Yeah, that's exactly the point. If the process takes couple of days and they do a lot of communication, there is a good chance the real owner of the account wi

Yeah, that's exactly the point. If the process takes couple of days and they do a lot of communication, there is a good chance the real owner of the account will get notified and have time to react before the attacker gets access to the account. Also, the commenters are completely wrong on that it is enough to have the email or ID to get through the process. The AWS people who contacted me required a lot more information that only the owner of the account would know.