$12.5B
FTC-reported fraud losses in 2024
FTC says consumers reported losing $12.5 billion to fraud in 2024.
Amazon Web Services phishing scam
Phishing emails impersonate AWS, claiming account suspension, billing issues, or security alerts, directing cloud service users to fake login portals that steal credentials and compromise business infrastructure.
“impersonation scam”
↑ 604%Key indicators
Usually targetsDevelopers
Often hitsFreelancers and contractors
Common regionUnited States
Last updated2026-04-04
Estimated impact
$1.4K
median reported loss
Typical range$90 – $18K
Recovery rate~15%
Annual reports330,000
Scam breakdown
1
Scammers send emails mimicking AWS notifications about billing failures, security events, or account verification requirements.
2
The phishing link leads to a convincing replica of the AWS console login page that captures IAM credentials and MFA codes.
3
Compromised AWS credentials are used to spin up cryptocurrency mining instances, exfiltrate stored data, or launch further attacks.
What to do first
Never click links in AWS notification emails — go directly to the AWS Management Console at console.aws.amazon.com.
Related terms
AWS phishing emailfake AWS billing alertAWS account suspension scamBrand impersonation scamsAmazonSurgingDevelopersIT professionalsSmall business ownersFreelancers and contractorsSmall business ownersTech workers and developersUnited StatesUnited KingdomIndiaAWS phishing emailfake AWS billing alert
Real-world example
How this scam plays out in practice
Based on reported patterns. Names and details are illustrative.
The setup
Lisa, 35, a developers, encountered what appeared to be a legitimate brand impersonation scams situation while using Amazon. Scammers send emails mimicking AWS notifications about billing failures, security events, or account verification requirements.
Step 2
What happened next was calculated: The phishing link leads to a convincing replica of the AWS console login page that captures IAM credentials and MFA codes.
Step 3
The pressure escalated quickly: Compromised AWS credentials are used to spin up cryptocurrency mining instances, exfiltrate stored data, or launch further attacks.
The outcome
Lisa realized something was wrong when an email claims your aws account will be suspended unless you verify billing details immediately. By that point, significant damage had already been done — money sent, personal information shared, or trust exploited.
The lesson
Never click links in AWS notification emails — go directly to the AWS Management Console at console.aws.amazon.com. Lisa's experience shows why an email claims your aws account will be suspended unless you verify billing details immediately and the login url is not aws.amazon.com — it uses lookalike domains or ip addresses are the clearest early warning signs.
How to identify it
- An email claims your AWS account will be suspended unless you verify billing details immediately
- The login URL is not aws.amazon.com — it uses lookalike domains or IP addresses
- The email demands immediate action and threatens data deletion or service termination
- Pause before paying, clicking, or sharing information. Scammers rely on speed.
- Verify the sender, company, or agency using a phone number or website you already know is legitimate.
- Treat secrecy, urgency, and off-platform payment requests as strong scam signals.
What to do now
- ✓Never click links in AWS notification emails — go directly to the AWS Management Console at console.aws.amazon.com.
- ✓Enable MFA on all AWS IAM accounts and use AWS Organizations with service control policies.
- ✓Report AWS phishing to [email protected] and review CloudTrail logs for unauthorized access.
What to save before reporting
- ✓Save the message, profile, phone number, email, or URL that was used.
- ✓Keep payment confirmations, receipts, and account alerts before you dispute or delete anything.
- ✓Write down the timeline while the details are still fresh.
How big is this problem
You are not alone — this scam affects millions of people.
These numbers come from government agencies and official reports. If you have been affected, know that this is a widespread problem — not something that only happens to careless people.
FTC 2024 fraud losses
Imposters
Most common FTC fraud category in 2024
FTC says imposter scams remained the most commonly reported fraud category in 2024.
History and evolution
- This scam family tends to persist because the social-engineering pressure works even when the exact scripts, platforms, and payment methods change.
- The specific packaging evolves over time, but the core pattern usually stays the same: create urgency, control the channel, and push action before verification.
- AWS-themed phishing campaigns were among the top cloud service impersonation attacks tracked by security researchers in 2023 and 2024.
Recovery and follow-up
- ✓Save the messages, receipts, account alerts, and transaction details before you block or delete anything.
- ✓Report the scam through the official platform or government channel that best matches where it happened.
- ✓Never click links in AWS notification emails — go directly to the AWS Management Console at console.aws.amazon.com.
