5 ms·

8 days ago I tried to log in to my Amazon retail account, and received a password invalid error. As it turned out my account had been closed, as it appeared to

8 days ago I tried to log in to my Amazon retail account, and received a password invalid error. As it turned out my account had been closed, as it appeared to Amazon that it had received a suspicious log in. This is the same account that I use for AWS - hosting websites critical to my business. Today it appears I am no closer to gaining access back to my AWS account than I was on day 1, even though I have been billed as normal for my services during this time. This should serve as a warning to anybody else who has an Amazon account that is shared between retail and AWS. Linked is a list of every event and interaction I have had during the last 8 days with Amazon, via Twitter, email, phone and chat.

btown 9y ago
Are services offline or are you just locked from accessing the account?
- deleted 9y ago
  [deleted]
- colinmeinke 9y ago
  My services are still online, so it's not a total disaster (yet), but I cannot sign in to the AWS control panel.
  - emeraldd 9y ago
    Definitely time to change services ...
digi_owl 9y ago
If anything this, along with similar situation(s?) with Google, should stand as a strong warning against single sign on systems across multiple services with multiple TOS.
- willow9886 9y ago
  Why do you see this as a single sign-on issue? Seems to me the issue is over reliance on large SaaS providers. Same things happens all the time to Google users.
  - mintplant 9y ago
    Because if you lose that single sign-on account, you lose everything attached to it as well.
    - willow9886 9y ago
      Amazon offers many services, of course they are going to want users to have one set of credentials to access all those services. There are trade-offs to every security approach, but storing passwords at every web service is 100x worse.
      - Hnrobert42 9y ago
        I don't understand your concern. We all have numerous accounts all over the web. Having one or two more doesn't increase our attack surface 100x.
      - aquadrop 9y ago
        What have passwords anything to do with this?
  - MichaelGG 9y ago
    Because you're unlikey to trigger a violation on your cloud SaaS account, but could easily run afoul of other policies like "Real Name" or "Bought a Pixel Phone and Sold It" or posting something "offensive", getting reported by other users, etc. If the account is just for a cloud SaaS, then there's likely to be very few policies to disable your account.
    - willow9886 9y ago
joelrunyon 9y ago
This happened to me with instagram. I reset a password, then they detected "suspicious activity." I clicked "send pin via email" and the email never shows up. I've done it 3 or 4 times over the course of a week + it never works. It's a documented error + FB/Instagram refuse to addres it. https://medium.com/@joelrunyon/instagrams-security-features-are-broken-and-they-won-t-do-anything-about-it-16233f0935b0 https://medium.com/@joelrunyon/instagrams-security-features-...
- legohead 9y ago
  And a similar thing has happened to me with Microsoft. I needed to get to my OneDrive. I go to log in, and it says invalid password. I go to reset the password, and it never sends me an email. I go through the alternate-email update process, answer the security questions, and it doesn't believe I am who I am. When I try to get access to real support (a person), it makes me login. Back to problem #1. Also, I should note that the email on record is real and works. The only thing I can think of is I named it microsoft@mydomain, and they don't like the word microsoft in it?
  - sly010 9y ago
    Same here (email never arrived) with my Apple Developer Account.
    - wlesieutre 9y ago
      I got into a similar situation when Apple prompted me to turn on 2-factor auth, and then after I accepted it wouldn't send 2-factor codes. Thankfully the "we turned on 2-factor" email gives you a link to turn it back off within 30 days or I would have been in some trouble.
  - joelrunyon 9y ago
    This is worse because at least with mine, they send the reset password (so I know they have the right email on file). Then, when they send the PIN to the same email - it never actually shows up. Ugh.
- 9y ago
Twirrim 9y ago
In all seriousness, email jeff@amazon.com. The most likely outcome is that some relevant managers will receive one of the infamous "?" emails from him. If so, that'll result in two things: 1) Your problem will be resolved ASAP, managers right up the chain will be tracking it extremely closely, as they'll have to justify every action to Jeff. Everyone goes scrambling when one of those emails goes out. 2) A post-mortem will be done of everything that happened, with processes and procedures improved to ensure it doesn't happen again.
- sleepychu 9y ago
  Can you provide some links to stuff about the infamous "?" emails?
  - trevyn 9y ago
    This page has 10 such links. 8-) https://www.google.com/search?q=bezos+question+mark+email https://www.google.com/search?q=bezos+question+mark+email
    - sleepychu 9y ago
      Duckduckgo wasn't so helpful with this one. :-(
  - deleted 9y ago
    [deleted]
  - adrianpike 9y ago
    Here's a couple I found: https://www.quora.com/Whats-it-like-to-receive-a-question-mark-e-mail-from-Jeff-Bezos-at-Amazon-Inc https://www.quora.com/Whats-it-like-to-receive-a-question-ma... https://www.inc.com/bill-murphy-jr/customer-service-jeff-bezos-question-mark-rule.html https://www.inc.com/bill-murphy-jr/customer-service-jeff-bez...
  - Twirrim 9y ago
    https://www.bloomberg.com/news/articles/2013-10-10/jeff-bezos-and-the-age-of-amazon-excerpt-from-the-everything-store-by-brad-stone https://www.bloomberg.com/news/articles/2013-10-10/jeff-bezo... and a little bit here: https://www.quora.com/Whats-it-like-to-receive-a-question-mark-e-mail-from-Jeff-Bezos-at-Amazon-Inc https://www.quora.com/Whats-it-like-to-receive-a-question-ma... No one inside Amazon wants to receive a question mark email from Jeff, and a number of the VPs have picked up the habit too.
buro9 9y ago
> This should serve as a warning to anybody else who has an Amazon account that is shared between retail and AWS. So much this. I had such an account and neglected the retail side (it was linked to amazon.com as well as AWS) as I was using a different account for retail (linked to amazon.co.uk from the days that these were separate systems). Logging on to amazon.com one day I noticed LastPass suggest I log in, so I did. To see that I hadn't ordered anything retail for 5+ years. So I requested deletion of the amazon.com account (good hygiene, delete unused accounts). Retail happily obliged... and a week later when payment failed and dunning started I realised what I had done. The account did not exist any more, I could not login to resolve this. This was entirely my mistake (and quite funny as well as terrifying), but the risk is real. Should anything happen to your retail account then your AWS account can and will suffer. I managed to resolve this, I was only using S3 and I wrote a migration tool to remotely move S3 items from one account to another, using only the auth keys that were still active. But woah... if I'd been using EC2 or anything else I would have been in a lot of trouble. Keep accounts single purpose and obvious. Use an account that only handles your AWS purchases.
birdman3131 9y ago
A friend had this happen to him (The unauthorized person accessing it). He sells on amazon and had all his inventory removed from being sold while this was going on. Calls did nothing. What finally worked was the amazon facebook page. He posted on there, they PMed him and he was back up and going within a couple hours where he had been getting the run around for a week or two on the phone.
allthecybers 9y ago
I had this happen because of a closed AWS account with 2FA that locked out my longtime Amazon.com retail account. The 2FA factor was a business phone number that I had given back to my former employer a couple of years ago. The best that AWS/Amazon support could give me is start a new Amazon.com account. At least the AWS account wasn't billing anything.

