Texts and calls

The Prime Day Deals Text Scam, October 2026

Updated 6 October 2026

You assume the text is about Amazon because the wording mentions Prime and a discount you did not ask about. That assumption is what the message is selling, and it is the only thing standing between you and a card that gets drained within the hour. The 2026 October Prime Day event starts on the 7th, and the lookalike texts started on the 1st, which means your phone is about to get a small burst of messages that look like deals and behave like phishing.

What the Prime Day text scam looks like in October 2026

The pattern this October is a short SMS that says something like "Amazon: Your Prime membership has been selected for an exclusive October deal. Confirm within 24 hours or your slot will be released." The link inside uses a short domain, a domain that mimics amazon in the middle of a longer string, or a country code top level domain that Amazon has no reason to send you through. A second common version says "Prime: A $39.99 charge for Prime Video Annual has been authorised on your account. If you did not authorise this, cancel here." Both versions share the same three parts. There is a hook that flatters or panics you. There is a deadline that makes you tap first and think second. There is a link that leaves the Amazon domain.

Some of the 2026 messages have been sent through the same grey route bulk SMS providers that powered the SIM swap setup texts earlier this year, which is why the sender number looks like a 10 digit mobile rather than a short code. Treat the sender number as decoration. The only thing that matters is the URL. If the URL is not on amazon.com, on amazon.co.uk, on amazon.de or on another genuine Amazon country site, the message is not from Amazon, no matter how clean the rest of it looks.

Amazon runs Prime Day promotions through the app, through the website, and through the email address on your account. It does not run flash sale enrolment through SMS. That single fact is the cleanest test you can apply in the three seconds between reading the text and tapping the link.

What the fake page actually does with your details

Tap the link and you land on a page that copies the Amazon login screen. The logo is right, the colour bar is right, and the address bar in many browsers will read "amazon" somewhere in the domain because the scammers buy a domain such as amazon-prime-deals-october dot click or amazon-october dot today. The form asks for your email or phone and your password. If you type both and tap Sign In, the page records the pair and bounces you to the real Amazon site. Many people only realise what happened when an order they never placed shows up days later, or when the card on file gets charged for a small test amount first.

The second page the link opens, on the more aggressive variants, asks for the card number, the expiry, the CVV, and the billing ZIP. It justifies the ask with a fake "verify your Prime membership to claim this deal" prompt. Some pages also ask for the one time passcode your bank sends in response to a login attempt the page triggers in the background. If you read that code out of your text messages and type it into the page, you have given the page the ability to add your card to a wallet controlled by the scammer. The bank is not part of that. The bank thinks it is you, because the code went to your phone and the page asked for it.

The October 2026 wave has a third layer. After the card details page, some of these sites offer a checkbox to "enrol in Prime for $0.99 to keep the deal price." That small charge is the test run. The real charge, a much larger recurring subscription in a different name, lands a few days later on a statement line that does not contain the word Amazon. This is the same shape as the Netflix payment failed text we covered last year. The 99 cent charge is the lure, the recurring debit is the product.

How to tell a real Amazon alert from a fake one

Amazon does text you, in some cases, but only after you opt in to alerts in your account under Communication preferences. If you have not ticked the SMS box in your Amazon settings, Amazon is not in a position to text you. That single setting is the easiest test.

When Amazon does text, the sender is a short code, not a 10 digit number, and the link in the message points to the amazon dot country domain that matches the country on your account. Open the Amazon app directly, type your deal in the search bar, and see if the offer exists. If it does, the text was redundant. If it does not, the text was a scam.

For account issues, Amazon will also email the address on file. The email contains your name, not "Customer" or "Member." The email footer contains the full country address of the Amazon entity that runs your account. If the email uses a free webmail address, or the footer is missing, the message is not from Amazon. The same pattern shows up in the DMV text scam we covered earlier, where the real agency and the fake share a brand but never share a domain.

What to do in the first 30 minutes after you tap

Stop typing. Close the page. If you entered your Amazon password, go to the real Amazon site, sign in, change your password, and turn on two step verification under Login and security. If you do not have a passcode on your Amazon account yet, set one. Amazon now offers a passkey option that uses your phone's own unlock, which is much harder for a phishing page to copy.

If you entered card details, call the number on the back of the card. Do not call a number in the text or on the fake page. Ask for a freeze on the card, then a replacement with a new number. Ask the agent to flag any pending authorisation for $0.99, $1, or $4.99 in the next 24 hours. That is the test charge pattern, and flagging it can stop the next charge even if the card has already been replaced.

If you typed the one time passcode from your bank into the page, the bank is now the only line of defence. Call the fraud team, not the general number, and ask for a wallet removal. Many banks can list every device that has your card tokenised and remove them in one call. Do this before the scammer adds the card to their phone and starts tapping it in person at a shop.

How to report the Prime Day text and slow the next wave

Forward the original text to 7726, which spells SPAM on a phone keypad. In the US this goes to the carrier's spam reporting line, and AT&T, T-Mobile, and Verizon all act on patterns reported to 7726. In the UK the same short code is used by the GSMA to feed reports to the networks. After forwarding, copy the sender number and the link, then block both on your phone.

Report the message to Amazon directly by opening the Amazon app, going to Customer Service, then Message us, and pasting the link. Amazon runs a phishing reporting line at reportascam@amazon.com and uses the reports to get lookalike domains taken down. Reporting the link is what gets the next person protected. The text you got was sent to thousands of others, and your report is the one that may turn a working scam page into a parked domain within hours.

In the US, the Federal Trade Commission accepts the report at reportfraud.ftc.gov under the category "Unwanted text message." The FTC used the 2025 SMS wave to push carriers into filtering more aggressively, and the 2026 wave is testing whether the filters held. Your report helps the next round. In the UK, the same report goes to Action Fraud at actionfraud.police.uk, where the National Fraud Intelligence Bureau uses the link pattern to map which scam groups are active.

How to keep your number off the next Prime Day list

Bulk SMS lists are sold between criminal groups, and the 2026 Prime Day list is largely recycled from the July 2025 list. If your number was on the 2025 list, the only reason it is quiet this year is that you changed numbers. The list itself has not shrunk. Two things actually reduce the number of texts you get. The first is to register your number on the Do Not Call registry, in the US at donotcall.gov, which is a legal block on most legitimate marketing SMS. It does not block the criminal traffic, but it does reduce the legitimate looking text that trains you to click.

The second is to call your carrier and ask for a free spam filter line such as AT&T ActiveArmor, T-Mobile Scam Shield, or Verizon Call Filter. These run on the network side and stop the bulk SMS before it reaches your phone. They are not perfect, and a fresh route will slip past them for a few days before the carrier updates the filter, but the difference over a month is significant.

For the texts that still get through, treat the link as the test. Do not tap to find out. Open the app, search the deal, decide from the real storefront. The same habit defeats the Cash App deposit scam, the Zelle and Venmo scam texts, and most of the other SMS cons we have covered. The 2026 Prime Day is a single event and a single scam shape, but the rule is the same. Read the link, not the wording.

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.