7 ms·

I've been locked out of my AWS account for almost 3 years now. I have 2FA enabled, tied to a phone number I no longer have access to. I receive two emails per

I've been locked out of my AWS account for almost 3 years now. I have 2FA enabled, tied to a phone number I no longer have access to. I receive two emails per month. One invoice, for $0.80 (I cannot remember what is running on there, but I guess it must be something). One threatening, "Your AWS Account is about to be suspended". I've been "about to be suspended" for the entire 3 years. I want to pay the bill, I can't log in. I emailed, I phoned. Eventually I spoke to somebody, who told me the only way I could access my account was to fill in "some paperwork"[1]. They emailed that to me. It has to be notarized. I called again, they absolutely will not accept this if it is not notarized. I've explained to them that all I want to do is pay the ~$30 in bills I've accrued for 3 years. I don't mind if I never get access to the account - let me pay the bill and shut the account down, they won't have it. I don't have any free notary access, and I'm not willing to pay more than the AWS bill amount just to be able to pay the bill. I've explained that to them, and they don't seem to care about that either, they'd rather not have the bill payed and continue piling it up. [1] https://s3.amazonaws.com/AWSCS_CustomerForms/IdentityVerificationFormAffidavit.doc https://s3.amazonaws.com/AWSCS_CustomerForms/IdentityVerific...

