6 ms·

Amazon just told me to log into someone else's account – and delete it

• r00fus 12y ago
  So Amazon's Kindle account creation process doesn't ask the user to verify their email prior to associating it with an account? Sounds very sloppy. Could it be a regression, or was it always this way? I wonder if this could be used to spearphish or scam someone somehow?
  • wl 12y ago
    I have a first initial last name gmail account and I see a lot of this kind of thing. Tons of companies don't verify email addresses and many make it impossible to do anything about it. Cell phone companies, banks, insurance companies, PayPal, eBay, Apple... it's getting rather ridiculous at this point.
    • r00fus 12y ago
      I wonder if a shaming campaign like plaintextoffenders would be productive...
    • knodi123 12y ago
      Tell me about it . My gmail account is actually the name of a common job title, and I get tons of stuff. Constant stream of resumes from india. Lots of random account signup confirmations. Once a guy set up his motion activated webcam to send me snapshots whenever it saw something, that was creepy. But I do love my vanity address, so I'll live with it! :-)
    • Doctor_Fegg 12y ago
      Tangentially related and amusing anecdote: http://dotat.at/tmp/railtrack.pdf http://dotat.at/tmp/railtrack.pdf (summary: troublemaker registers 'Railtrack Ltd' as UK limited company after dissolution of the previous Railtrack, which owned the country's rail network; long succession of solicitors, land agents etc. fail to do basic research and send legal demands to this new Railtrack Ltd; merriment ensues)
    • 5555624 12y ago
      Mine is a first and middle initial and last name gmail account. Some woman just bought a Honda and I get email from the dealership. I get contracts and song demos for an American country music singer-songwriter. (I get email from his pickup truck dealership all the time, too.) Someone else just applied for a job at Wells Fargo. Some guy is building a house in North Carolina. Attempts to correct the problem rarely work. In South Africa, someone with the same initials added his wife's initial before the last name and once I figured that out, I've been able to correct realtors and banks. (I've gotten copies of leases and loan documents.) He and I have exchanged a few emails about it. His wife even invited me to their twins birthday party.
    • wrs 12y ago
      I have a fairly common name with first.last@gmail.com and have a whole set of filter rules to get rid of the mail that can't be stopped. Once someone with my name signed me up for what seemed to be every dating website in Europe. I resisted the temptation.
  • dnorton 12y ago
    Neither does Apple. Someone used my email address for their iCloud account. (no, not JL.)
  • wmf 12y ago
    Email verification probably reduces conversions which is lost money. Why refuse to take someone's money just because they don't know their own email address?
• skamoen 12y ago
  This guy doesn't seem to be willing to actually help you. I'd consider trying a new chat session with, hopefully, a new guy who's capable of doing his job.
  • exelius 12y ago
    Sounds more like he doesn't have the tools to help because Amazon had locked him out. As a side note, this is how customer service becomes terrible. Security audits turn up processes that allow social engineering attacks, so they lock down the customer service tools. Agents get confused, so they implement rigid procedures (i.e. you can be fired for going off-script). These rigid procedures can be executed by a trained monkey at minimum wage, so agent quality declines. Rinse and repeat for a few decades and you get Comcast customer service.
    • toong 12y ago
      Wow, the idea that he really doesn't have the tools to help out didn't even enter my mind. I was just assuming ignorance/incompetence ? Still .. Hanlon's razor is in my head :-) Edit: if the customer-support-tools really are locked down, shouldn't they have a procedure to escalate ? Telling a user to break the law to help himself out should not be standard practice after all.
      • exelius 12y ago
        He may not have the tools as a security precaution: when you're a huge company like Amazon, you're going to hire a few bad apples. So you don't want to give all of your support reps access to every account (though maybe you have a few managers who do), which is why the security questions exist. Furthermore, I don't even know what Amazon is supposed to do in this instance. They would normally e-mail the user, but that's obviously not going to work in this case. I guess they could send a snail mail letter, but even then this is probably enough of an edge case there's no policy around it, and as such no automated form letter to send or system to send it from. If their support reps are taught to never deviate from policy, he may have gotten confused and given up (this happens any time you hire anyone under ~$15/hr: you have to pay them enough to care). I would guess he could have gotten a better response by jumping on LinkedIn and finding a VP of customer support and e-mailing them directly. At a company with the velocity Amazon has, they still see one-in-a-million errors a few dozen times a year, so it's not a bad idea to address them as they come up.