btown 9y ago

Are services offline or are you just locked from accessing the account?

deleted 9y ago
[deleted]
colinmeinke 9y ago
My services are still online, so it's not a total disaster (yet), but I cannot sign in to the AWS control panel.
- emeraldd 9y ago
  Definitely time to change services ...

digi_owl 9y ago

If anything this, along with similar situation(s?) with Google, should stand as a strong warning against single sign on systems across multiple services with multiple TOS.

willow9886 9y ago
Why do you see this as a single sign-on issue? Seems to me the issue is over reliance on large SaaS providers. Same things happens all the time to Google users.
- mintplant 9y ago
  Because if you lose that single sign-on account, you lose everything attached to it as well.
  - willow9886 9y ago
    Amazon offers many services, of course they are going to want users to have one set of credentials to access all those services. There are trade-offs to every security approach, but storing passwords at every web service is 100x worse.
    - Hnrobert42 9y ago
      I don't understand your concern. We all have numerous accounts all over the web. Having one or two more doesn't increase our attack surface 100x.
    - aquadrop 9y ago
      What have passwords anything to do with this?
- MichaelGG 9y ago
  Because you're unlikey to trigger a violation on your cloud SaaS account, but could easily run afoul of other policies like "Real Name" or "Bought a Pixel Phone and Sold It" or posting something "offensive", getting reported by other users, etc. If the account is just for a cloud SaaS, then there's likely to be very few policies to disable your account.
  - willow9886 9y ago

joelrunyon 9y ago

This happened to me with instagram. I reset a password, then they detected "suspicious activity." I clicked "send pin via email" and the email never shows up. I've done it 3 or 4 times over the course of a week + it never works. It's a documented error + FB/Instagram refuse to addres it. https://medium.com/@joelrunyon/instagrams-security-features-are-broken-and-they-won-t-do-anything-about-it-16233f0935b0 https://medium.com/@joelrunyon/instagrams-security-features-...

