New GEET Phishing Scam Mimics Amazon to Drain Bank Accounts
A clever new phishing campaign named GEET uses fake Amazon gift card rewards to bypass security filters and steal personal banking credentials.
The Anatomy of the GEET Campaign
A new email threat is quietly landing in inboxes worldwide. Cybercriminals are using the promise of free Amazon gift cards to bait unsuspecting users. But this isn’t a simple retail scam. Security researchers have flagged a sophisticated new campaign dubbed ‘GEET’ that bypasses traditional email filters to steal sensitive banking credentials. It is fast, highly targeted, and incredibly convincing.
Phishing campaigns often rely on greed and urgency. GEET uses both to devastating effect.
How the Trap is Sprung
It all starts with an email. The message claims the recipient has won an Amazon promotional reward or a loyalty gift card, often valued between $100 and $500. The branding is nearly flawless. The attackers copy Amazon’s exact colors, fonts, and logo layout. They even include fake privacy links at the bottom to build trust.
The email urges the reader to click a link to claim the balance before it expires. This artificial rush stops people from pausing to check the details. But clicking that link initiates a complex chain of events.
Once a user clicks, they don’t go to Amazon. Instead, the GEET campaign uses smart routing. It analyzes the victim’s device, IP address, and location. If the click comes from an automated security scanner or an out-of-scope region, the server redirects them to a harmless website like Google or Wikipedia. This clever evasion tactic keeps the campaign hidden from security companies for days, even weeks.
Targeting Bank Accounts
If the victim matches the targeted profile—usually users in the US, Canada, or the UK—they face a much darker reality. Instead of a gift card portal, they are sent to a highly realistic clone of a major retail bank’s login page. The scam dynamically adapts to show branding from institutions like Chase, Wells Fargo, or Bank of America.
The page prompts the victim to ‘link’ their active bank account to receive the promotional funds. To do this, they must enter their online banking username, password, and answer security questions. The scammers don’t stop there. If the bank sends a one-time verification code to the victim’s phone, the fake site prompts them to enter that too. The attackers harvest this data in real-time, instantly logging into the real bank account to drain funds or initiate unauthorized wire transfers.
Why Traditional Filters Fail
Most email gateways look for known malicious links or suspicious attachments. The GEET campaign bypasses these defenses by leveraging legitimate infrastructure. Attackers routinely hijack compromised, highly reputable WordPress sites to host their initial redirect scripts. Because these sites already have good reputations, security filters wave the emails right through.
They also employ HTML smuggling. This technique hides the malicious payload inside an innocent-looking HTML attachment or web script. The code only assembles and runs once it reaches the victim’s local browser, safely out of reach of network-level security tools.
How to Stay Safe
As phishing tactics grow more complex, relying solely on software protection is no longer enough. Security experts recommend several key defenses:
- Verify the sender address: Don’t just trust the display name. Check the actual email address behind the name to see if it matches the official domain.
- Be skeptical of fast rewards: Large companies rarely hand out hundreds of dollars in gift cards for free. If you have to log into an external site to claim a prize, it’s a scam.
- Look at the URL: Before typing any login credentials, double-check the address bar. If you are logging into your bank, ensure the domain is exactly correct.
- Use App-Based MFA: Switch from SMS-based multi-factor authentication to authenticator apps wherever possible. Scammers can easily phish SMS codes, but app-based prompts are much harder to intercept.
The GEET campaign is a stark reminder that cybercriminals are constantly evolving. Staying vigilant and verifying every unexpected request is the best defense against these shifting digital threats.
