You open your email and see an invoice from Amazon. It says you bought a new iPad for nearly $1,000. The order has supposedly shipped, and your payment has already gone through. There’s even a customer support number to call if something looks wrong. Your first reaction might be to grab your phone and stop the charge. That’s exactly what makes this fake Amazon invoice scam so dangerous. It uses a realistic-looking receipt and an expensive purchase to make you worry about your money. Then it offers what appears to be an easy solution. Matt, who lives in California, recently sent us one of these suspicious emails. He wanted to help others recognize the warning signs before someone falls for the same trick. After examining the message, we found several clues worth sharing.
Missed CyberGuy LIVE? Watch the replay and discover 5 ways to travel smarter and save money.
Our free CyberGuy LIVE class, 5 Ways to Travel Smarter and Save Money, has ended, but you can still watch the full replay. Kurt “CyberGuy” Knutsson walks you through five practical ways to protect your phone and personal information, avoid common travel scams, find better deals, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.
Watch the free replay + downloadable checklist now at CyberGuyLive.com.
DO NOT CLICK FAKE ‘ACCOUNT RECOVERY’ AMAZON EMAIL
Matt received the email on Oct. 28. Its subject line addressed him by name and claimed his order had already left the facility. Inside was a professionally formatted invoice featuring Amazon’s familiar logo. The invoice listed an Apple iPad Air 11-inch (M4) with 256GB of storage and cellular connectivity. It showed a price of $973.19. Below that was an additional $14.99 charge labeled “Amazon Protect+ (Auto-Renew).” The grand total came to $988.18.
The document also included an invoice number, shipping details and a delivery date. It even displayed Amazon’s corporate address in Seattle. All those details helped create the appearance of a legitimate transaction. However, the email also included a phone number for canceling or modifying the order. That number appeared prominently near the top, again in the payment instructions and once more at the bottom. That’s where the real concern begins. The message appears designed to make someone call before checking whether the purchase actually happened.
Let’s look at the warning signs hiding in Matt’s email. Some are obvious once you notice them. Others are more subtle and help explain why these scams can fool people.
This is the biggest giveaway. The email claimed to come from someone named Jack Campos. However, the actual sender address used Outlook.com with a different personal name embedded in the address. It had no apparent connection to Amazon. Amazon says its legitimate customer emails come from Amazon domains, including amazon.com. A personal Outlook account claiming to send an official Amazon invoice deserves immediate suspicion. Scammers can write almost anything in the sender’s display name. That’s why I always recommend checking the actual email address before trusting a message.
The invoice displayed the same customer support number in three separate locations. It appeared inside a shaded banner, within the payment instructions and again near the bottom. That’s a significant warning sign because the email steers the recipient toward making a phone call. Rather than directing Matt to verify the purchase through his Amazon account, it emphasizes contacting the number printed on the invoice. That number should be treated as unverified and potentially controlled by scammers. We have not independently established who operates it. Amazon warns that fraudulent order confirmations often encourage customers to contact supposed support representatives. Those calls can turn into attempts to obtain payment information or gain access to an account.
Look at the amount: $988.18. That’s enough money to get almost anyone’s attention. If you saw that charge for a product you didn’t buy, you’d probably want to fix it immediately. Scammers understand that reaction. They often choose expensive electronics because the potential financial loss feels serious. The detailed iPad description makes the transaction appear more believable. However, the amount on an email invoice proves nothing about your actual bank account. Until you verify the charge independently, treat it as an unsupported claim.
Here’s a detail I find especially revealing. The subject line claims the order has already left the facility. Yet the invoice says cancellations are accepted only before dispatch. So which is it? Has the package already shipped, or can the customer still cancel it? The conflicting language creates confusion while encouraging the recipient to seek help quickly. A concerned shopper may decide to call the listed number rather than spend time figuring out the inconsistency.
