Interview isn't a job. This sort of thing isn't uncommon in tech industry.

Did they not give you a name and phone number you can check on an Amazon directory of employees?

Developers at all levels have to not fall for a phishing attack: verification of contact isn't a bad thing, and actually shows a level of consciousness in the role all employees play in security.