If your mom or dad got a call tomorrow from “Amazon,” would they know what to do? Most people don’t know until the phone rings, and by then the caller is already steering the conversation.
This matters now because of a story PCMag ran with the headline How a Fake Amazon Phone Call Cost a Retired Nurse $400K, and What You Can Do to Protect Your Parents. That’s a retired nurse and a fake Amazon call, and the loss was $400,000. I’m going to be upfront. The part of the article I had to work from was the headline and summary, so I won’t retell the details of her case. I’d be guessing. What I can do is walk you through how these impersonation calls usually work, from a SOC analyst’s point of view, and give you a rule your family can use.
What happened, in plain English
According to PCMag, scammers phoned a retired nurse pretending to be Amazon, and she ended up losing $400K. The headline says this is something you can protect your parents from. I agree. These scams rely on a few predictable moves, and predictable moves can be countered.
How a fake Amazon call usually goes
This is the general pattern of impersonation calls. It isn’t a transcript of the nurse’s case.
- The hook. An unexpected call says there’s a problem: a suspicious order, a charge you don’t recognize, a hacked account. It’s meant to alarm, not to inform.
- The handoff. The caller says they’ll connect you to someone more senior, such as a fraud department, a bank, or sometimes police. Each new voice makes the story feel more official.
- The pressure. You’re told to act now, to stay on the line, and to keep it quiet. The secrecy is a tell. Real companies don’t need you to hide a call from your family.
- The ask. You’re asked to move money, share a code, install software, or read out account details, usually framed as “protecting” you.
None of this requires technical skill. It’s a performance. The scammer’s whole job is to keep your parent from stopping to think or calling someone else.
How to tell if it affects your family
Any parent with a phone is a possible target. A few things raise the odds that a call will land:
- They’re home during the day and answer unknown numbers.
- They shop online, so an “Amazon problem” sounds believable.
- They have savings, and the caller may somehow sound like they know it.
- They’d be embarrassed to admit they were fooled, so they don’t tell anyone.
The last one matters most. Shame keeps scams alive, and it’s why I’d start with an easy, no-blame conversation.
The warning signs to teach them
- You didn’t start the contact. They called you, or texted you.
- There’s urgency: “right now,” “today,” “your account will be closed.”
- There’s secrecy: “don’t tell the bank,” “don’t tell your family.”
- They want money moved to “keep it safe,” or they ask for gift cards, crypto, or a transfer to a new account.
- They want remote access to the computer, or a verification code sent to your phone.
- They get angry or anxious when you say you’ll call back.
Print that list and put it by the phone. Seriously. It’s the kind of thing people can’t recall when they’re flustered.
The simple callback rule
If I could give your parents one rule, it would be this:
If someone calls you about money or an account, hang up and call the company back yourself, using a number you found on your own.
That means the number on the back of your bank card, on a paper statement, or on the company’s official website or app. It doesn’t mean the number the caller gave you, a number in a text, or whatever shows on call display. Caller ID can be faked, so it proves nothing.
A few details make the rule work better:
- If you can, use a different phone, or wait a bit and make sure you hear a dial tone before dialing. This guards against a caller who tries to stay connected.
- Tell your parents it’s okay to be rude. “I’ll call you back” is a complete sentence.
- A real Amazon issue will still be there in ten minutes. A scam depends on there being no ten minutes.
The same rule works for a fake CRA text
You searched for how to tell if a CRA text is fake, so here’s how the same thinking applies. Texts that claim to be from the Canada Revenue Agency tend to share the same traits: they show up unexpectedly, push you to click a link, and hint at a refund or a penalty to rush you.
- Don’t tap the link. Instead, open the CRA’s official website yourself, or use a bookmark, and sign in there. If something is real, you’ll see it in your account.
- Treat any demand for payment by text as a red flag, especially gift cards, crypto, or transfers to an unfamiliar person.
- Don’t reply, even to say “STOP.” A reply can confirm your number is active. Delete it instead, and report it to the CRA through its official channels.
Same idea as the Amazon call: you pick the channel, they don’t.
What to do today
- Call your parents this week. Skip the lecture and say, “I read about a scam and wanted to share a rule with you.”
- Agree on the callback rule and the warning-sign list.
- Pick a family code word or a “call me first” rule for any request involving money.
- Ask their bank what alerts and transfer limits it offers, and set them up together.
- Turn on a call-blocking or spam-filter feature through their phone provider or phone settings.
- Make sure they know that if they get fooled, they should tell you right away, and you won’t be upset.
Signs something already went wrong
Act quickly if your parent has done any of these after a call like this:
- Sent money, bought gift cards, or moved funds to a new account.
- Given out a banking password, a one-time code, or card details.
- Let a caller control their computer remotely.
- Seemed unusually secretive or stressed about their money.
If so, call the bank first, using the number on the card, and tell them what happened. Ask what they can do about the transfer. Then report it to your local police and to the Canadian Anti-Fraud Centre. If there was remote access, disconnect the computer from the internet and change passwords from a different, clean device. Time matters, so don’t wait until you feel certain.
When to get help
Get help if money has already left an account, if someone had remote access to a computer, or if you’re not sure whether a device is safe. That’s the point where a second pair of eyes is worth more than another hour of worrying.
Sources
Need help with this?
I’m a SOC analyst and I help small businesses with exactly this kind of problem. Book a free call and I’ll tell you honestly whether you need help or just a couple of settings changed.
