"Unrecognized Amazon purchase": the fake call or SMS to "cancel" it

"This is the Amazon security department. We have detected a purchase of an iPhone for 1,149 euros on your account. If you did not make this purchase, press 1." Sometimes it's a recorded voice, sometimes a person with a well-rehearsed script, and sometimes it's an SMS with a link to "cancel the order". The name might be Amazon, PayPal, AliExpress, a big department store or any well-known shop. What never changes is the goal: that, in your rush to stop a charge that doesn't exist, you hand over your card details, a code from your bank or control of your phone or computer.

How does this scam work?

The script repeats with few variations:

1. The bait. An automated call, an SMS or a WhatsApp message warns you about an expensive order you don't recognize: a phone, a laptop, a games console, gift cards. The amount is deliberately high so you panic.
2. The handover to an "agent". If you press a key, call back or tap the link, someone answers who introduces themselves as the security team or customer service. They often know your name, and sometimes your address, because that data circulates from old breaches.
3. The "cancellation". To "cancel the purchase" or "refund your money" they ask for one of these:
   • your full card details, "to verify you are the cardholder";
   • the code you've just received by SMS, which actually authorizes a payment or a change in your online banking;
   • that you install a "support" or "remote access" app (AnyDesk, TeamViewer, QuickSupport or similar) so "a technician can fix it";
   • that you log into your online banking "while they watch" to "process the refund".
4. The hit. With your card they make purchases; with the code they authorize payments or add your card to their own phone; with remote access they see your screen, read your SMS and move your money while you think they're helping you.

There's a particularly twisted variant: the fake "over-refund". With remote access, the scammer manipulates what you see on screen so it looks as if you've been refunded 1,000 euros instead of 100, and then anxiously asks you to "send back the difference" by bank transfer or gift cards. There was never any refund: the money you send is your own.

What are the warning signs?

• They warn you about a purchase you can't see in the shop's official app. If the order doesn't appear under "Your orders", it doesn't exist.
• They rush you: "the purchase will be processed in 30 minutes", "if you hang up we won't be able to stop it".
• They ask you to install an app to cancel an order. No shop needs to control your device to cancel a purchase.
• They ask for codes sent by SMS. Those codes are your signature: anyone asking for them over the phone wants to use them.
• They ask you to pay in order to receive money: gift cards, transfers or "sending back the difference".
• The link in the SMS doesn't lead to the official website, but to a similar-looking address with extra letters or words.
• The number looks legitimate. Don't trust it: the number shown on screen can be faked (spoofing), and a familiar name on caller ID proves nothing.

What do I do right now if they call or the SMS arrives?

1. Hang up or don't reply. Don't press any key, don't call back the number they give you and don't tap the link.
2. Check for yourself, on your own. Open the shop's official app or type its address into your browser by hand and check your orders. If nothing looks odd, you have your answer.
3. If there really is an order you don't recognize, cancel it from the app itself or contact the shop through the help section of its official website or app, never through the number given to you by the caller.
4. Don't give out details, codes or passwords, even if the person knows your name, your address or the last digits of your card.
5. Don't install anything that someone who contacted you out of the blue asks you to install.
6. Block the number and report it in the spam number directory to warn other people.

One simple rule sums all this up: if they call you, hang up and call them yourself through a channel you looked up on your own.

What if I've already given details or installed the app?

Act fast and in this order:

1. Cut the connection. If you installed a remote access app, end the session, disconnect the device from the internet (airplane mode or turn off Wi-Fi) and uninstall the app.
2. Call your bank now, on the official number printed on the back of your card or shown in its app, not one the caller gave you. Ask them to block the card, review recent transactions and stop any pending transfer. The sooner you call, the more options there are.
3. Change your passwords, from another clean device if you can: your email first, then online banking and your shop account. Turn on two-step verification.
4. Review your shop account: signed-in devices, new delivery addresses, saved cards and gift card balance. Remove anything you don't recognize.
5. Check the device. If someone had remote access, run a trusted antivirus and, if in doubt, back up your data and reset the device.
6. Keep the evidence: screenshots of the SMS messages, the number that called you, the time, payment receipts and the name of the app you installed.
7. Report it to the police. In Spain, to the Policía Nacional or the Guardia Civil; elsewhere, to your national police. Bring everything above. Your bank will usually ask for a police report to process a claim.

If there have already been charges or transfers, how to get your money back after a phone scam explains the ways to make a claim.

Where do I report it and who can help me?

• Police: in Spain, the Policía Nacional (091) or the Guardia Civil (062), at a police station; elsewhere, your national or local police. If you are in immediate danger, call 112 (the emergency number across the EU) or your country's emergency number.
• Cybersecurity helpline: in Spain, INCIBE's 017, a free and confidential cybersecurity helpline that advises you on what to do with your accounts and devices; elsewhere, your national cybersecurity agency or fraud reporting service.
• OSI (Oficina de Seguridad del Internauta), part of INCIBE in Spain: it publishes alerts about active fraud campaigns, useful to check whether the message you received is already circulating. Many countries have a similar public alerts service.
• Your bank, always through its official channels.
• The shop itself: the big platforms have a section in their help pages for reporting suspicious messages or calls that use their name.

Frequently asked questions

Does Amazon ever call me about a suspicious purchase? A shop may contact you, but it won't ask you over the phone for your card details, codes from your bank or to install remote access software. If in any doubt, hang up and check your orders in the official app.

I don't have an Amazon account and they called me anyway. Why? Because the calls are made in bulk. They use the name of the best-known shop knowing that many people will have an account. The fact that you don't confirms it's a fraud.

I only pressed 1 and hung up. Is that a problem? Usually not. Most likely they've confirmed your number is active and you'll get more attempts. Don't give out any details on later calls and block the numbers.

I gave them my card details but not the SMS code. Am I safe? Not entirely. Call your bank to block the card: with those details they can try purchases at shops that don't require extra verification, and they will call you again to get the code.

In short

A purchase you don't recognize is checked in the shop's official app, never from the call or link that announces it. No one legitimate needs your codes, your card or control of your phone to cancel an order. If you've already fallen for it, cut off access, call your bank, change your passwords and report it. An app like NoCall can warn you that a number has already been reported by other people before you answer, and if you get one of these calls, report it in the NoCall spam number directory: your report helps other people hang up in time.