PayPal Amazon Impersonation Campaign Targets Users
Security researchers identified an active social engineering campaign on March 16, 2026, where attackers impersonate PayPal and Amazon customer support representatives. The threat actors contact victims through phone calls and emails, claiming to assist with account issues or suspicious transactions.
The attackers use convincing scripts and spoofed caller IDs to appear legitimate. They request account credentials, payment card details, and personal information under the guise of verifying identity or resolving fabricated security concerns.
PayPal and Amazon Customers Under Attack
The campaign primarily targets PayPal and Amazon account holders across multiple regions. Attackers focus on customers who recently made purchases or have active payment disputes, using publicly available transaction data to enhance credibility.
Small business owners using PayPal for commerce and frequent Amazon shoppers face elevated risk. The CISA advisory system tracks similar social engineering threats affecting financial service users.
Related: Russian hackers target Signal, WhatsApp in govt phishing
Related: Chinese APT Targets Asian Organizations in Multi-Year
Related: FortiGate Firewalls Exploited in Network Breach Campaign
Related: Teams Phishing Campaign Deploys A0Backdoor Malware
Related: ClickFix Malware Campaign Targets AI Coding Assistants
How the PayPal Amazon Scam Works
Attackers initiate contact claiming urgent account security issues require immediate verification. They guide victims through fake authentication processes, capturing login credentials and two-factor authentication codes in real-time.
The criminals use sophisticated voice spoofing technology and reference legitimate transaction details to build trust. Users should verify any unsolicited support contact by independently calling official customer service numbers. The Microsoft Security Response Center recommends never providing credentials through unsolicited communications.
