Texts and calls

The Amazon Driver Verification Text Scam, October 2026

Updated 6 October 2026

You are not a delivery driver, and the text knew that. The message lands with your first name, a one-time code, and a tidy little line about verifying your Amazon Flex account, and the costly assumption is that the URL inside the message belongs to Amazon. It does not, and the next two minutes decide whether your bank balance, your phone number, and your inbox stay yours.

What the Amazon driver verification text actually says

The scam arrives as an SMS, usually from a ten-digit U.S. or Canadian number that has been burner-registered for this run. It opens with a greeting that uses your first name, pulled from a previous data broker leak, and then offers one of three stories. In the first, it claims your Amazon Flex driver account is under review and you must re-verify to keep delivering. In the second, it claims a new device tried to sign in to your Flex account and you need to confirm the six-digit code they have just sent. In the third, it claims a background check came back incomplete and you need to upload a photo of your driving licence to clear it.

Each version ends with a short link. The most common pattern in October 2026 uses a redirector hosted on a freshly registered .top or .click domain that bounces to a near-clone of the Amazon Flex sign-in page. The page is good. The favicon is right, the typography is close, the spacing is correct, and the only giveaway is the address bar if you bother to look. Some versions skip the clone and go straight to a credential harvester dressed as a one-time password entry box, which is the variant that catches the people who never had a Flex account to begin with.

Two details make the text work. The first is the name. A first-name greeting turns a generic blast into a personal message, and the cost of those names on the people-search market is now low enough that the scam can afford to spend the money up front. The second is the implied urgency. Drivers who actually use Flex are gig workers paid by the hour, and a frozen account is a missed shift. The message is engineered to make the reader act before they think, and the version aimed at non-drivers uses the same urgency to short-circuit the question of why Amazon is texting them at all.

There is also a quieter variant doing the rounds in October 2026 that arrives in WhatsApp and Signal instead of SMS. It claims to be from an Amazon recruiter offering high-paying driver slots in your area and asks you to install what it calls a Flex onboarding app. The file is an Android sideload with a package name that mimics com.amazon.flex but resolves to a different signing certificate. Installing it gives the attacker a persistent foothold on the phone, and the on-screen instructions walk you through disabling Play Protect so the warning goes away. The end state is the same as the SMS version: a harvested password, a stolen session cookie, or a planted dropper, depending on which link you tap.

Who is behind the verification link, and where the data goes

The infrastructure behind this scam is not a lone actor. Researchers at PhishTank and urlscan.io have been tracking the same redirector clusters since the summer of 2026, and the pattern is consistent. The first hop is a cheap domain registered through a registrar that does not require thick WHOIS, the second hop is a Cloudflare-fronted credential harvester, and the third hop, triggered only after a successful login, is a session-rider that pushes the stolen cookie into a buyer Telegram channel within minutes.

The buyer side is where the money actually lives. Stolen Flex accounts are sold for between $80 and $300 depending on the payout history, and the most valuable accounts are the ones with a linked bank account and a high weekly earning cap. Once a buyer takes over an account, they reroute the payout to their own bank and run a short burst of legitimate-looking deliveries to keep the account in good standing, then drain it through a chain of small cash-app transfers. The driver who actually owns the account is left with a flagged Flex profile, a tax form that no longer matches, and a support queue that takes weeks to answer.

The non-driver variant of the scam has a different end game. A non-driver has no Flex account to steal, so the harvester pivots. After the fake login, the page asks for the one-time code Amazon has just sent to your phone, and that code is the real prize, because with it the attacker can attempt an account recovery on your personal Amazon account. If you have a strong password and a hardware key, the attempt fails. If you have an older account on a recycled password, the attempt can succeed, and the attacker now has your saved cards, your address book, and your order history to work with. The same codes are also tried against Coinbase, PayPal, and the major banks within minutes, which is why a single tapped link can feel like three different compromises at once.

The phone-number harvest is the part nobody talks about. Even if you never type a password, the link itself can fire a small fingerprint script that reads your IP, your User-Agent, and the headers your carrier adds to the request. That fingerprint gets joined to your phone number and sold back into the people-search economy, where it will turn up in the next batch of first-name greetings aimed at you in three to six weeks. Tapping the link is a long-tail cost, not a single event, and that is the part to remember when a friend says it was just spam and nothing happened.

