When Dan Landau ordered a portable photo printer from Amazon.com Inc., he expected the confirmation email to tell him what was on its way. Instead, he was notified that his “luggage” was coming. In another instance, the 38-year-old head of marketing for a venture capital firm ordered items to maintain his pool and was confused when the company labeled them three different ways: “Decor,” “Outdoors” and “Garden.”
“The categories are very vague, and they seem to have little to do with what is actually being ordered,” he said.
Landau isn't the only one expressing bafflement. In recent weeks, Amazon customers on TikTok and Reddit have also wondered why product names and images were replaced with labels such as “Household item” or “Essentials item” in order confirmation emails.
An Amazon spokesperson said the company simplified the information to direct customers back to its app and website in an effort “to further improve” their privacy by reducing “customer information shared outside” of Amazon.
But critics say the emails can be so vague, and sometimes so far removed from the actual product, that they become less useful for telling customers what's being shipped, and more useful to scammers looking for a template to launch phishing attacks.
Arun Vishwanath, founder of the Cyber Hygiene Academy, says the change is essentially asking shoppers to trade privacy for security and could spur impersonation attempts.
“It's definitely not in the best interest of customers,” said Vishwanath, who also advises the National Security Agency's research-focused Science of Security & Privacy directorate. “If anything, it increases risk.”
Phishing attacks often mirror official emails and trick people into clicking on a bogus link that might contain malware or request login credentials. Vishwanath says Amazon's new confirmation emails could encourage users to click on links without verifying who sent them.
Last year, Americans reported $3.5 billion in losses from so-called imposter scams, according to the Federal Trade Commission. The agency said that in 2023 it received about 34,000 reports of scammers pretending to be Amazon, the second-most impersonated company after Best Buy/Geek Squad.
Without directly addressing cybersecurity concerns, the Amazon spokesperson said the new email format was designed to make authentic messages from the company easily identifiable.
But Erich Kron, an adviser to Knowbe4, a firm that trains people to avoid phishing and other attacks, said the change itself could attract scammers.
“Anytime some change like this happens, bad actors are going to jump on it and they're going to use that change and things that people aren't used to, to help us make mistakes,” he said.
In cases where consumers don't receive Amazon app notifications to corroborate their purchases, an email may be the only immediate indication that an order has shipped. But when the message no longer details what they ordered, they may be more inclined to follow email links — including ones sent by scammers, Kron said.
“It's never been safe to just click on random links in emails, even if it does look kind of like it comes from Amazon,” he said. Kron said it's typical for phishers to practice “credential stuffing,” a method often used by Amazon scammers who feed purloined usernames and passwords in a tool that automatically searches banks, credit card companies and other large retailers for a match.
Standard security practices can help spot phishing attempts, such as hovering over a link with a computer mouse if browsing from a desktop. But that safeguard is harder to use on a cellphone, where Amazon notifications are most likely to appear. On a phone, it is less likely that when clicking a link, a preview will pop up allowing users to confirm the link leads directly to Amazon's platform.
Abnormal AI, a security company that uses artificial intelligence to help companies prevent phishing attacks, said it has not yet seen conclusive data showing a spike in scams since Amazon stopped providing specific product information in its order confirmation emails. But, echoing other cybersecurity experts, the firm said the new format could make it easier to carry out such attacks.
(This story has not been edited by NDTV staff and is auto-generated from a syndicated feed.)
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.