otoburb 9y ago
The problem is that as they get bigger, they may soon automate delinquent account notifications to debt collection agencies which could impact your credit rating sometime down the line. You are unfortunately on the wrong side of an asymmetric relationship here.
- throwaway76543 9y ago
  That's solved by disputing the debt. Document the good faith attempts to pay.
  - djsumdog 9y ago
    Still a hassle you shouldn't have to go through.
  - CaptSpify 9y ago
    I take it you haven't actually tried disputing debt. It's not a simple process, and can wreak havoc on your credit even if you are clearly not at fault.
    - throwaway76543 9y ago
      I have disputed debt. Simple is relative, but I certainly did not have any trouble with the process. It's true that your credit can be damaged by false reports. It's also true that damages resulting from false reports are recoverable. If you don't feel like you can do it yourself, hire a lawyer and have them sue Amazon to recover their fee.
      - sschueller 9y ago
        They are not recoverable. Good luck trying to get your rewards back once the credit card company cancels your card because some moron enter you social security instead of someone else's at the dept collector. Sure you can get a new account once your credit score is back but you get no simpathy from the credit card company. Even after more than 10 years with them.
        throwaway76543 9y ago
        Of course they're recoverable. See JOHN STEVENSON vs. TRW for example. You seem to be saying lawsuits are a hassle. Yes, they are.
yellow_postit 9y ago
at what point does the debt get sold to a debt collector thus causing you more trouble and pain than paying for a notary would cost? Also if you're in the US and maintain a bank account, many banks offer free notary services.
- bitJericho 9y ago
  I love your willingness to be blackmailed.
  - softawre 9y ago
    It's practical advice.
  - freyir 9y ago
    It's not blackmail. He locked himself out of his account, and Amazon is erring on the side of caution before turning off services and shutting down accounts. While it might be a nuisance to get a document notarized, it's not some extraordinary hardship. The policy is there to prevent abuse. If he prefers to let his bill go unpaid as a result of locking himself out of his account, that's his choice.
    - bitJericho 9y ago
      You shouldn't have your credit ruined for not wanting to give up your documents to some shitty company.
      - manigandham 9y ago
        That's not what's happening here. Not paying your bills does rightly deserve a warning on credit reports. Not paying your bills because you lost access to your own account does not change this situation. The same way as that having no income or car or phone or internet and can't pay your other bills doesn't excuse those liabilities either.
    - tinus_hn 9y ago
ccleve 9y ago
You can get something notarized, at least in Illinois, for $1. Just go to a currency exchange. Most banks will do it for free.
- rewrew 9y ago
  Yes, my bank branch notarizes for free.
  - tankenmate 9y ago
    This is quite different in Australia where notaries public are appointed either by the State Supreme Court or by an Archbishop. Almost all of which of which are solicitors or barristers, sometimes retired from practice.
    - technion 9y ago
      As an Australian, if your workplace has a legal department - make friends with someone there. It can save you a huge headache when you need to do something like apply for a home loan, and need tonnes of notarised papers.
      - rewrew 9y ago
        In the US the bank sends a notary free of charge with all your paperwork to sign. What a pain that you don't get this service!
- foobarbazetc 9y ago
  The term "notarization" means very different things depending on the country you live in. Outside the US this process can be lengthy and/or expensive as it can even result in official government stamps, translations, etc.
  - thephyber 9y ago
    GP is in San Francisco. Standard notary fee is $20 in California, but some companies will subsidize it. I feel sorry for those foreign countries where notaries are either rarified or unobtainably expensive, but it doesn't apply to this thread. That said, I think Amazon's policy of notarization (at least in the US sense and fees) seems a reasonable policy from an account security standpoint. Not sure I can sympathize with GP who voluntarily added 2FA to their own Amazon account, then no longer had access to the phone number they previously used. $20 is not unreasonable for something that GP could have prevented with some forethought.
andrewvc 9y ago
The UPS store will notarize stuff for like $10-20 bucks FYI.
- CobrastanJorji 9y ago
  Unless you live in Kansas, Iowa, Maine, Alaska, or Louisiana, you won't be charged over $10.
mobiledev1 9y ago
your bank can usually notarize the document for free.
- leesalminen 9y ago
  This. I do it all the time. They have no problems with it.
analyst74 9y ago
I'm sorry for what you have to deal with, and I think as an industry we have definitely not thought through on the 2FA-over-phone system. But I feel like asking for a notorized letter confirming you are actually "you" is quite reasonable. Otherwise it'll be all too easy for malicious social engineering.
- Macha 9y ago
  What's the consequence of him being impersonated here though? Some fraudster pays his bill and gets nothing out of it?
  - eridius 9y ago
    Some fraudster shutting down an account that should actually be kept running, owned by someone who is merely very lax about paying bills.
    - CaptSpify 9y ago
      If you aren't paying your bills, then you shouldn't be surprised that it gets shut down.
      - leereeves 9y ago
        Who downvoted you for saying one shouldn't be surprised when an account gets shut down after not paying for 3 years? On that note: why hasn't the account been shut down for nonpayment?
        threatofrain 9y ago
        Maybe the debt needs to be groomed on paper before it's sold.
        jimrandomh 9y ago
        Presumably because that only happens when it crosses a threshold dollar amount, and $0.80/month isn't enough to get it over that threshold. (That price is too small for there to be a running instance; it's most likely for storage belonging to an instance that was shut down, such as a 16GB EBS snapshot. It is reasonable that Amazon would be very careful about deleting that.)
pierrebeaucamp 9y ago
