A famous case of Amazon ATO (account take-over) was trivially executed where a fraudster would use one of the Amazon checkout paths with a credit card that they

A famous case of Amazon ATO (account take-over) was trivially executed where a fraudster would use one of the Amazon checkout paths with a credit card that they own (e.g. a disposable Visa gift card) but later add a victim's email so that the credit card would get added to the victim's account. The fraudster would then call Amazon support, impersonate the victim, proving their identity by using that credit card number, expiration date, and CVV, and claim that their phone is stolen. Amazon support would then "update" the victim's account with the phone number under fraudster's control. The fraudster would then use the "forgot password" flow to reset the victim's password using the phone. Game over, the fraudster now controls the account (and the real CCs added to it) through no fault of the victim (nor their knowledge). They would go on by purchasing electronic gift cards (iTunes/X-box/etc.) and selling the numbers on eBay for real money. This specific flow has since been fixed, but ATOs still happen much more than you can imagine.