Amazon has closed my account due to unauthorized activity, what do I do now?

[ficbot]

Good point about clearing out emails. I just realized that I have saved all the 'welcome to XYZ' emails I got when I joined various services. So if someone hacked into my email, they could learn about all this stuff! I am going to go in tonight and save those all to text files on my computer and get them off my email.

No news from Amazon yet about reinstating my account, which they said would happen within 24 hours. I'm still hoping to hear back on that.

[crich70]

Originally Posted by Blossom

Yeah it seems that hacker group has been wreaking havoc and alot of amazon accounts have been compromised by it.

First thing to do is remove any payment info link to your account. Go buy a gift card or a cheap debit card and leave a small amount on it for buying books if you do not want enter your CC info each time then remove it. Change your passwords just to be safe and use upper, lower letters and numbers in it.

It isn't safe right now for anyone it seems. Paypal has also taken a hit. It makes me nervous. I also suggest don't use Facebook connect, Gmail or any of those merge accounts log in sites. If you can remove the accounts from each other. It makes the trail harder to follow.

Keep your accounts separate. Use different email addresses for different things. Never use your personal email linked to your shopping accounts for forums and other free services like Facebook. Use different passwords for each site if you can or a group of passwords for each type of site if you can't remember them all.

Clean out your webmail specially if you use gmail. Log in occasionally and clean out the mail it archives that shows where your accounts may be. I had my gmail hacked once so I do this alot.

I think right now this applies to all of us. No one is safe with info being posted right and left. So change your passwords!

Think of your online identity as a trail and make it hard for someone who may get one type of your info to follow the other.

Indeed. Just recently I got an email at my hotmail account saying they would have to close it down for some reason (I don't remember the wording) if they didn't hear from me by a certain date. I made inquiries and found out it was a pishing scam. They wanted my info. but needless to say they didn't get it. The email addy didn't look right for one thing. A private email rather than one from hotmail, and besides that why would hotmail need for me to send them my info? They already have it on file I would imagine. So I was suspicious from the start.

[crich70]

Originally Posted by Solicitous

I use a range of 4 passwords. Trouble is between all the accounts one has such as iTunes, work log on, your personal email, online banking, forums, various other sites (such as in aus the ato and aus post) you either need to narrow the number of passwords or write them all down. Trouble is if you write them down then one has the ease of seeing everywhere where you have an account.

Still one of the best things one can do is not link their cc with any account, so if one does get hacked you won't be out of pocket.

I use a Tiddlywiki on my local machine to keep track of sites and log in info. It works very well for me.

[lestatar]

Originally Posted by anachronicus

I use a free, open source password manager called keepass. It will remember all your passwords, and even generate them for you based on whatever criteria you choose. This way you can have strong, random passwords for each account. I highly recommend it or some other tool like it.

+1 Keepass is indeed quite excellent.

[shibamistress]

Yeah, call Amazon. One of my friends had something similar happen to her with AOL and she didn't know enough not to log in through the email. Of course it was a scam, and they got her credit card info., etc. Luckily for her, her credit card company is very vigilant and called her immediately to tell her they believed that someone had gotten her account information.

But I'd call them, for sure, rather than trusting this email. If it is legit, they'll help you get a new account set up.

[karunaji]

So, some people are getting their Amazon accounts compromised. The question is, how does it happen? Several possible answers:

1) It is due to trojans on those people computers. In this case as long as your computer remains compromised, changing passwords will not be very affective as the bad guys will get a new password soon. First you should ensure that your computer is secure.

2) Are Amazon servers broken in and data stolen? Not very likely but with the news how Sony and many other seemingly respectable companies have lost a lot of important customer info and even repeatedly so, everything is possible. Amazon should be more open how do they think these accounts are compromised.

3) Most likely version is that it is indeed connected with Sony and similar hacks and we see dangers of password reuse. In this case thieves now have your e-mail address and password that you use for another site and it happens that your Amazon login is exactly the same.

Amazon is one of very attractive targets. The thieves can easily order electronics worth thousands of dollars to be sent to any address they want as Amazon is less restrictive about sending items to a new address that is different from your billing account. My experience is that they will even send the stuff to another country without any question or asking for confirmation unlike many other online shops.

So be careful and change your password to a unique one. It doesn't have to be extremely complicated or long. It is enough that it cannot be easy guessed and different from any other password you may have for any other site.

[Refom1]

Originally Posted by karunaji

So, some people are getting their Amazon accounts compromised. The question is, how does it happen? Several possible answers:

Very simple-I guess you don't follow the news. A hacking group called Lulzsec hacked into a variety of different sites, stole email addresses and passwords, and posted them publicly. I had my Twitter, LinkedIn and iTunes accounts disabled due to "suspicious activity" and found out my info was among the 100,000 or so other people's that was stolen.

If you get an email from Amazon or any other place you do business at, and you aren't sure it's legit, there is no need to freak out. First off, does it address you by your name or the username you use on the site? Legit emails always will. Scam ones won't ever.

