This screenshot shows a fake reCAPTCHA page impersonating Amazon.de. The page claims the victim must prove they are “not a robot” by entering characters from an image – a classic tactic used to trick victims into completing a “verification” step that often leads to malware or credential theft.
Threat Analysis: Amazon Fake reCAPTCHA Phishing – “I’m not a robot” Scam
How it works:
The victim receives a link (often via email, SMS, or malicious ad) that leads to this page. The page mimics a legitimate Amazon security check, displaying a fake CAPTCHA image with characters (“ACXJPVU”) and a checkbox “I’m not a robot.” The victim is instructed to enter the characters and click “Fortsetzen” (Continue). After submission, the victim is typically:
- Redirected to a phishing page asking for Amazon login credentials
- Prompted to download malware disguised as a “security update”
- Taken to a survey or offer wall (affiliate fraud)
The goal:
The attacker aims to:
- Trick the victim into entering information that can be used to bypass security measures
- Lead the victim to a subsequent phishing page where Amazon credentials are stolen
- Generate affiliate revenue through fake surveys or downloads
Red flags to watch for:
- Suspicious URL: The page is hosted on a domain that is not
amazon.de. Legitimate Amazon CAPTCHA challenges appear on official Amazon domains. - Generic design / missing Amazon branding: While the page uses the Amazon logo, the layout is minimal and lacks the full navigation, security notices, and footer links of the real Amazon site.
- Fake CAPTCHA image: The image text is simple and appears to be a static image, not a dynamically generated CAPTCHA. Real reCAPTCHA is more complex and interactive.
- Unsolicited verification request: Amazon does not require you to complete a CAPTCHA via an external link to “prove you’re not a robot.”
What to do if you encounter this:
- Do not enter any characters or click “Fortsetzen.”
- Do not click any links or download any files from such pages.
- If you have already entered information and were redirected to a login page, do not enter your Amazon credentials. Change your Amazon password immediately if you suspect you may have been tricked.
- Always access Amazon by typing
amazon.dedirectly into your browser.
Protective measures:
- Never complete a CAPTCHA on a page you reached via a link. Legitimate CAPTCHA challenges appear only on the official site you are already visiting.
- Check the URL carefully – Amazon.de domains end with
amazon.de. Look for misspellings, extra words, or unusual top‑level domains. - Use a password manager – it will not autofill on fake domains.
- Enable two‑factor authentication on your Amazon account.