The exact same thing happened to me. In my case I still had a t2 instance running and was billed ~15$ a month. Eventually I shut down the instance over ssh, but that didn't change the overall situation. I was studying in Germany at the time and access to a notary public costs about 40$ USD there. I asked the AWS support on the phone if letting the payments bounce would suspend my account which they confirmed. Unfortunately every time I disputed the payment with my bank, AWS send me a physical copy of their terms and my billing address as a proof of contract and my bank would process their payment. Eventually, 3 months in, my credit card expired anyway, solving at least that part. They still tried to charge me for about 6 months afterwards, but I haven't heard back from them since. Interestingly, I opened a second account, with the exact same billing address, but a different credit card without problem. But I don't really use AWS anymore since then. I totally believe that they (AWS) just stuck to their process, which was enacted in good faith. But switching my phone number should have not caused that entire fiasco.
breatheoften 9y ago
I'd be worried about them sending your account to collections -- would be annoying to take a credit hit over this ... insane as it is that you have no ability to resolve this situation now without hardship, you also won't have hardship free resolution path after it goes to collections ... I guess if it goes to collections you'll at least then be able to pay the debt collector -- but you'll still take a credit hit ...
kiehlster 9y ago
Have you made any attempt to work something out with whoever may have your old phone number? Explain the situation to them? Maybe they'd be kind enough send you the 2FA code for the account?
kinkrtyavimoodh 9y ago
I sympathize with your predicament, but I can say I am very happy to know that Amazon won't just let anybody get access to a 2FA account without a substantial burden of proof. We all read horror stories of people's accounts being compromised via trivial social engineering hacks. This will always be a balancing act. And to be honest I am all for erring on the side of caution.
vivekd 9y ago
I don't understand, why don't you just notarize the form and send it back to them, notaries are really cheap.
- Cacti 9y ago
  They like having something to complain about. The poster lives in/near SF and has hundreds of notaries available to them for 0 to minimal cost, time, and effort.
michaf 9y ago
I was locked out of my AWS account for about 2 years due to loosing my 2FA authenticator on my phone. But had no open bills and didn't really care about it, so I did not try to gain back access. Until last week, when I decided that I need to use the account again. I simply clicked the recovery link on their 2FA login form. Had to enter my account details and my phone number. Within 15 minutes (as stated on the website) a member of their service team called me. I explained the situation (lost 2FA app). Not a problem, the service agent told me. He then sent me an e-mail (to my AWS-associated mail address) with some random characters, which I had to read back to him. After that he simply removed 2FA, and I was able to log in with my username/password. For me the experience was quite pleasant, but had someone else have access to my e-mail account and knew my AWS username/password, he might have been able to take over my account, bypassing 2FA. I don't quite know how to feel about that. EDIT: Ok, this probably only works if your phone number is also already associated with your account. So an attacker additionally would need access to my phone number, making things quite a bit more secure in my view.
- kavok 9y ago
  Could the number be spoofed?
  - pjc50 9y ago
    Unfortunately, yes - by going through the customer services of most mobile phone companies.
- chinathrow 9y ago
  As of late, transferred phone numbers against the owners will is a thing.
user5994461 9y ago
Cancel your card. Problem solved.
- CydeWeys 9y ago
  To clarify, get a new number for your credit card account; don't cancel it entirely. If it's your oldest credit card account then canceling it outright will have bad repercussions for your credit score.
  - tzs 9y ago
    That's not necessarily sufficient. If the card is a Visa or MC and credit card uses the card update service that is available for such cards then that might give Amazon the new card number on the account. I believe that whether or not the update service works for a specific card is up to the entity that issued that card.
    - kelnos 9y ago
      If you report the card as lost or stolen, I would guess that the update service wouldn't be used: the bank likely doesn't want to update the card number with someone who might have added it fraudulently.
hinkley 9y ago
Ask the office manager at your job if there's a notary public on staff. It's not uncommon for one of the assistants or the office manager to get certified as a notary. It's very useful for small office situations and short deadlines.
Cacti 9y ago
You're willing to pay the $30, $40, $50 AWS bill for services you aren't using but the $5 notary charge is some grave affront?
- Lev1a 9y ago
  As said already in other comments of sibling thread: notary fees can differ hugely depending on state/country and may be more on the order of $40-$50.
  - pbhjpbhj 9y ago
    Having a brief search around the standard UK price per page of document to be notarised seems to be £60. Or, as here, ~£200 per hour - http://www.premiersolicitors.co.uk/Legalisation,11332,10160,11328,0.html http://www.premiersolicitors.co.uk/Legalisation,11332,10160,....
  - kelnos 9y ago
    As said already in other comments: the poster is in San Francisco. Last time I had to get something notarized in SF, I went to a UPS Store and it cost me $15.
manigandham 9y ago
Their security worked, you lost access so this is entirely your problem. I'm happy to see that AWS requires notarization to get past 2FA. Regardless of the size of the bill, comparing it to cost of a notary (which is very minimal) is irrelevant.
ouid 9y ago
Have you tried calling your old phone number and seeing if it's been recycled? You could have that person do the second factor for you.
ta667788 9y ago
I recently noticed a $20-30 charge each month from 'Amazon Web Services' on the credit card and vaguely recall signing up and trialing it one day (must have left a small instance running I guess too). I had to cancel that credit card in the end as I couldn't get access to the account and their support is, as far as I can tell, automated email responses. I also had the threat to suspend my account over many days (to which I was responding, 'Yes, please do'), but they stubbornly just kept threatening instead of closing the account. The support person did not seem to respond to what I wrote in my replies at all, just pasted a stock response that didn't make sense in context. They really cannot seem to handle their scale in terms of their customer support (and I wonder how many people are getting bitten for small chunks of cash).