• Justin_K 12y ago
  I had the same issue with my Adobe account. Someone created an account in another country, with my email address. I took the liberty of doing a password reset own my to reclaim the address. Luckily, the user had purchased nothing. I had to then go through Adobe support to reset the country, as I couldn't do it on my own. I too was surprised that there was no process to verify the email address. What a joke!
• anonbanker 12y ago
  If we can use trust law as our starting point (trust = shared title to property), then we see that an Amazon/Kindle account is just a trust between you, amazon, and this other party. The only one investing money in the trust is this third party. If you delete the account, you have two of the three parties' agreements documented. You need all three, in order to be able to claim that nobody's rights are being infringed. This can be done by making a good faith effort to notice the third party via multiple forms of communication. Even if they don't get to the party, you need to at least make the attempt. Send a first notice, wait ten days, if no response, send a second notice. If no response, consider that your acquiescence, and delete the account.
  • coldpie 12y ago
    Yeah, trying to contact the user seems like a reasonable thing to do. If you've got her name, you can probably dig up an email or social media account.
  • jellicle 12y ago
    It's not possible to contact the third party without logging into "their" account, which is a crime under the Computer Fraud and Abuse Act. The act of getting that contact info from someone else's account is precisely what the CFAA exists to illegalize.
    • Roedou 12y ago
      I assumed there was a law somewhere I'd be breaking; thanks for letting me know what it is.
      • anonbanker 12y ago
        not so fast[1]. 1. https://news.ycombinator.com/item?id=8522250 https://news.ycombinator.com/item?id=8522250
    • anonbanker 12y ago
      by using your email address, they have entered you into this trust with them. As such, you have a claim to ownership of the account. The Computer Fraud and Abuse Act only covers accounts that do not belong to you, and being this one partially does, you are within your rights to use the account to contact the other owners.
• pwarner 12y ago
  I had a very similar problem with ebay. Account made with my email, not me. Again, no email verification. To make it worse I couldn't log in and delete the account since ebay required security questions to do a password reset. I ended up trying to track down and call the person, it was a while ago but I think I even sent them snail mail. (there was enough info in the emails to track them down, maybe a shipping address when they won an auction?) Eventually they stopped, but no thanks to ebay. Why is email address verification not more standard?
  • livingparadox 12y ago
    I had this happen to me too, but no security questions. So I just deleted the account.
  • russell_h 12y ago
    Thats funny, a month or so ago I tried to sign up for an eBay account and never managed to make it through the buggy email verification. Last I checked I still can't use the account, or create another with the same email address.
• robbrown451 12y ago
  I would place a bet that now that this is on HN, someone at Amazon will tell you no, don't do that, we'll fix the issue.
  • Roedou 12y ago
    It's as if that was the plan all along... ;)
    • robbrown451 12y ago
      Ha. Good luck... :)
• deleted 12y ago
  [deleted]
• jmsduran 12y ago
  I recently bought a Kindle Paperwhite, and also noticed how easy it was to tie the Kindle to an email account upon purchase, all without verification. This seems like something Amazon definitely needs to fix.
• macros 12y ago
  The I have too much time on my hands approach is to self-publish a short story to this person on how to get in touch with you and buy it from their amazon account.
  • Roedou 12y ago
    That is... inspired. It doesn't matter how little time I have on my hands, I really want to do that now. Or maybe an app that lets them live chat me?
  • ChuckMcM 12y ago
    This is brilliant. I would totally do that in a heartbeat. I don't know if I would have them buy it (although that might be necessary to get them to read it). You could presumably do the same thing with an app which ran and said, "Let's figure out what your real email address is shall we?"
