"Suspicious Amazon purchase": the fake call or text to "cancel" it

"Suspicious Amazon purchase": the fake call or text to "cancel" it

"This is Amazon. An iPhone 16 for $1,899 has been ordered on your account. If you didn't make this purchase, press 1." Or a text: "Unusual order detected on your account. Call us to cancel." Your stomach drops, you press 1 or call back, and a polite "security agent" offers to sort it out. There's no order. It's a scam that uses the name of Amazon (and sometimes Apple, PayPal or a New Zealand retailer) to get your card details, your text codes or remote access to your device.

How does this scam work?

1. The bait. An automated call, a text or a WhatsApp message warns you about an expensive order you don't recognise: a phone, a laptop, a games console, gift cards. The amount is high on purpose, to scare you.
2. The handover to an "agent". If you press a key, call back or tap the link, someone answers claiming to be from the security team or customer service. They often know your name or address from a data breach.
3. The "cancellation". To "cancel the order" or "refund your money" they ask for one of these: your card details to "verify you're the account holder"; the code you're about to receive by text; or that you install a remote-access app (AnyDesk, TeamViewer or similar) so they can "help you".
4. The hit. With your card they make purchases; with the code they authorise payments or add your card to their phone wallet; with remote access they see your screen, read your texts and get into your internet banking. Sometimes they "refund" you too much and ask you to send back the difference.

What are the warning signs?

• They warn you about a purchase you can't see in the shop's official app or website. If the order doesn't appear under "Your orders", it doesn't exist.
• They rush you: "the order ships in 30 minutes", "if you hang up we can't stop it".
• They ask you to install an app to cancel an order. No shop needs to control your device to do that.
• They ask for codes sent by text. Those codes are your signature: anyone asking for them over the phone wants to use them.
• They ask you to pay in order to get money back: gift cards, transfers or "returning the difference".
• The link in the text doesn't go to the official website, but to a lookalike address with extra letters or words.
• The number looks legitimate. Don't trust it: caller ID can be faked, and a familiar name on screen proves nothing.

What do I do right now if they call or the text arrives?

1. Hang up or don't reply. Don't press any key, don't call back the number they give you and don't tap the link.
2. Check for yourself. Open the shop's official app, or type its address into your browser, and look at your orders. If nothing looks odd, you have your answer.
3. If there really is an order you don't recognise, cancel it in the app or contact the shop through the help section of its official website or app, never through the call or text.
4. Don't give out details, codes or passwords, even if the caller knows your name, address or the last digits of your card.
5. Don't install anything that someone who contacted you out of the blue asks you to.
6. Block the number and report it in the spam numbers directory. If it was a text, forward it free to 7726, the Department of Internal Affairs scam-text service.

What if I've already given details or installed the app?

1. Cut the connection. If you installed a remote-access app, end the session, disconnect the device from the internet (flight mode or Wi-Fi off) and uninstall the app.
2. Call your bank now, on the official number on the back of your card or in its app, not one the caller gave you. Ask them to block the card, review recent transactions and, if you logged in to internet banking during the call, block that too.
3. Change your passwords, from another clean device if you can: your email first, then internet banking and your shop account. Turn on two-step verification.
4. Review your shop account: signed-in devices, new delivery addresses, saved cards and gift card balance. Remove anything you don't recognise.
5. Check the device. If someone had remote access, run trusted antivirus and, if in doubt, back up your files and reset the device.
6. Keep the evidence: screenshots of the texts, the number that called, the time, payment receipts and the name of the app you installed.
7. Report it to Police (see below). Your bank will usually ask for the Police reference.

Where do I report it and who can help me?

• NZ Police: report it on 105 or through the 105 online service on the NZ Police website. If you're in immediate danger, call 111.
• The National Cyber Security Centre: report the scam to the NCSC, especially if someone had remote access to your device.
• Consumer Protection: its Scamwatch pages explain impersonation and online shopping scams.
• Your bank, always through its official channels.
• The shop itself: big platforms have a help page for reporting suspicious calls, texts and emails that use their name.

Frequently asked questions

Does Amazon ever call me about a suspicious purchase? Treat any unexpected call about an order as suspicious. Check your orders yourself in the official app or website. A genuine company won't ask you for text codes, card details or remote access over the phone.

I don't have an Amazon account and they called me anyway. Why? Because these calls go out in bulk. Amazon is chosen because so many people use it, not because the scammers know you do.

I only pressed 1 and hung up. Is that a problem? Not really. It may confirm your number is active, so expect more calls. Block the number and don't call back.

I gave them my card details but not the text code. Am I safe? Not completely. Some purchases don't need a code. Call your bank, block the card and get a new one.

In short

The suspicious purchase is the bait; the real target is your card, your codes or your device. Hang up, check your orders yourself in the official app, and never install anything or read out a code. If you've already fallen for it, cut the connection, call your bank, change your passwords and report it to Police and the NCSC. And report the number in the NoCall spam numbers directory.