If an Email or Text Claims to Be Amazon: Don't Open the Link, Check in the Official App or Your Own Bookmark — About One in Three Phishing Reports in September Imitated Amazon

If an email or text claims to be from Amazon, do not open the link in it. Open Amazon's official app, or a bookmark you saved yourself, and check there. In its report for September 2026, published on October 19, the Council of Anti-Phishing Japan said that of the 94,661 phishing reports it received, about 33.2% imitated Amazon, and that this share is rising.

How to read the number: this is a count of "reports" sent to the Council, not the total number of fake emails that reached people. Even so, about one third of reports concentrating on a single brand name means fakes imitating Amazon are being reported in large numbers, and it is realistic to prepare for that.

One more thing to be careful about. The Council notes that many data-breach announcements came out in September, and that phishing emails that include the recipient's name have been seen. It says the link to any particular breach is unknown. A correct name is not proof that a message is genuine.

Phishing reports for September 2026 (Council of Anti-Phishing Japan)

• ▸Reports: 94,661. Up 12,323 from the previous month, about 15.0%. Unique phishing-site URLs were 49,032, up about 23.2%
• ▸Brands imitated: Amazon about 33.2% (rising) and Apple about 11.1% (falling). Next most reported were Saison Card, American Express and the National Tax Agency. The top five brands made up about 65.3%
• ▸By sector: e-commerce about 47.9% and credit/card about 35.0%, both rising
• ▸Number of brands: 105 brands were abused. 13 brands each drew 1,000 or more reports, together about 87.9% of the total
• ▸Pushing apps: emails posing as app updates or application procedures, leading to the installation of malicious apps, are surging. Android-oriented messages were seen, imitating the National Tax Agency, card companies and various online services

How the scheme runs

• ▸① An email or text arrives: under a well-known brand name, urging you to log in or complete a procedure. It may include your name
• ▸② The link leads to a fake page: a screen made to look genuine. The Council reports that amazonaws.com made up about 11.6% of reported URLs, and that domains of legitimate services such as docs.google.com, windows.net and sendgrid.net were also widely used
• ▸③ You are made to enter information: credit card information, mobile phone number, authentication code, bank account details, one-time passwords and the like
• ▸④ It is misused: the Council explains that stolen credentials are used illegally

Change the entrance instead of trying to spot fakes (the Council's guidance)

• ▸Do not open links in emails or texts. The Council lists "access services through the official site or app" and "do not enter personal information right away"
• ▸Open official sites from a bookmark or similar. Install apps from the official store. In its September report the Council asks you to update apps through your phone settings or the official store, and not to download directly from an email link
• ▸Use a password manager. The Council explains that a password manager fills in your ID and password only on the genuine sites you registered, so it does not react to a fake site. If nothing is filled in automatically, that is a reason to suspect the site (this last sentence is our own addition)
• ▸Set up passkeys and multi-factor authentication. Even if a password is stolen, it is harder to use at once. The Council recommends phishing-resistant authentication such as passkeys
• ▸Stop and think before you enter anything. If you are asked for card details, a phone number, an authentication code, bank account details or a one-time password, confirm that the procedure is really needed

Note: this article cannot tell you whether an email you hold right now is genuine or fake. Because it cannot be judged, we recommend checking in the official app without opening the link. If the same notice is not in the official app either, confirm with the service's inquiry desk.

What you can do today

• ✓★Install the official apps for the services you use often (Amazon and others) and make bookmarks. From now on, check only from there
• ✓★Start using a password manager. It is available in phone apps and browsers. If it does not fill in automatically on a site, stop entering data
• ✓Set up passkeys wherever a service supports them. For those that do not, turn on multi-factor authentication
• ✓Use a different password for each service. Stop reusing them
• ✓Turn on spam filters and SMS filters.
• ✓Report suspicious emails and texts to the service's inquiry desk or to the Council of Anti-Phishing Japan (info@antiphishing.jp)

If you entered information (the Council's guidance)

• ✓If you entered an ID and password, change the password from the official app or site. Then check the access history, and if anything looks suspicious, contact that service's support center. Change the same password on any other service where you reuse it
• ✓If you see card charges you don't recognize, contact your card company and ask it to suspend and reissue the card.
• ✓If you can no longer log in after entering your ID and password, reset the password and contact support.
• ✓Where to ask in Japan: Consumer Hotline 188 (connects to your local consumer center). To consult the police, the police consultation line #9110. If damage is ongoing, such as an unauthorized transfer, call 110

Three lines to share with family

• ▸About one third (33.2%) of phishing reports imitate Amazon (Council of Anti-Phishing Japan, September). Fake emails that include your name are also appearing
• ▸★Do not open the link in an email or text that claims to be from Amazon or similar. Check in the official app or your own bookmark.
• ▸If you entered information, change the password from the official app and tell your card company. In Japan, ask Consumer Hotline 188 or the police line #9110

Pages we relied on