazon or a government agency. |
| Product recall text | Sign in or submit payment information | A related Amazon recall-message campaign was reported in February 2026; it is separate from the January 2025 PDF operation. Yahoo Tech covered the Guardio warning. |
| Prime Video billing notice | Open a receipt or “fix” a payment | A December 2025 campaign reportedly used fake billing messages and PDF receipts. Forbes reported that separate campaign. |
What the scammers want
- Your Amazon email address or username and password.
- Card number, expiry date, CVV and billing details.
- Name, address, phone number and other personal information.
- One-time passcodes or other authentication details.
- Passwords reused on other websites.
Compromised Amazon credentials can enable purchases using saved payment methods and expose order history, addresses and account settings. Reused passwords may let attackers attempt logins elsewhere. The evidence establishes credential and payment theft as the objective; it does not prove that every victim suffers identity theft or that stolen data is sold.
Red flags that deserve a stop-and-check
- An unexpected expiration, renewal, suspension, refund, recall or account-hack claim.
- Pressure to act immediately or an unusually high renewal amount.
- A PDF attachment or button you did not request.
- Requests for a password, full card number, CVV, Social Security number, gift-card code or one-time passcode.
- A phone number, shortened link or redirect supplied by the message.
- A message that appears only in email or text and not in Amazon’s Message Center.
Good spelling, your name, correct personal details, an Amazon logo or a convincing PDF does not prove authenticity. Sender names and addresses can be forged, and a visible link can conceal another destination. A domain such as amazon.com.example.com belongs to example.com; security-amazon.com is not amazon.com.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
How to verify an Amazon message without taking the bait
- Do not click the email, PDF, text link, “cancel” button or supplied phone number.
- Open the Amazon app or type Amazon’s address into your browser yourself.
- Sign in and inspect Prime status, payment methods, recent orders and security settings.
- Open Amazon’s Message Center and look for a corresponding communication. An external message that has no counterpart there deserves suspicion, although the absence or presence of one message is not, by itself, conclusive.
- For an Amazon Pay issue, navigate directly to the official Amazon Pay site rather than using the message’s link. Amazon Pay’s guidance explains direct verification and look-alike domains.
Amazon can send legitimate email, text and app notifications, and some may ask you to sign in. The safe habit is to start from the official app or site instead of trusting the route supplied in an unsolicited message.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do based on what happened
If you only received the message
Do not open the attachment or interact with it. Preserve the original message if you may report it, then delete it. Amazon says suspicious messages should be deleted without opening attachments or clicking links. Forward suspected forgeries to [email protected] and use Amazon’s official phishing-report form at Amazon’s reporting guidance.
Rank #4
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
If you clicked but entered nothing
- Close the page and do not download files or approve browser notifications.
- Review your browser’s downloads and remove anything unexpected.
- Run your device’s normal security scan if a file was downloaded or opened.
- Visit Amazon independently to check orders, payment methods, account details and security activity.
- Report the message, retaining the original email, attachment, headers, destination domains and screenshots first.
If you entered an Amazon password
- Go directly to Amazon and change the password immediately.
- Choose a new password that is unique to Amazon.
- Change it anywhere else you reused it, starting with email and financial accounts.
- Enable Amazon two-step verification or multifactor authentication. MFA reduces takeover risk but cannot stop someone from voluntarily submitting information to a fake site.
- Review orders, saved cards, addresses, email, phone number, devices and login activity; sign out unfamiliar sessions where Amazon provides that control.
- Contact Amazon through its official site if account details were changed or you cannot sign in.
If you entered card information
- Call the card issuer immediately and ask whether the card should be blocked or replaced.
- Dispute unauthorized transactions and monitor statements.
- After securing Amazon, remove the exposed card from the account.
- If you also submitted identity information, consider a fraud alert or credit freeze through the official credit bureaus.
Removing a card from Amazon does not reverse a transaction or guarantee that future misuse is impossible.
If the attacker changed your email or password
Use Amazon’s official login-recovery or customer-service route by navigating to Amazon manually. Do not use contact details in the suspicious message. Secure the email account associated with Amazon: change its password, enable MFA and check for unauthorized forwarding or recovery changes. Then change any reused credentials on other accounts and contact the card issuer separately.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
How to report and preserve evidence
- Forward the suspected forgery to
[email protected]and submit Amazon’s official phishing report. - Report financial loss or attempted fraud to the U.S. Federal Trade Commission at ReportFraud.ftc.gov.
- Notify your bank or card issuer immediately when payment information or transactions are involved.
- Keep the original message and headers, PDF, URLs or domains, screenshots and transaction records before deleting anything.
Bottom-line decision tree
- Received only: Do not interact; verify in the app or on Amazon’s site and report it.
- Clicked: Close it, scan if a file was downloaded, and inspect the account.
- Entered a password: Change it now, change reused copies, enable MFA and review activity.
- Entered card or identity data: Contact the issuer, secure Amazon and consider fraud controls.
- Lost access: Use Amazon’s official recovery path and secure the associated email account.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
