Too bad you can't ask for the CVV code, and run a dummy $1 transaction. Anyone could have the last four of the card number, but the person is much more likely to have the card itself with the CVV.

Disclaimer: I use AWS extensively. Please do this.

Call 1: "Hey, we just got a new credit card, can you put it on our account?"

Call 2: "I just locked myself out of the account, can you reset it for me."

If you're using the payment method as auth, you should be locking it out as an auth method for X days after a change has been made, and emailing/SMSing the contact regarding the change.

Yeah, that's the only thing amazon seller support asks me for verification as well. Either last 4 of credit card or last 4 of bank account - which is even stupider - anyone who you wrote a check out to has your bank account number.

That is a little unnerving if true.

A reporter at Wired had his digital life destroyed (including personal mac wiped) by social engineering, using little more than info from one account (last 4 digits of credit card from Appstore account) to socially engineer Amazon customer support - http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/

Edit. Had some details wrong. It was a reporter at Gizmodo, and basically a collection of data was gathered from various online services (mailing address, last 4 digits of CC) to ultimately social engineer his Apple account and remote wipe his computer. A number of factors were involved, but ultimately he was done in by not having 2FA on google, and not backing up his machine.

Just confirmed with our CTO. He was able to turn MFA off on our root AWS account over the phone.

Huh. I'm going to say thanks to HN, and this comment chain, for bringing this to light. That seems kind of insane.

Maybe it's time for Amazon to decouple AWS accounts from Amazon shopping accounts.

I think you can do that yourself, although it probably means that you need two credit cards.

I mean from a system level perspective. The trouble is that they have policies that are optimized for people shopping on a site with a money back guarantee not for hosting critical infrastructure.

Lastpass will let you remove 2FA using the attached email address. I do not believe it requires you to enter codes from the 2FA to disable. It makes me uncomfortable despite my email having two factor.