Most legit emails won't ask you to click on a link. They'll ask you to go to the site and log in or call them.

Finally, if there is a link in the message, simply take your cursor and HOVER (don't click) it over the link and look at the info bar. If the URL shown matches the link, it's good. If it's a phishing link, it'll be very obvious.

[Refom1]

Originally Posted by karunaji

The thieves can easily order electronics worth thousands of dollars to be sent to any address they want as Amazon is less restrictive about sending items to a new address that is different from your billing account.

This is simply not true. If you want to have an order shipped to an address that isn't already linked to your account, Amazon makes you re-input your credit card info. This is a very good thing. A scammer who got access to your account would not be able to have a thing shipped to him because he wouldn't have your CC info. Only the last 4 digits show on your account.

[karunaji]

Originally Posted by Sue7M3

This is simply not true. If you want to have an order shipped to an address that isn't already linked to your account, Amazon makes you re-input your credit card info. This is a very good thing. A scammer who got access to your account would not be able to have a thing shipped to him because he wouldn't have your CC info. Only the last 4 digits show on your account.

Good to know this but the infamous Sony data leak also included credit card numbers (and even direct debit bank account numbers for some countries).

So far Amazon do not employ Visa or Mastercard 3D Secure system and neither they send to the billing address only. They also have no requirement that the credit card belongs to the recipient of the goods.

Ease of purchase was justified when they only sold books. But now as an electronics store they must have adopted internal measures to actively monitor for fraud and suspend all suspicious accounts in advance.

[crich70]

Usually when I buy something at Amazon (books or other things) they send me a confirmation email letting me know that my purchase has gone through. So I would hope that if someone did manage to break into my amazon account and order something that an email would go out to me letting me know that my purchase had been accepted. I do have a letter and # password that I hope is unique to me anyway so it should be a challenge to any would be hackers.

[DMB]

Originally Posted by crich70

Indeed. Just recently I got an email at my hotmail account saying they would have to close it down for some reason (I don't remember the wording) if they didn't hear from me by a certain date. I made inquiries and found out it was a pishing scam. They wanted my info. but needless to say they didn't get it. The email addy didn't look right for one thing. A private email rather than one from hotmail, and besides that why would hotmail need for me to send them my info? They already have it on file I would imagine. So I was suspicious from the start.

I have long received those several times a week.

[tearofamuse]

I just joined. I wanted to pass on a bit of info I got way back when I first got the internet. Never, ever, ever save your passwords to your computer. I use a small notebook. I write down the website, user name, password, and any other security items in it. This ensures that each site has it's own unique info. If I need a security question answer, I make them up. I do not store the notebook in the open. If I need a password, I have to go get into the safe, which makes me try harder to remember them.

[Refom1]

Originally Posted by karunaji

So far Amazon do not employ Visa or Mastercard 3D Secure system and neither they send to the billing address only. They also have no requirement that the credit card belongs to the recipient of the goods.

You don't seem to have read my post. Amazon will not allow shipment of an order to an address not already linked to an account. They will ask you to re-input your credit card info. If someone were to gain access to your Amazon account and try to place an order, they wouldn't be able to get it shipped to them because they won't have your credit card details. So there is protection.

Amazon has not suffered a data breach. Lulzsec claims some of the email addresses and passwords they stole came from Amazon but there is no proof, and if it is true, you can not do very much with just someone's login info. You can't even buy a gift card without being forced to re-input your CC info.

Most retailers don't require the payment info belong to the recipient of the goods. This would make buying gifts for others and having them sent to the gift recipient impossible.

[karunaji]

Originally Posted by Sue7M3

You don't seem to have read my post.

I understood your post fine. I just added that credit card details were also stolen in Sony data leak (and otherwise available in great quantities to hackers in darknet). So, in some case it might be possible to thieves to re-enter cc data when required.

There are no indications that Amazon is hacked but that's not an issue. Many companies have been irresponsible with customer data. In any case how did Amazon knew that the account was hijacked? They surely knew something was not right. Maybe they correlated Sony leaked data with their customer activities and saw that some transactions that otherwise would look like gift shopping are most likely frauds.

[Refom1]

Originally Posted by karunaji

I understood your post fine. I just added that credit card details were also stolen in Sony data leak (and otherwise available in great quantities to hackers in darknet). So, in some case it might be possible to thieves to re-enter cc data when required.

There are no indications that Amazon is hacked but that's not an issue. Many companies have been irresponsible with customer data. In any case how did Amazon knew that the account was hijacked? They surely knew something was not right. Maybe they correlated Sony leaked data with their customer activities and saw that some transactions that otherwise would look like gift shopping are most likely frauds.

No they probably did what everyone else did and used the database that was made available. It allows anyone to input an email address and find out if it was compromised. I know this is how LinkedIn, Twitter, and iTunes did it.