  • bensedat 12y ago
    Rather than go through self-publishing, you can use the personal documents service to upload a short document and send it down to the device. Details are at http://www.amazon.com/gp/help/customer/display.html/ref=hp_pdoc_main_short_us?nodeId=200767340 http://www.amazon.com/gp/help/customer/display.html/ref=hp_p.... There are fees if the user isn't on WiFi though...
  • PeterWhittaker 12y ago
    Oh, I so much I could upvote multiple times. Brilliant.
    • PeterWhittaker 12y ago
      Wow, that got downvoted? Yikes. Some folks have itchy trigger fingers.... (Oh, I know. I forgot to phrase it as "This" followed by a personal anecdote supporting the assertion in question. Ah, humbled again.) (Yup, expecting karma loss on this. Fun and games, no eyes at risk.)
      • 12y ago
• neomech 12y ago
  Reading the chat log it doesn't seem like the replies are from an actual person. Are Amazon outsourcing their customer support to a collection of AI constructs. :-)
  • adamio 12y ago
    If AI needs only be better than these responses, this could be a huge opportunity
  • a3n 12y ago
    I think it might be an actual person selecting from choices, and then the response is automatically composed.
• aroberge 12y ago
  The practice of checking the validity of email addresses seems to be lost on many (most?) businesses. I've found in my mailbox, from at least 4 other "A Roberge" located in either the U.S. or Canada the following: Health insurance form and other information for a child School report for a child Mortgage information Book library late notice Nail product order confirmation Multiple confirmations of job applications PS4 account information Various invitations to family gatherings etc. Whenever I could find the relevant information, I contacted the various people that send me the original email to correct the information. Most did not respond (including the father of a child with the above mentioned information who was copied on one email). Sometimes the emails contained an unsubscribe button (yay) but, upon trying to use it, it asked for a password (which I obviously did not have). So, off to the spam folder... So, I completely agree that Amazon's registration process is very flawed ... but there seems to be a lot of clueless people and businesses out there as well.
  • deleted 12y ago
    [deleted]
  • nnnnni 12y ago
    Wow, there are possibly both HIPAA and FERPA violations there...
    • aroberge 12y ago
      In this case yes: the child is in the US. However, I am not...
  • fencepost 12y ago
    I get these regularly, and for purchase notifications on sites where I expect the person will come back, I make an effort to track them down and notify them. The only one where I actually put in quite a bit of effort was when I was getting the email notifications for downloading someone's CME (Continuing Medical Education) certificates as they completed courses. It turned out to be a real pain - I could find the person, but couldn't get hold of them. Approaching retirement age, rural, etc. - I think I finally ended up leaving voicemail on their son's # and with their church, though it probably would've been easier at that point to just sit down and actually write and mail a letter. And the only one that really annoys me is the gun nut. I get more crap from whacked out black helicopter EEEEBOOOOOLLLAAAAA idiots now...... And he actually gave them money, so they just don't go away.
• robododo 12y ago
  This is the burden of having firstlast@popular.com email address. Once, my wife had someone setup some sort of financial account with her email (CC, IIRC). They didn't verify the address! My wife called and tried to do the right thing, but the people on the phone just didn't understand the concept that the email address was wrong. It simply wouldn't compute for them. Since my wife had the email address, she /must/ have been the account holder. Right?
  • AjithAntony 12y ago
    Me too. I'm particularly noticing in my case, since I get lots of people in India using my eponymous gmail address, that Indian banks, mobile carriers, and ISPs are terrible at every facet of this experience. Lots of spam, no unsubscribe opportunities, sending passwords in plain text in email, all mails are embedded images only with no text.
• whiddershins 12y ago
  Madness. My friend is getting emails from 3 different dating sites, all to a person who has a very similar name and managed to sign up for all these sites using the wrong email address. Somehow none of them bothered with email authentication. It seems as if, technically, these sites (including Amazon in this scenario) are engaging in illegal spam practices. But who knows.
  • bryanrasmussen 12y ago
    whoa, that explains what's been happening to me. I've been getting some mail from some match.com and I've never signed up.
• ck2 12y ago
  It's gmail, sheesh just create a filter to delete the emails. If you delete their account you may be committing a crime somehow, just logging in may be committing a crime, not worth it.
