A reporter at Wired had his digital life destroyed (including personal mac wiped) by social engineering, using little more than info from one account (last 4 digits of credit card from Appstore account) to socially engineer Amazon customer support - http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/

Edit. Had some details wrong. It was a reporter at Gizmodo, and basically a collection of data was gathered from various online services (mailing address, last 4 digits of CC) to ultimately social engineer his Apple account and remote wipe his computer. A number of factors were involved, but ultimately he was done in by not having 2FA on google, and not backing up his machine.

Just confirmed with our CTO. He was able to turn MFA off on our root AWS account over the phone.

Huh. I'm going to say thanks to HN, and this comment chain, for bringing this to light. That seems kind of insane.

Maybe it's time for Amazon to decouple AWS accounts from Amazon shopping accounts.

I think you can do that yourself, although it probably means that you need two credit cards.

I mean from a system level perspective. The trouble is that they have policies that are optimized for people shopping on a site with a money back guarantee not for hosting critical infrastructure.