The email addresses Matt by name in the subject line. However, the billing section identifies the customer as “Amazon Account Holder.” The invoice also lacks a clear, personalized billing and shipping address. Instead, it provides broad fulfillment details and an estimated delivery date. Generic customer information alone doesn’t prove fraud. Still, it raises questions when an email claims to document a completed purchase worth nearly $1,000. If the order were genuine, Matt should be able to locate its actual details inside his Amazon account.
The invoice uses terms such as “Standard Account Allocation” and “active ledger.” It also claims the authorization has been verified and automated order fulfillment is underway. Those phrases may sound official, but they provide little useful information about how the payment occurred. The email never gives Matt a reliable way to verify the transaction through his account. Scammers sometimes use corporate-sounding language to make a document seem authoritative. Don’t assume unfamiliar financial terminology means the message came from a legitimate company.
Alongside the iPad, the invoice lists “Amazon Protect+ (Auto-Renew)” for $14.99. An unexpected recurring charge can create another reason for someone to contact support. Even if they aren’t immediately concerned about the iPad, they might worry about paying for a subscription they never requested. The label alone doesn’t establish whether the service exists or whether Matt was actually charged. However, any unfamiliar subscription on an unexpected invoice deserves verification through the company’s official website.
The document features an invoice identifier beginning with “AMZ” followed by additional letters and numbers. It looks technical enough to seem convincing. However, scammers can generate invoice numbers as easily as they can copy a company logo. An unfamiliar invoice identifier should never replace independent verification. Check Amazon’s Your Orders section for a matching purchase instead.
The invoice shows October 28, 2026, as both the order date and estimated delivery date. It also claims that fulfillment has already moved forward. Same-day delivery can happen with legitimate Amazon orders, so that detail alone doesn’t establish fraud. Still, the message offers no independently verifiable tracking information. It relies on its own claims about shipment and delivery. The document also lists zero estimated sales tax on the nearly $1,000 transaction. That may have a legitimate explanation depending on the circumstances. However, it adds another detail worth comparing with a real order record.
Here’s one of the more interesting details. The invoice includes the Amazon logo and lists Amazon.com Services LLC at 410 Terry Avenue North in Seattle, Washington. That address corresponds to an actual Amazon corporate location. This helps explain why the invoice can look credible. Scammers don’t have to invent every detail. They can copy real company information and place it inside a fraudulent document. A legitimate address on a receipt doesn’t authenticate the sender. The same goes for company logos and polished formatting.
IDENTITY THIEVES DON’T NEED YOUR PASSWORD ANYMORE; HERE ARE 6 NEW ACCOUNT TAKEOVER THREATS
The likely goal of this type of scam is to move you from an email conversation to a phone call. Once someone calls, a person posing as customer support may offer to cancel the purchase or reverse the charge. To complete that supposed refund, they might request payment details or account verification information. Some scammers also ask victims to install remote-access software. They may claim the installation is necessary to resolve a billing problem. In reality, that software could give a stranger access to the person’s computer.
Amazon specifically warns that its representatives will never ask you to share a one-time password over the phone. The company also cautions customers against providing financial details or granting unexpected remote access. These are documented tactics in Amazon impersonation scams. We haven’t established what would happen if someone called the particular number in Matt’s email. The most important point is that receiving a fake invoice does not mean you’ve actually been charged.
“Scammers that attempt to impersonate Amazon put consumers at risk,” an Amazon spokesperson told CyberGuy. “We will continue to invest in protecting consumers and educating the public on scam avoidance. We encourage consumers to report suspected scams to us so that we can protect their accounts and refer bad actors to law enforcement to help keep consumers safe. Please visit our help pages to find additional information on how to identify scams and report them at amazon.com/ReportAScam.”
If an unexpected Amazon invoice lands in your inbox, don’t rush to cancel the order or call the number provided. A few simple checks can help you determine whether the purchase is real. And if you’ve already contacted the supposed support team, there are steps you can take to protect your information.
Open the official Amazon app or type Amazon.com into your browser. Select Your Orders and look for the alleged purchase. Avoid using links or phone numbers in the suspicious email. Going directly to your account helps you determine whether the order actually exists.
