Amazon Virus Email “Your Order Has Been Paid” Scam

virusThis is both a heads-up about an Amazon virus email as well as a valuable marketing lesson.

But I’ll tell you right now, this post is going to cause some stir, so let me be clear on one thing – I don’t condone scamming, spamming, hacking, phishing and other black-hat-personal-data-collecting crap that the internet is full of.

Yet, from a marketing perspective, this scam is just brilliant, man!

Yesterday I received an email that lit a major fire under my ass. For a second anyway… I was quick enough to realize the potential for a ducking fizaster if I followed through.

Here is the email I got:

Your order has been paid! Parcel NR.5087.

Thank you for shopping at
We have successfully received your payment.
Your order has been shipped to your billing address.
You have ordered ” Sony VAIO VGC-LV240J ”
You can find your tracking number in attached to the e-mail document.
Print the postal label to get your package.
We hope you enjoy your order!

The email sported a zip attachment. In it there was an .exe file that was cleverly disguised as a word doc.

Yup, the creator actually embedded the word icon into it!

After some checking I learned this is a nasty banking data scraper that is as persistent as a yeast infection. The Amazon virus email attachment is to be avoided like a plague. Yet I love it!

So Why Would I Admire The Dirty Bastard Who Created The Amazon Virus Email?

Well, here is the thing. If you stop to think about it, you’ll see brilliant yet short copy with a killer call to action.

The title calls for attention like a teenager in heat:

What order? I never ordered anything…

The next part says you just bought an expensive toy and the money is already gone. Yikes!

At this point, this email commands your full attention as you’re led to believe someone stole your identity.

(I’d love to see what kind of conversions this bastard gets)

As you start looking at this more carefully, the address checks out. Email seems legit:

your order has been paid scam

And then what does he do in the end?

A call to action that promises to move you closer to the solution – print the attached file to get your tracking number.

He doesn’t even have to say it, yet he makes you think “I have to get this tracking number so I can fix this

Who Does The Amazon Email Scam Work On And What To Do About It?

Sure, you’ll say that the Amazon virus email would never work on you, just like it didn’t on me.

But you and I aren’t this dude’s target market.

I may be giving him too much credit, but I think he has his target market well defined.

If I were to hazard a guess, I’d say the Amazon virus email creator is targeting a male baby boomer who has little to medium experience shopping online; does online banking, fears identity theft and uses one of four major antivirus programs


Anyhow, if you did get the email, and you did open the attachment in the Amazon virus email, make sure you don’t log into any of your online accounts. Contact Amazon for instructions on how to get rid of the program (Amazon Virus Email doesn’t self-replicate so is not technically a virus, btw)

-Comrade iVan

14 comments to Amazon Virus Email “Your Order Has Been Paid” Scam

  • Jerry

    Hey, I just got one of these myself. I wish I read this before I launched the exe file though because now I’m paranoid something is installed on my machine.

    My computer did hiccup when I ran it and then nothing happened. Think I’m safe?


    • iVan

      Hi Jerry

      I wouldn’t bank on it (no pun intended). In fact, I’d look long and hard into it; just the fact you got a “hiccup” makes me suspicious.

      Sorry to frighten you, bro. Better safe than sorry.


  • Melissa

    Hey, thanks for the heads up. I always believed that scammers are to dumb to do anything right, but this actually makes sense.

    Ya, I hope they don’t read this blog, LOL

  • lim seng

    I have just got one awhile ago. I smell a rat right away and I quickly googled “your order has been paid amazon scam” and I came across your article. Thank you for highlighting it.

  • Jim

    Thanks, I was searching for something along the lines of this. I was thinking, do you think newsletters are still an good way of marketing online? Does anybody still use them successfully and actually acquire readers?


    • iVan

      Hey there Jim

      I can only tell you what I observed over the time – most internet marketers are abandoning that ship. Newsletters are associated with a waste of time these days, and are becoming largely inneffective.

      You’re much better off with something along the lines of special reports, white papers, or better yet video and audio training materials (often called boot camps these days).

      If you’re really focused on providing value you can grow your list pretty quick, especially if you provide a little sneak preview even before they opt-in.

      Simply put in a tiny video window into your form body that would reveal what’s waiting for them on the inside. Just make sure you deliver on the promise, and you’ll be fine.

      Hope this helps!


  • Man Scrudato

    Howdy there,I find out that your web log is extremely instructive and helpful and we were interested if there can be a possibility of obtaining More article content like this on your weblog. If you willing to help us out, we would be willing to compensate you… Kind regards, Man Scrudato

    • iVan

      Hey there Man (that really your name? Far out!)

      Hey, I have no problem with you taking the content off this blog for free and reposting it wherever you want so as long you link back. I’d be only glad to help out.

      I assume you’re setting up a blog yourself. Let us know what it is when it’s up; I’d love to check it out.


      • Frank L

        This is a spammer – leaves the same thing on lots of site (or tries to). Uses a different silly name every time though – Ian Zicari, Markus Dimezza, Cory Sadger, Yon Burdess.

        The gang (or is it really one particularly industrious individual?) is simply getting links to various .info sites designed to push their Google ranking (but it won’t work because they’re doing it wrong). The idiots tried it on my security blog. Just add to your firewall (or did they come at you from a different IP?)

        • iVan

          Hey Frank, thanks for the tip, but no – it was a different IP.

          I was playing with a comment URL stripper plugin or two when this was put up; I guess that’s why the backlink never appeared.

          I see they’re using a randomizer in their submitter as the comment appears slightly different across a variety of blogs.

          Thanks for the heads up. What’s your site?

          • Frank L

            My blog is fairly easy to find – just Google “frank blog comment spam” or similar ;-)

            There’s some good information on Wikipedia “Spam in Blogs” for anyone interested, although some of it needs a “this is only a theory” warning.

            I have another blog that’s harder to find that deals with comment spam attempts by warning the people not to put a link in and dropping it if they do. It works a treat.

          • iVan

            Hey, you’re welcome to post a link back to it if you’d like (where I’m at, your namesake Kern pops on Google when searched for “frank blog comment spam”)

  • ivan

    you know i just got it last week. What a joke.

Leave a Reply