4 ms·
I found it also pretty odd that I could use my Prime account to order things for a friend using my address for shipping and billing and his bank details for dir
by heffer 12y ago
I found it also pretty odd that I could use my Prime account to order things for a friend using my address for shipping and billing and his bank details for direct debit (which is the most common means of payment here on Amazon.de, I guess).
The other way around (his address, my bank details) also works without any further verification.
So I could basically just enter someone's bank details and hope the order ships to my anonymous forwarding address before they notice. The victim will then order her bank to refund the fraudulent direct debit transaction (thanks to SEPA she now has 13 months to file the request). Amazon will probably suspend the account but the perpetrator will obviously not care.
Even if it's less convenient (because not instantaneous) Amazon should be doing something similar to what PayPal does: transferring a few cents together with a verification code to the account for verification.
This scenario would hopefully only work if the account itself was compromised. But when looking at how overcredulous customer support seems to be it might well be possible to pull this off without actual access to the account.
- hga 12y agoI do this frequently, the use case is ordering things for my father, who's certainly capable of doing this on his own, but since I buy so much stuff from Amazon, starting a year after they opened, it's the most convenient way. Only difference is I'm in the US and charging it to a credit card of his. And a Prime account is not required (we recently split the difference on getting one). And if they're looking for fraud, that we have the same last name, and his billing address is about a mile away, could reassure them.
- MichaelGG 12y agoAmazon probably won't suspend the account because they don't like losing customers. Same reason they're generous with the returns. Verifying via a few cents is enormous in terms of ease-of-use. Holy crap, now I have to log into my bank and check transactions just to buy some stuff? No thanks. And, I know this isn't great logic, but I hope Amazon does nothing like PayPal.