  • chris_mahan 12y ago
    Just forward them all to privacy@amazon.com?
    • adamio 12y ago
      Email the whole blog post to jeff@amazon.com for higher level support
• pessimizer 12y ago
  It's just bad customer service workflow (that you weren't escalated, but locked into the script) and bad interface design (that addresses aren't verified.) It's some ratio of lack of imagination:care. I called paypal last week to remove an expired card from my account. At some point, Paypal has started doing background checks to come up with security questions after the fact, all three of which have to be answered correctly in order to have a discussion about your account. One of the questions was my father's wife's (who he married when I was in my late teens and both lived in a different state) birthday month. Another was a friend's street address that I used to get an Oregon ID, and slept on her floor for about 3 months 20 years ago. The operator was sympathetic, but what could she do? She had no way to escalate, and there was no contingency for if a question was asked that the customer may never have had the answer to. It's just sloppy.
  • zem 12y ago
    > At some point, Paypal has started doing background checks to come up with security questions after the fact wtf? paypal keeps pestering me to link it to my bank account, with the incentive that i won't have to pay fees to transfer money to friends. i've held off out of a vague feeling that they'll find some way or the other to screw me over once i do; stories like this make me happier that i've listened to that instinct.
• Pinckney 12y ago
  Why not just set up a filter to delete them?
• jonnynezbo 12y ago
  I applaud you taking the time to do the right thing. I probably would have just created an email filter, and called it a day.
• jpetersonmn 12y ago
  Why not just create a filter to send those emails to the trash? I certainly wouldn't log into the account, that's likely illegal.
• adenner 12y ago
  having the email address my last name @ gmail.com I have gotten a lot of this sort of thing. The best one was 3 years worth of income tax returns from some accountant in New Zealand.
• robbrown451 12y ago
  Here's how you can send the original owner a message so that you don't have to delete the account. Log into their account, and order, to be delivered to their address, something that gives them the first letter of your message. For instance http://www.amazon.com/Sterling-Silver-Initial-Pendant-Necklace/dp/B00CIOBWHQ/ref=sr_1_3?ie=UTF8&qid=1414518915&sr=8-3&keywords=initial http://www.amazon.com/Sterling-Silver-Initial-Pendant-Neckla... Then do it over and over to send them a message that their email address is wrong. You'll have to space them out by a few days, so they arrive in order.
  • malexw 12y ago
    If he has access to the account, why wouldn't he just write up an explanation of the problem and push it to the Kindle?
• colinbartlett 12y ago
  "Low level customer service rep at Amazon just told me to log into someone else's account - and delete it." Clearly, someone made a mistake. This is not some official policy sanctioned by Bezos and handed down from above, despite what the clickbait headline reads.
• cddotdotslash 12y ago
  Shouldn't Amazon be verifying the email address before they just start treating it as valid?
• yoctonaut 12y ago
  I managed to get (first name)@(popular).com, and man, it's a core sample into what a bunch of people all over the world are doing. Signing up for cable or satellite tv, buying iPads/iPhones, sending each other family photos, ordering dinner, taking cabs, buying bus tickets, getting divorced, offending their condo association, signing up for dating/hookup sites, opening stock-trading accounts, applying for jobs, posting jobs for people to apply to, and more. And none of them know their own email address.
  • deleted 12y ago
    [deleted]
  • steanne 12y ago
    given that my name can be seen as an abbreviation for sainte anne, i tend to get french churches that don't know their own email address.
• rogerallen 12y ago
  It is such negligence that so many companies do not validate email addresses. It is especially frustrating that nearly every time this happens it comes from a "do not reply" address within the company so you can't do anything about it.
• gwbas1c 12y ago
  Actually, the best thing to do is to make this very, very, very painful for Amazon. First, it needs to become very obvious that Amazon goofed in not verifying that the kindle owner owns the email address. Second, the person with access to the account needs to rack up so many charges that they max out the credit card. By making "not verifying email addresses" an expensive product mistake, this problem can be solved quite quickly.