otoburb 9y ago

The problem is that as they get bigger, they may soon automate delinquent account notifications to debt collection agencies which could impact your credit rating sometime down the line. You are unfortunately on the wrong side of an asymmetric relationship here.

throwaway76543 9y ago
That's solved by disputing the debt. Document the good faith attempts to pay.
- djsumdog 9y ago
  Still a hassle you shouldn't have to go through.
- CaptSpify 9y ago
  I take it you haven't actually tried disputing debt. It's not a simple process, and can wreak havoc on your credit even if you are clearly not at fault.
  - throwaway76543 9y ago
    I have disputed debt. Simple is relative, but I certainly did not have any trouble with the process. It's true that your credit can be damaged by false reports. It's also true that damages resulting from false reports are recoverable. If you don't feel like you can do it yourself, hire a lawyer and have them sue Amazon to recover their fee.
    - sschueller 9y ago
      They are not recoverable. Good luck trying to get your rewards back once the credit card company cancels your card because some moron enter you social security instead of someone else's at the dept collector. Sure you can get a new account once your credit score is back but you get no simpathy from the credit card company. Even after more than 10 years with them.
      - throwaway76543 9y ago
        Of course they're recoverable. See JOHN STEVENSON vs. TRW for example. You seem to be saying lawsuits are a hassle. Yes, they are.

yellow_postit 9y ago

at what point does the debt get sold to a debt collector thus causing you more trouble and pain than paying for a notary would cost? Also if you're in the US and maintain a bank account, many banks offer free notary services.

bitJericho 9y ago
I love your willingness to be blackmailed.
- softawre 9y ago
  It's practical advice.
- freyir 9y ago
  It's not blackmail. He locked himself out of his account, and Amazon is erring on the side of caution before turning off services and shutting down accounts. While it might be a nuisance to get a document notarized, it's not some extraordinary hardship. The policy is there to prevent abuse. If he prefers to let his bill go unpaid as a result of locking himself out of his account, that's his choice.
  - bitJericho 9y ago
    You shouldn't have your credit ruined for not wanting to give up your documents to some shitty company.
    - manigandham 9y ago
      That's not what's happening here. Not paying your bills does rightly deserve a warning on credit reports. Not paying your bills because you lost access to your own account does not change this situation. The same way as that having no income or car or phone or internet and can't pay your other bills doesn't excuse those liabilities either.
  - tinus_hn 9y ago

ccleve 9y ago

You can get something notarized, at least in Illinois, for $1. Just go to a currency exchange. Most banks will do it for free.

rewrew 9y ago
Yes, my bank branch notarizes for free.
- tankenmate 9y ago
  This is quite different in Australia where notaries public are appointed either by the State Supreme Court or by an Archbishop. Almost all of which of which are solicitors or barristers, sometimes retired from practice.
  - technion 9y ago
    As an Australian, if your workplace has a legal department - make friends with someone there. It can save you a huge headache when you need to do something like apply for a home loan, and need tonnes of notarised papers.
    - rewrew 9y ago
      In the US the bank sends a notary free of charge with all your paperwork to sign. What a pain that you don't get this service!
foobarbazetc 9y ago
The term "notarization" means very different things depending on the country you live in. Outside the US this process can be lengthy and/or expensive as it can even result in official government stamps, translations, etc.
- thephyber 9y ago
  GP is in San Francisco. Standard notary fee is $20 in California, but some companies will subsidize it. I feel sorry for those foreign countries where notaries are either rarified or unobtainably expensive, but it doesn't apply to this thread. That said, I think Amazon's policy of notarization (at least in the US sense and fees) seems a reasonable policy from an account security standpoint. Not sure I can sympathize with GP who voluntarily added 2FA to their own Amazon account, then no longer had access to the phone number they previously used. $20 is not unreasonable for something that GP could have prevented with some forethought.