- ✓Enable MFA on all AWS IAM accounts and use AWS Organizations with service control policies.
- ✓Report AWS phishing to [email protected] and review CloudTrail logs for unauthorized access.
Why this pattern keeps working
Even when the story changes, most scams still use the same pressure pattern: urgency, authority, and a request to move money or data fast.
AWS-themed phishing campaigns were among the top cloud service impersonation attacks tracked by security researchers in 2023 and 2024.
OpenScam research
Where to report it
If you have been targeted by this scam, reporting it helps authorities track the pattern and protect others. United States has dedicated agencies that handle fraud reports.
ReportFraud.gov
Federal Trade Commission
Central U.S. consumer fraud reporting portal.
File an IC3 complaint
FBI Internet Crime Complaint Center
FBI portal for internet-enabled crime reports.
Start identity theft recovery
IdentityTheft.gov
Official U.S. identity theft recovery plan builder.
Explore further
Understand the bigger picture
Who is most at risk
Who this scam targets
Primary targets
Developers, IT professionals, Small business owners
Geographic concentration
United States, United Kingdom, India, Germany
Primary channel
Amazon — Brand impersonation scams
Why this group is vulnerable
Developers are particularly vulnerable because this scam exploits trust in familiar brands, authority figures, and time-sensitive decisions. The rapid increase in reports suggests that awareness among this demographic remains low.
Sources and methodology
How we verify this information
OpenScam tracks scam patterns using a combination of government consumer protection databases (FTC, IC3, Action Fraud), platform-specific fraud reports, and verified consumer complaint data. Each entry is cross-referenced against at least two independent sources before publication.
Severity ratings are based on financial impact potential, reversibility of damage, and volume of reports across multiple reporting channels. Trend velocity reflects the rate of change in report volume over the most recent 90-day window.
This page was last verified on 2026-04-04. Red flags, recovery steps, and reporting resources are reviewed quarterly against current agency guidance.
Evidence and indicators
- AWS-themed phishing campaigns were among the top cloud service impersonation attacks tracked by security researchers in 2023 and 2024.
Source notes
- OpenScam research
Frequently asked questions
Common questions about amazon web services phishing scam
How does the amazon web services phishing scam work?+
Scammers send emails mimicking AWS notifications about billing failures, security events, or account verification requirements. The phishing link leads to a convincing replica of the AWS console login page that captures IAM credentials and MFA codes. Compromised AWS credentials are used to spin up cryptocurrency mining instances, exfiltrate stored data, or launch further attacks.
What are the warning signs of amazon web services phishing scam?+
An email claims your AWS account will be suspended unless you verify billing details immediately The login URL is not aws.amazon.com — it uses lookalike domains or IP addresses The email demands immediate action and threatens data deletion or service termination
What should I do if I encounter amazon web services phishing scam?+
Never click links in AWS notification emails — go directly to the AWS Management Console at console.aws.amazon.com. Enable MFA on all AWS IAM accounts and use AWS Organizations with service control policies. Report AWS phishing to [email protected] and review CloudTrail logs for unauthorized access.
Who is most at risk for amazon web services phishing scam?+
This scam primarily targets Developers, IT professionals, Small business owners. It is most commonly reported in United States, United Kingdom, India, Germany and typically appears on Amazon.
Is amazon web services phishing scam getting worse?+
Amazon Web Services phishing scam is currently surging — reports are increasing rapidly. It has been reported across US, UK, IN, DE. Last updated 2026-04-04.
Related scams
Similar scams to watch out for
Government impersonation
↑ 121%Tax refund verification phishing scam
A fake refund or filing problem message pressures the victim to verify tax identity through a counterfeit government portal.
What to do first
Go directly to the tax authority website instead of using message links.
Targets
Tax filers
Seen in
U.S.
Employment fraud
↑ 80%Freelance project unlock fee scam
A freelancer wins a project but is told they must buy a platform license, ID badge, or portfolio review to start.
What to do first
Do not buy access tools or badges to start freelance work.
Targets
Freelancers
Seen in
Global
Smishing
↓ 16%Tax agency refund text link scam
A text says a refund or filing issue needs immediate identity confirmation through a mobile link.
What to do first
Use the tax authority's official website instead of the text.
Targets
Tax filers
Seen in
U.S.
Help someone avoid this scam.
Scammers succeed because people do not talk about it. If you or someone you know has been affected, there is no shame in it — it happens to millions of people every year. Share this page with friends and family so they know what to look for.
Relevant collections