legohead 9y ago
And a similar thing has happened to me with Microsoft. I needed to get to my OneDrive. I go to log in, and it says invalid password. I go to reset the password, and it never sends me an email. I go through the alternate-email update process, answer the security questions, and it doesn't believe I am who I am. When I try to get access to real support (a person), it makes me login. Back to problem #1. Also, I should note that the email on record is real and works. The only thing I can think of is I named it microsoft@mydomain, and they don't like the word microsoft in it?
- sly010 9y ago
  Same here (email never arrived) with my Apple Developer Account.
  - wlesieutre 9y ago
    I got into a similar situation when Apple prompted me to turn on 2-factor auth, and then after I accepted it wouldn't send 2-factor codes. Thankfully the "we turned on 2-factor" email gives you a link to turn it back off within 30 days or I would have been in some trouble.
- joelrunyon 9y ago
  This is worse because at least with mine, they send the reset password (so I know they have the right email on file). Then, when they send the PIN to the same email - it never actually shows up. Ugh.
9y ago

Twirrim 9y ago

In all seriousness, email jeff@amazon.com. The most likely outcome is that some relevant managers will receive one of the infamous "?" emails from him. If so, that'll result in two things: 1) Your problem will be resolved ASAP, managers right up the chain will be tracking it extremely closely, as they'll have to justify every action to Jeff. Everyone goes scrambling when one of those emails goes out. 2) A post-mortem will be done of everything that happened, with processes and procedures improved to ensure it doesn't happen again.

sleepychu 9y ago
Can you provide some links to stuff about the infamous "?" emails?
- trevyn 9y ago
  This page has 10 such links. 8-) https://www.google.com/search?q=bezos+question+mark+email https://www.google.com/search?q=bezos+question+mark+email
  - sleepychu 9y ago
    Duckduckgo wasn't so helpful with this one. :-(
- deleted 9y ago
  [deleted]
- adrianpike 9y ago
  Here's a couple I found: https://www.quora.com/Whats-it-like-to-receive-a-question-mark-e-mail-from-Jeff-Bezos-at-Amazon-Inc https://www.quora.com/Whats-it-like-to-receive-a-question-ma... https://www.inc.com/bill-murphy-jr/customer-service-jeff-bezos-question-mark-rule.html https://www.inc.com/bill-murphy-jr/customer-service-jeff-bez...
- Twirrim 9y ago
  https://www.bloomberg.com/news/articles/2013-10-10/jeff-bezos-and-the-age-of-amazon-excerpt-from-the-everything-store-by-brad-stone https://www.bloomberg.com/news/articles/2013-10-10/jeff-bezo... and a little bit here: https://www.quora.com/Whats-it-like-to-receive-a-question-mark-e-mail-from-Jeff-Bezos-at-Amazon-Inc https://www.quora.com/Whats-it-like-to-receive-a-question-ma... No one inside Amazon wants to receive a question mark email from Jeff, and a number of the VPs have picked up the habit too.

buro9 9y ago

> This should serve as a warning to anybody else who has an Amazon account that is shared between retail and AWS. So much this. I had such an account and neglected the retail side (it was linked to amazon.com as well as AWS) as I was using a different account for retail (linked to amazon.co.uk from the days that these were separate systems). Logging on to amazon.com one day I noticed LastPass suggest I log in, so I did. To see that I hadn't ordered anything retail for 5+ years. So I requested deletion of the amazon.com account (good hygiene, delete unused accounts). Retail happily obliged... and a week later when payment failed and dunning started I realised what I had done. The account did not exist any more, I could not login to resolve this. This was entirely my mistake (and quite funny as well as terrifying), but the risk is real. Should anything happen to your retail account then your AWS account can and will suffer. I managed to resolve this, I was only using S3 and I wrote a migration tool to remotely move S3 items from one account to another, using only the auth keys that were still active. But woah... if I'd been using EC2 or anything else I would have been in a lot of trouble. Keep accounts single purpose and obvious. Use an account that only handles your AWS purchases.

birdman3131 9y ago

A friend had this happen to him (The unauthorized person accessing it). He sells on amazon and had all his inventory removed from being sold while this was going on. Calls did nothing. What finally worked was the amazon facebook page. He posted on there, they PMed him and he was back up and going within a couple hours where he had been getting the run around for a week or two on the phone.

allthecybers 9y ago

I had this happen because of a closed AWS account with 2FA that locked out my longtime Amazon.com retail account. The 2FA factor was a business phone number that I had given back to my former employer a couple of years ago. The best that AWS/Amazon support could give me is start a new Amazon.com account. At least the AWS account wasn't billing anything.