andrewvc 9y ago

The UPS store will notarize stuff for like $10-20 bucks FYI.

CobrastanJorji 9y ago
Unless you live in Kansas, Iowa, Maine, Alaska, or Louisiana, you won't be charged over $10.

mobiledev1 9y ago

your bank can usually notarize the document for free.

leesalminen 9y ago
This. I do it all the time. They have no problems with it.

analyst74 9y ago

I'm sorry for what you have to deal with, and I think as an industry we have definitely not thought through on the 2FA-over-phone system. But I feel like asking for a notorized letter confirming you are actually "you" is quite reasonable. Otherwise it'll be all too easy for malicious social engineering.

Macha 9y ago
What's the consequence of him being impersonated here though? Some fraudster pays his bill and gets nothing out of it?
- eridius 9y ago
  Some fraudster shutting down an account that should actually be kept running, owned by someone who is merely very lax about paying bills.
  - CaptSpify 9y ago
    If you aren't paying your bills, then you shouldn't be surprised that it gets shut down.
    - leereeves 9y ago
      Who downvoted you for saying one shouldn't be surprised when an account gets shut down after not paying for 3 years? On that note: why hasn't the account been shut down for nonpayment?
      - threatofrain 9y ago
        Maybe the debt needs to be groomed on paper before it's sold.
      - jimrandomh 9y ago
        Presumably because that only happens when it crosses a threshold dollar amount, and $0.80/month isn't enough to get it over that threshold. (That price is too small for there to be a running instance; it's most likely for storage belonging to an instance that was shut down, such as a 16GB EBS snapshot. It is reasonable that Amazon would be very careful about deleting that.)

pierrebeaucamp 9y ago

The exact same thing happened to me. In my case I still had a t2 instance running and was billed ~15$ a month. Eventually I shut down the instance over ssh, but that didn't change the overall situation. I was studying in Germany at the time and access to a notary public costs about 40$ USD there. I asked the AWS support on the phone if letting the payments bounce would suspend my account which they confirmed. Unfortunately every time I disputed the payment with my bank, AWS send me a physical copy of their terms and my billing address as a proof of contract and my bank would process their payment. Eventually, 3 months in, my credit card expired anyway, solving at least that part. They still tried to charge me for about 6 months afterwards, but I haven't heard back from them since. Interestingly, I opened a second account, with the exact same billing address, but a different credit card without problem. But I don't really use AWS anymore since then. I totally believe that they (AWS) just stuck to their process, which was enacted in good faith. But switching my phone number should have not caused that entire fiasco.

breatheoften 9y ago

I'd be worried about them sending your account to collections -- would be annoying to take a credit hit over this ... insane as it is that you have no ability to resolve this situation now without hardship, you also won't have hardship free resolution path after it goes to collections ... I guess if it goes to collections you'll at least then be able to pay the debt collector -- but you'll still take a credit hit ...

kiehlster 9y ago

Have you made any attempt to work something out with whoever may have your old phone number? Explain the situation to them? Maybe they'd be kind enough send you the 2FA code for the account?

kinkrtyavimoodh 9y ago

I sympathize with your predicament, but I can say I am very happy to know that Amazon won't just let anybody get access to a 2FA account without a substantial burden of proof. We all read horror stories of people's accounts being compromised via trivial social engineering hacks. This will always be a balancing act. And to be honest I am all for erring on the side of caution.

vivekd 9y ago

I don't understand, why don't you just notarize the form and send it back to them, notaries are really cheap.

