A New Holiday Threat
Security researchers are sounding the alarm over a sophisticated new phishing campaign targeting shoppers ahead of the 2026 holiday rush. Cybercriminals are using highly convincing, fake Amazon gift card offers to lure victims. Instead of traditional malicious links, however, these attackers are relying on QR codes—a rapidly growing threat vector known as “quishing.”
The timing is no accident. As families prepare for the busiest shopping season of the year, scammers are exploiting the expectation of holiday deals, shipping notifications, and loyalty rewards. The promise of a quick, free balance is often enough to make even cautious internet users let their guard down.
How the ‘Quishing’ Trap Is Sprung
The scam typically begins with an email or, increasingly, a physical postcard delivered to the victim’s mailbox. Decorated with official-looking branding and Amazon’s signature logos, the message congratulates the recipient on winning a holiday reward—often a gift card worth $100 or $250. To claim the funds, the user is instructed to scan a large QR code prominent on the page.
Once scanned with a smartphone, the QR code redirects the victim to a meticulously designed, spoofed Amazon login page. To the untrained eye, the site looks identical to the official retail portal. If the victim enters their credentials, they unknowingly hand their account access over to hackers.
Why Attackers Are Swapping Links for QR Codes
The shift to QR codes is a deliberate evasion tactic. Standard security filters installed by email providers are highly effective at scanning text and analyzing hyperlinks for known malicious patterns. However, these automated scanners struggle to read and interpret destination URLs embedded inside images like QR codes.
“QR codes act as a blind spot for many traditional email defense systems,” says Marcus Vance, a lead threat researcher at cybersecurity firm NetGuard. “By moving the transaction from a secure computer to a personal smartphone, hackers successfully bypass the corporate or home network filters designed to keep users safe.”
Worse, these fake portals are built to bypass multi-factor authentication (MFA). When a victim inputs their login information, the phishing site triggers a real-time request to the actual Amazon platform. The victim is then prompted to enter their MFA one-time passcode on the fake site. The scammers capture this code instantly, giving them full access to the account before the victim even realizes they have been tricked.
How to Stay Safe This Shopping Season
As the shopping season ramps up, cybersecurity experts urge consumers to remain highly skeptical of unsolicited offers. Protecting yourself requires a few basic shifts in online behavior:
- Avoid scanning unknown QR codes: If an offer sounds too good to be true, it almost certainly is. Legitimate companies rarely require customers to scan QR codes to redeem gift balances.
- Go directly to the source: If you receive a notification about an Amazon gift card or promotion, open your web browser, type Amazon’s official address manually, and log in to check your account message center.
- Check sender details: Look past the display name of emails. Scammers often use names like “Amazon Support” but the actual email address behind it is a string of random characters or a hijacked domain.
- Use a password manager: Reliable password managers detect the actual domain of a website. If you are on a spoofed site, the manager will not offer to autofill your credentials.
With holiday shopping activity expected to break records this year, staying alert is the best defense. A moment’s hesitation before scanning a code can mean the difference between a happy holiday and a compromised digital identity.
