A Butterfly Habitat Order Revealed a Possible Online Security Threat

My mom and I talk every morning. Last week, during one of our conversations, she asked me to order a few butterfly habitats so she could raise butterflies.

She told me she would email me the Amazon links. However, when we spoke again that evening, I explained that I had never received her emails.

That was when the conversation took an unexpected turn.

My mom said she had been trying to order several items through Amazon, but the orders kept being cancelled. She had contacted Amazon, but they could not explain why it was happening.

As we continued talking, it became clear that this might be more than a problem with an online order. Her Amazon account, email or Kindle Fire tablet may have been compromised.

The Password Change That May Not Have Helped

My mom had already changed her Amazon password, which is normally an important first step. However, she had changed it using the same tablet that may have been compromised.

If a device contains malicious software, changing a password from that device may not fully protect the account. The new password could potentially be captured as it is entered.

I explained that she needed to change her Amazon password again—but this time from a different, trusted device.

She had also wisely removed her payment information from Amazon. I encouraged her to closely review her credit card transactions and contact her card issuer immediately if she noticed anything unfamiliar. Depending on the situation, requesting a replacement card may also be appropriate.

Removing the Possible Threat

I stopped at her house and helped her complete a factory reset of the Kindle Fire tablet.

A factory reset removes the information, applications, and settings stored on a device and returns it to its original configuration. Although it can help remove malicious applications or unwanted software, it is still important to secure every account that may have been accessed from the device.

After resetting a device, users should reinstall only trusted applications from official app stores and avoid restoring unfamiliar or unnecessary apps.

How May the Device Have Been Compromised?

We believe the issue may have started when my mom clicked an Amazon-related link that had been sent by a family member.

The family member may not have known that the link was unsafe. Their own account or device could have been compromised, allowing a fraudulent message to appear as though it came from someone my mom trusted.

This is an important reminder: A message is not automatically safe simply because it appears to come from a friend or family member.

Cybercriminals frequently use compromised accounts to send convincing links, fake delivery notices, shopping offers or account alerts to people in the victim’s contact list.

What to Do When an Account or Device May Be Compromised

If you notice unexplained cancelled orders, password-reset notifications, unfamiliar purchases or other unusual account activity, take the following steps:

1. Stop using the possibly compromised device.
   Do not continue signing in, shopping or entering financial information.
2. Use a different, trusted device.
   Change the password for the affected account from another phone, tablet or computer.
3. Secure your email account.
   Your email can be used to reset passwords for many other accounts. Change its password and turn on multifactor authentication.
4. Review account activity.
   Look for unfamiliar orders, addresses, payment methods, devices or account changes.
5. Remove saved payment information when appropriate.
   Contact your financial institution or card issuer if any transactions appear suspicious.
6. Consider resetting the affected device.
   A factory reset may help remove malicious software, but make sure important photos or documents are safely backed up first.
7. Be cautious with links—even when they come from someone you know.
   Instead of tapping a link, open the company’s official app or type its website address directly into your browser.

Trust the Warning Signs

My mom’s situation did not begin with an obvious security alert. It began with cancelled butterfly habitat orders and emails that never arrived.

Small problems can sometimes be the first sign of a larger issue. When account activity does not make sense, do not ignore it. Stop, investigate and secure your information before continuing.

In this case, an everyday conversation may have helped prevent a much more serious financial loss.