Cacti 9y ago
They like having something to complain about. The poster lives in/near SF and has hundreds of notaries available to them for 0 to minimal cost, time, and effort.

michaf 9y ago

I was locked out of my AWS account for about 2 years due to loosing my 2FA authenticator on my phone. But had no open bills and didn't really care about it, so I did not try to gain back access. Until last week, when I decided that I need to use the account again. I simply clicked the recovery link on their 2FA login form. Had to enter my account details and my phone number. Within 15 minutes (as stated on the website) a member of their service team called me. I explained the situation (lost 2FA app). Not a problem, the service agent told me. He then sent me an e-mail (to my AWS-associated mail address) with some random characters, which I had to read back to him. After that he simply removed 2FA, and I was able to log in with my username/password. For me the experience was quite pleasant, but had someone else have access to my e-mail account and knew my AWS username/password, he might have been able to take over my account, bypassing 2FA. I don't quite know how to feel about that. EDIT: Ok, this probably only works if your phone number is also already associated with your account. So an attacker additionally would need access to my phone number, making things quite a bit more secure in my view.

kavok 9y ago
Could the number be spoofed?
- pjc50 9y ago
  Unfortunately, yes - by going through the customer services of most mobile phone companies.
chinathrow 9y ago
As of late, transferred phone numbers against the owners will is a thing.

user5994461 9y ago

Cancel your card. Problem solved.

CydeWeys 9y ago
To clarify, get a new number for your credit card account; don't cancel it entirely. If it's your oldest credit card account then canceling it outright will have bad repercussions for your credit score.
- tzs 9y ago
  That's not necessarily sufficient. If the card is a Visa or MC and credit card uses the card update service that is available for such cards then that might give Amazon the new card number on the account. I believe that whether or not the update service works for a specific card is up to the entity that issued that card.
  - kelnos 9y ago
    If you report the card as lost or stolen, I would guess that the update service wouldn't be used: the bank likely doesn't want to update the card number with someone who might have added it fraudulently.

hinkley 9y ago

Ask the office manager at your job if there's a notary public on staff. It's not uncommon for one of the assistants or the office manager to get certified as a notary. It's very useful for small office situations and short deadlines.

Cacti 9y ago

You're willing to pay the $30, $40, $50 AWS bill for services you aren't using but the $5 notary charge is some grave affront?

Lev1a 9y ago
As said already in other comments of sibling thread: notary fees can differ hugely depending on state/country and may be more on the order of $40-$50.
- pbhjpbhj 9y ago
  Having a brief search around the standard UK price per page of document to be notarised seems to be £60. Or, as here, ~£200 per hour - http://www.premiersolicitors.co.uk/Legalisation,11332,10160,11328,0.html http://www.premiersolicitors.co.uk/Legalisation,11332,10160,....
- kelnos 9y ago
  As said already in other comments: the poster is in San Francisco. Last time I had to get something notarized in SF, I went to a UPS Store and it cost me $15.

manigandham 9y ago

Their security worked, you lost access so this is entirely your problem. I'm happy to see that AWS requires notarization to get past 2FA. Regardless of the size of the bill, comparing it to cost of a notary (which is very minimal) is irrelevant.

ouid 9y ago

Have you tried calling your old phone number and seeing if it's been recycled? You could have that person do the second factor for you.

ta667788 9y ago

I recently noticed a $20-30 charge each month from 'Amazon Web Services' on the credit card and vaguely recall signing up and trialing it one day (must have left a small instance running I guess too). I had to cancel that credit card in the end as I couldn't get access to the account and their support is, as far as I can tell, automated email responses. I also had the threat to suspend my account over many days (to which I was responding, 'Yes, please do'), but they stubbornly just kept threatening instead of closing the account. The support person did not seem to respond to what I wrote in my replies at all, just pasted a stock response that didn't make sense in context. They really cannot seem to handle their scale in terms of their customer support (and I wonder how many people are getting bitten for small chunks of cash).