How to tell the real Amazon from the fake, every time

Amazon will never text you to verify your driver status. The company states this plainly on the Flex help pages and has done so since 2023, but the help pages are not where the text sends you. The single rule that kills this scam is to open the Amazon app yourself and look for the message there. If the message is real, it is in the app. If it is not in the app, the message is fake, and that includes every variant that uses your first name, every variant that quotes a six-digit code, and every variant that asks for a photo of your licence.

The second rule is about the code itself. Amazon sends one-time passwords by text for sign-ins, password resets, and two-step verification, and the code is six digits long. The scam sends the same six digits in the body of the message, then asks you to type them into the linked page to confirm the verification. Real one-time codes are entered on the Amazon site, not on a link in the same text that delivered the code. If a message contains both a code and a link, the link is the payload and the code is the lure.

The third rule is the device check. If a text says a new device tried to sign in, you can confirm or deny the attempt from the Amazon app under Your Account, then Login & Security, then Two-Step Verification. The same screen shows the device name, the approximate location, and the timestamp. If the screen shows nothing, the text is lying, and the cleanest response is to delete it without tapping anything. The same screen also lets you revoke any active sessions, which is the right move if you have already tapped the link and typed a code.

The fourth rule applies to the WhatsApp and Signal variants. Amazon does not recruit Flex drivers through unsolicited messages on encrypted chat apps, and Amazon does not ask you to sideload an app from a link in a chat. Real Flex onboarding happens through the Amazon Flex app on the official app stores, and the application flow does not include disabling Play Protect. If a message asks you to install an APK from a link, the right answer is the same as the SMS version: do not tap it, block the sender, and report the chat to the platform.

What to do in the next ten minutes if you already tapped

If you have tapped the link but did not type anything, the immediate risk is low but the fingerprint cost is real. Go to your phone settings, clear the browser data for the site, then check the recent apps screen for anything you do not recognise. If you are on Android, run a scan with Play Protect and look for any app that was installed today. If you are on iPhone, the scam is contained to the browser sandbox, but change the password for any account that shares the password you might have autofilled.

If you typed your Amazon password, the account is now considered compromised even if the harvester page errored out. Go to the Amazon app or type amazon.com into a fresh browser tab, sign in, change the password, and revoke every active session. Turn on two-step verification with a hardware key or an authenticator app, not SMS, and remove any phone numbers from the account that are not yours. Then check your order history for the last 48 hours and your address book for any new entries you did not add. Compromised Amazon accounts are used to place high-value gift card orders against saved payment methods, and the orders are usually scheduled for same-day delivery to an address that is not yours.

If you typed the one-time code, the risk profile is worse. A code that you typed into a page you opened from a link is a code that the attacker now has, and it can be used against any account that uses SMS-based two-step. From a clean device, change the Amazon password, the email password tied to the Amazon account, and the password on any bank or crypto account that shares the same email. Then call your carrier and ask for a port-out PIN to be set, because a compromised phone number is a SIM-swap away and the SMS codes that protect those accounts stop being yours the moment the number moves.

If you installed the sideloaded app, the device is the problem now and the account is secondary. Put the phone in airplane mode, do not sign into any account from it, and from a clean computer change the passwords for the accounts that were signed in on the phone, starting with email, bank, and any account that has a saved payment method. A factory reset is the cleanest answer, and so is a conversation with your carrier about replacing the SIM and the number if the device was Android. The malware is built to survive a reboot, and the longer it stays installed the more it learns.

The two-minute rule that kills this and the next ten scams

The two-minute rule is simple. Any text that creates urgency and asks you to tap a link costs you two minutes of verification, and the two minutes are spent on a channel you opened yourself, not the channel the text used to reach you. For Amazon, the channel is the app. For your bank, the channel is the number on the back of your card. For the tax office, the channel is the address on your last real letter. The scam works because the message redirects you to a different channel, and the rule is to refuse the redirect.

Report the message before you delete it. In the United States, forward the text to 7726, which routes to the carrier's spam reporting desk, and then block the sender. In the United Kingdom, forward the text to 7726 as well, and report the message to Action Fraud at actionfraud.police.uk. In Australia, the reporting address is 0429 999 888. The reports do not always produce a callback, but they do feed the same clustering pipelines that researchers use to map the infrastructure, and the infrastructure is the part the scam needs to keep running.

Finally, do the boring work that the scam is trying to make you skip. Rotate any password that is older than a year, turn on a password manager if you do not already have one, and check whether your email and phone appear on a people-search site you forgot to opt out of. The first-name greeting only works because the data exists, and the data exists because the opt-outs were never filed. The scam is the surface, the leak is the engine, and the two-minute rule is the seal that keeps the next message from landing on a name it knows is yours.

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.