Amazon fraud email: how to spot it and what to do

When a suspected Amazon email is harder to identify

Some fraudulent Amazon emails include accurate personal details such as your name, a real order number, or a shipping address. Attackers purchase this data from brokers or acquire it through previous breaches. Correct personal information does not confirm an email is legitimate.

An email that passes your spam filter is also not automatically genuine. Spam filters score on many signals; a message can clear them while still carrying a fraudulent link. Beyond the account-verification step, the most direct additional evidence is the email's Authentication-Results header.

Reading the Authentication-Results header

Every delivered message carries authentication metadata in its headers. The Authentication-Results field, defined in RFC 8601, records the outcome of SPF, DKIM, and DMARC checks performed by the receiving mail server for that specific message.

A message from a legitimate sending path will generally produce results like this illustrative example:

Authentication-Results: mx.example.com;
  dkim=pass header.d=yourdomain.com header.s=selector1 header.b=Abc12345;
  spf=pass smtp.mailfrom=noreply@yourdomain.com;
  dmarc=pass header.from=yourdomain.com

A fraudulent message spoofing a trusted domain will typically show one or more failures:

Authentication-Results: mx.example.com;
  dkim=fail header.d=yourdomain.com;
  spf=fail smtp.mailfrom=noreply@lookalike-yourdomain.example;
  dmarc=fail (dis=QUARANTINE) header.from=yourdomain.com

These are illustrative examples only. Exact field values follow RFC 8601 and vary by sending path and receiving server. A dmarc=fail result is strong evidence that the message did not originate from an authorized sending path for that domain. A dmarc=pass result means the message passed alignment checks for that domain, though it does not rule out social-engineering content within the message body.

To inspect the full headers of a suspicious email, copy the raw header block and run it through the email header analyzer.

What to do with a suspected Amazon fraud email

Do not click any link or download any attachment

Do not click links, tap buttons, download attachments, or scan QR codes from the email. If you need to reach Amazon, type amazon.com directly into your browser address bar.

Verify by logging into your account

Go to amazon.com in a fresh browser tab and sign in. Check your order history and account notifications for the same message. Amazon records legitimate communications in your account. If the message does not appear anywhere in your account, it is fraudulent.

Report it

The exact steps for reporting an Amazon phishing email to Amazon and to federal authorities are at Amazon report phishing email. Reporting helps Amazon's security team identify active campaigns and take action against the domains being used.

Act immediately if you already clicked

If you clicked a link and entered your Amazon password, change it immediately at amazon.com. Check whether any orders were placed, any payment methods were added, or any account details were changed. Enable two-factor authentication if it is not already active.

If your domain is being impersonated the same way

The technique used in Amazon fraud emails works against any domain that has not published a DMARC enforcement policy. Attackers can forge the From header to show your domain as the sender. Without p=quarantine or p=reject in your DMARC record, receiving servers have no DMARC-based reason to reject those messages.

If your domain is being impersonated, the DMARC learning hub covers how to inventory your legitimate sending sources, validate SPF and DKIM alignment for each, and move safely toward an enforcement policy. The authentication setup for senders using Amazon SES specifically is covered in why are Amazon SES emails going to spam.

Palisade analyzes DMARC aggregate report data to identify which sending sources pass alignment and which fail, then creates prioritized remediation tickets so your team knows what to fix before tightening policy. Start with Palisade to monitor aggregate report data for your domain.

Inspect a suspicious email's authentication results

Paste the full header block from the suspected Amazon fraud email into the email header analyzer to see the SPF, DKIM, and DMARC outcome recorded by the receiving server. Compare the authentication results with the illustrative patterns above.

Analyze the email headers

Header analysis shows what the receiving server recorded about one message. It cannot confirm whether a future message is genuine, whether the sending domain has been blocklisted, or what action Amazon's security team will take on the report.