The holiday shopping rush for late 2026 is starting incredibly early, and cybercriminals are already ahead of the game. The Federal Trade Commission issued an urgent alert this week warning consumers about a highly sophisticated “one-click” Amazon gift card scam targeting unsuspecting shoppers.
It starts with a simple email or a text message. The notification looks identical to an official Amazon alert, claiming you have an unclaimed promotional gift card or a holiday reward waiting for you. The hook? A single, tempting button promising to instantly add the funds to your account balance.
But that one click could cost you your entire digital identity.
According to the FTC, this new campaign relies on advanced social engineering and session-hijacking scripts. Instead of just redirecting users to a clumsy, fake login page, these malicious links are designed to steal active browser cookies. Once clicked, the software bypasses two-factor authentication entirely, letting fraudsters hijack the victim’s actual Amazon account in seconds.
How Session Hijacking Works
These session hijacking attacks, often called “adversary-in-the-middle” exploits, are highly dangerous because they render traditional security measures useless. Even if you have a strong, unique password and SMS verification set up, the stolen session cookie tells Amazon’s servers that you have already successfully logged in. The security gate is bypassed entirely, giving attackers immediate access.
“We are seeing a massive shift in how cybercriminals operate,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “They no longer just want your password. They want your active session. Clicking a single link can now give a scammer full control of your shopping account, saved credit cards, and personal data.”
While email remains the primary delivery method, the FTC warns that these malicious links are also spreading rapidly via SMS and direct messages on platforms like WhatsApp and Instagram. Some messages even appear to come from friends whose accounts have already been hacked, adding a layer of trust that makes the trap even harder to spot.
The Growing Financial Toll
The timing of the warning is no coincidence. Retailers are pushing holiday sales earlier than ever in 2026, forcing shoppers to hunt for deals long before the winter holidays actually arrive. Scammers know people are looking for quick ways to save money, making a surprise $100 or $500 gift card offer highly enticing.
Once inside a compromised account, the thieves move fast. They typically drain any existing gift card balances, purchase high-value digital items, or buy physical goods sent to drop addresses. Because the transactions happen from the victim’s own logged-in device session, Amazon’s automated fraud detection systems often fail to flag the suspicious activity immediately.
The financial toll is already mounting. In the first half of this year alone, gift card-related scams drained tens of millions of dollars from American consumers. The FTC fears this new “one-click” technique will cause those numbers to skyrocket as the winter holidays approach.
How to Protect Your Account
Protecting yourself requires breaking old habits. For years, internet users were told to look for bad grammar or spelling mistakes in phishing emails. Today’s scams, however, use perfect branding, convincing logos, and flawless layouts generated by advanced software tools.
Security experts say the safest rule is simple: never click to redeem.
- Go direct: If you receive a notification about an Amazon gift card, ignore the link in the message. Open a new browser tab, go directly to Amazon’s official website, and navigate to your account settings to check your balance.
- Use manual codes: Legitimate gift cards always come with a 15-character claim code that you must type in manually. If there is no code, it is a scam.
- Clear your cache: The FTC advises users to regularly clear their browser cookies and cache. This simple step invalidates old session tokens that hackers might try to exploit.
- Enable alerts: Turn on push-notification alerts for all transactions to catch unauthorized activity before it is too late.
If you believe you have fallen victim to this scam, act immediately. Change your Amazon password from a secure device, log out of all active sessions, and contact your bank to freeze any linked credit cards. You should also report the incident to the FTC at ReportFraud.ftc.gov to help law enforcement track the unfolding campaign. This year, vigilance is your best defense. A single careless click is all it takes to ruin your holiday season before it even begins.
