The holiday shopping rush is still weeks away, but cybercriminals are already setting their traps. Security researchers have flagged a highly sophisticated phishing campaign targeting Amazon users. This isn’t your average password-stealing scam. It specifically targets gift card redemptions and, crucially, bypasses multi-factor authentication (MFA).
If you think your account is safe because you have two-step verification enabled, think again. This new wave of attacks relies on a technique known as Adversary-in-the-Middle (AitM). It is highly effective, incredibly fast, and very difficult for the untrained eye to spot.
Here is how the threat unfolds, and what you need to do to protect your wallet before the seasonal chaos begins.
The Bait: Fake Gift Card Claims
The scam usually starts with an email or a text message. It looks official, complete with Amazon branding and formatting. The message might promise a surprise $100 gift card, or it might warn that a gift card you recently purchased has been flagged for suspicious activity.
To “claim” or “verify” the funds, you are urged to click a link. That link leads to a spoofed Amazon login page. It looks identical to the real deal, right down to the legal footers and help links.
This is where the trap snaps shut.
Under the Hood: How the MFA Bypass Works
When you enter your username and password, you aren’t actually logging into Amazon. Instead, you are sending your details to a server controlled by the hackers. But the scammers don’t just take your password and run. They need your MFA code to get in.
In a standard phishing setup, hackers try to log in later, only to get blocked by the two-step verification prompt. The AitM method solves this problem for them. The phishing site acts as a proxy. As you type your credentials into the fake site, the hacker’s server automatically sends them to the real Amazon login page in real-time.
Amazon then detects a legitimate login attempt and sends a one-time passcode to your phone or authenticator app. You, believing you are on the real Amazon site, type that code into the fake page. The hacker’s server grabs the code, passes it to the real Amazon site, and logs in.
Once inside, the scammers don’t just change your password. They steal your session cookie. This digital token tells Amazon’s servers that you are already logged in and verified. With this cookie, the hackers can bypass future MFA prompts entirely. They quickly navigate to the gift card redemption page, drain any existing balances, or use your saved payment methods to buy high-value digital gift cards and send them to untraceable accounts.
Why This Scam is Exploding Ahead of the Holidays
Why are security experts sounding the alarm right now? The timing is deliberate.
“Scammers love the pre-holiday rush,” says Marcus Vance, a senior cybersecurity analyst. “People are distracted, they are expecting packages, and they are actively looking for deals and gift cards. They are much more likely to click on a link without double-checking the URL.”
Gift cards are particularly attractive to thieves. Unlike physical goods, which require a shipping address and leave a paper trail, digital gift card codes can be liquidated in seconds. Once a code is redeemed on a burner account or sold on a third-party marketplace, the money is gone forever. Amazon rarely refunds balances lost to phishing.
How to Shield Your Account
Fortunately, you don’t have to be a tech genius to protect yourself. A few simple habits can render these sophisticated attacks useless.
- Never click direct links: If you actually have a gift card to redeem, go to Amazon.com directly by typing the address into your browser. Navigate to your account settings and redeem the code there.
- Use a password manager: Password managers are one of the best defenses against AitM attacks. Because they rely on the exact domain name to autofill credentials, they will refuse to enter your password on a spoofed site, even if it looks identical to the real Amazon.
- Upgrade your MFA: SMS codes and authenticator apps are vulnerable to proxy attacks. If you want maximum security, switch to physical security keys (like a YubiKey) that support FIDO2 standards. These keys require cryptographic proof that you are on the actual, legitimate website before granting access, making AitM bypasses virtually impossible.
As the holiday shopping season kicks off, vigilance is your best defense. Don’t let a fake claim code ruin your festive season.
