Back to Amazon Product Recall Smishing Scam

This is a version of Amazon Product Recall Smishing Scam.

Amazon Risk Management Team: Product Recall Refund SMS

A mass-sent iMessage/SMS impersonates Amazon's "Risk Management Team," claiming that an item from the recipient's January 2026 purchase (Order No. 115-7293846-5401927) has been recalled under 2026 safety requirements. The message urges the victim to visit a shortened link to complete a refund. The link routes through k6b1q4.co to v2k9a.shop, which serves a fake human-verification page and then a polished counterfeit Amazon sign-in page titled "Awazen - Shopping." Bots and security scanners are silently redirected to a series of generic shopping surveys, allowing the phishing page to avoid automated detection.

Amazon Risk Management Team: Product Recall Refund SMS | Screenshot

What’s different in this version

These traits set this message apart from the usual pattern.

  1. Uses a product recall (rather than a delivery failure or payment issue) as the urgency trigger — less commonly seen in Amazon smishing.

  2. Includes a plausible-format Amazon order number (115-7293846-5401927) to appear legitimate.

  3. Excessive and mismatched emojis (🥌🧸👏🤝📂🧥) are a hallmark tell — legitimate Amazon notices do not use decorative emojis.

  4. Bot-detection gate: security scanners receive harmless shopping surveys; only real users see the phishing login page.

  5. Fake login domain 'v2k9a.shop' uses the path '/ap/signin' to mimic Amazon's real login URL pattern (amazon.com/ap/signin).

  6. Page title reads 'Awazen - Shopping' — a near-anagram of 'Amazon' used to evade brand-name detection.

  7. Sent via iMessage (SMS/MMS), enabling blue-bubble delivery which may seem more trustworthy to Apple users.

How this scam works

  1. 1

    Step 1: Victim receives an iMessage or SMS claiming to be from Amazon Risk Management, stating that an item from a recent order has been recalled and a refund must be processed urgently.

  2. 2

    Step 2: A fake but realistic-looking order number is included (e.g., 115-7293846-5401927) to create the appearance of a legitimate notice.

  3. 3

    Step 3: The victim clicks a shortened URL (e.g., k6b1q4.co) that redirects to the scammer's infrastructure.

  4. 4

    Step 4: A fake 'Human Verification' page (mimicking a reCAPTCHA-style checkbox) filters out security bots before revealing the phishing payload.

  5. 5

    Step 5: The victim lands on a counterfeit Amazon login page (hosted on a non-Amazon domain like v2k9a.shop) that closely copies Amazon's sign-in interface, asking for their email or mobile number.

  6. 6

    Step 6: After entering their email, the victim is prompted for their password — credentials are silently sent to the scammers.

  7. 7

    Step 7: Bots and scanners are served harmless shopping surveys instead of the phishing page, helping the scam evade automated takedowns.

✓ Do this

  • Log in to Amazon directly at amazon.com by typing the address into your browser — never via a link in a text or email.
  • Check your real order history in the Amazon app or website to verify any recall claims.
  • Report suspicious texts to Amazon at stop-spoofing@amazon.com and to the FTC at reportfraud.ftc.gov.
  • Forward the message to 7726 (SPAM) to report it to your mobile carrier.
  • If you entered credentials on a fake site, change your Amazon password immediately and enable two-factor authentication.

✗ Avoid this

  • Never click links in unsolicited text messages claiming to be from Amazon, even if they include a real-looking order number.
  • Do not trust a 'Human Verification' checkpoint on a site you reached from a text — it is a filter to hide phishing from security researchers.
  • Never enter your Amazon login on any domain other than amazon.com.
  • Do not assume emojis or friendly language in a text make it legitimate.
  • Do not reply to the text — even a 'STOP' reply confirms your number is active.

Verbatim excerpts from the scam

Exact lines from emails or messages—searchable text so you can compare wording.

  1. 1 Excerpt 1
    🥌 🧸 Amazon Product Recall Notice Dear Customer, We appreciate your👏 continued support. Based on updated 2026 safety requirements, an item from your January 2026 purchase (Order No.: 115-7293846-5401927) is now included in a recall. For your safety, please stop using the product and complete the refund process promptly. To access full details, please visit the official link🤝 below: https://k6b1q4.co/Ud3b5T1C?ZCYI=YqMJpG 📂 We apologize for any inconvenience caused. Your safety remains our highest priority. Sincerely, Amazon Risk Management Team 🧥