In early December 2023, we received emails from readers who asked about a purported Amazon.com scam that was being virally shared on Facebook with the claim, "Amazon got hacked."
This appeared to be the latest item in the world of copied-and-pasted Facebook posts. Such posts usually contain evidence-free claims about security or privacy risks.
The text of the posts said that criminals had added to users' accounts one or more mailing addresses that were labeled as alternative pickup locations named Amazon Locker, Amazon Hub Locker, Amazon Fresh or Amazon Counter (e.g., Whole Foods Market). (Usually, a one-time, six-digit code or a user's phone is needed to retrieve packages from such locations.)
According to the rumor, the added addresses were fraudulently labeled and were not actually official Amazon pickup locations. Rather, the actual number and street name for each address led to locations that could be accessed by criminals, which would allow them to order products and then receive them, all on an innocent Amazon user's dime.
One of the more popular versions of the copy-and-paste posts read as follows:
PSA: check your saved addresses on Amazon. Amazon got hacked and a lot of people (including me) have random “Amazon lockers” saved in their addresses - which are not actual lockers. If you do use Amazon lockers, be sure to verify that the locker you’re sending it to an actual locker.
Double check your order history and make sure there aren’t any orders you don’t recognize. And check your bank accounts to make sure your credit card on file is also not being used for unauthorized purchases.
We reached out to Amazon's public relations team via email to ask about this rumor. We received the following statement from the company's global media relations spokesperson, Montana MacLachlan:
We have no evidence of a security event at Amazon and our systems remain secure. Customers who have questions about their account should contact customer service.
In our research of this rumor, we noticed that quite a few Facebook users had shared screenshots of the purportedly fake Amazon pickup addresses. However, key here was the fact that all of the mailing addresses that appeared in the screenshots were, in fact, genuine and trustworthy pickup locations for Amazon Locker, Amazon Hub Locker, Amazon Fresh and Amazon Counter. Some of the users who shared the rumor had incorrectly said that the mailing addresses were "not actual lockers."
We looked for more clues in the comments of a helpful Reddit thread, as well as in additional Facebook posts. Some users said that the mailing addresses that were added to their accounts were located in U.S. states different than where they lived. It's unclear if any of this activity could have been the result of a bug that occurred as part of a feature that seeks to automatically add pickup alternatives to accounts. We reached out again to Amazon to ask further questions and will update this story if we receive an answer.
From all of the posts that we combed through online, we noted that none of the people who had reported the mailing addresses as showing up on their accounts had also said that unauthorized orders had already occurred. In other words, if criminals were purportedly taking advantage of these addresses that they supposedly added to the accounts, why weren't users on Reddit or Facebook including in their posts and comments details about fraudulent orders?
Aside from the rumor, it's never a bad idea to change your password. Also recommended is the enabling of two-step verification, a method that adds a second layer of security to an account (on top of just having a password).