Sign in to your Amazon account and look for Your Messages or Message Center under your account options. Amazon says authentic customer emails appear there. When a suspicious message doesn’t appear, that’s another reason to question its legitimacy.
Expand the sender details instead of trusting the name displayed in your inbox. Scammers can make an email appear to come from Amazon while sending it through a personal account. Be especially suspicious of unfamiliar domains or addresses that have no connection to the company.
A fake customer support number can connect you directly to a scammer. Instead, find customer service through Amazon’s official app or website. Remember, the person who sent the questionable invoice also supplied that phone number.
Amazon now lets U.S. customers use Alexa for Shopping on Amazon.com or in the Amazon Shopping app to check suspicious emails, texts and phone calls. Simply ask, “Is this email from Amazon?” and provide details about the message. The tool checks the information against Amazon’s records to determine whether the communication came from the company. If it can’t verify the message, it will let you know. You can also forward suspicious emails to verify@amazon.com for verification.
Never share your Amazon password or one-time security codes with someone who contacts you unexpectedly. Consider setting up a passkey or enabling two-step verification for additional protection. These safeguards can make unauthorized account access more difficult, even when someone obtains your password.
Strong antivirus protection can help detect malicious links, unsafe websites and harmful downloads that scammers may use to steal information. Choose reputable security software with real-time protection and keep it updated. While antivirus software cannot prevent someone from being tricked over the phone, it adds protection against other threats that often accompany scams. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.
Review your bank and credit card transactions through their official apps or websites. Look for unfamiliar purchases or charges that don’t match your records. Contact your financial institution immediately if you discover unauthorized activity. You can also enable transaction alerts to help catch suspicious charges sooner.
Scammers may use personal information found on data broker websites to make fraudulent emails more convincing. A personal data removal service can help remove your name, address, phone number and other details from covered people-search sites. Although these services cannot prevent every scam email, reducing your online exposure can make it harder for criminals to research and target you. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com
Identity theft protection services can help monitor certain types of suspicious activity involving your personal information. Depending on the plan, you may receive alerts about unfamiliar credit activity or signs of identity misuse. Some services also offer professional restoration assistance if your identity becomes compromised. These protections can provide valuable support when criminals obtain sensitive information, although no service can detect every type of fraud. See my tips and best picks on Best Identity Theft Protection at CyberGuy.com.
Visit Amazon’s official scam reporting page to report the message. You can also report attempted fraud to the Federal Trade Commission at reportfraud.ftc.gov/. Amazon recommends that people without an Amazon account forward suspicious communications as an attachment to reportascam@amazon.com. Reporting these attempts helps companies and authorities identify fraudulent activity.
For additional protection, we’ve also covered how Amazon alerts customers about impersonation scams and the precautions the company recommends.
Already called the number on a suspicious Amazon invoice? Your next steps depend on what information you shared and whether you gave anyone access to your device. Here’s how to protect yourself.
The sooner you act, the better your chances of preventing additional damage. Even a short conversation with a scammer deserves attention if you shared personal information or allowed access to your device.
I appreciate Matt taking the time to share this email with us. It’s a good reminder of how much effort scammers put into making fraudulent communications look credible. What caught my attention was the combination of a detailed invoice and that repeatedly displayed phone number. The message creates concern about a large purchase, then conveniently offers a way to fix it. That’s where people can get pulled into a scam before they realize what’s happening. And here’s something worth remembering: You don’t have to spot every strange detail on an invoice to protect yourself. You only need to recognize that an unexpected charge deserves independent verification. The lesson I take from Matt’s experience is simple. Don’t let a scary email decide whom you call or how quickly you act. Check your account through an official channel before you give anyone access to your money or personal information. I’m glad Matt reached out because sharing these examples gives more people a chance to recognize the warning signs.
Have you received a convincing fake Amazon invoice or spoken to someone pretending to be customer support? Tell us what happened by writing to us at CyberGuy.com. Your experience could help someone else avoid becoming a victim.
Sign up for my FREE CyberGuy Newsletter
Copyright 2026 CyberGuy.com. All rights reserved.