I was locked out of my AWS account for about 2 years due to loosing my 2FA authenticator on my phone. But had no open bills and didn't really care about it, so I did not try to gain back access.

Until last week, when I decided that I need to use the account again. I simply clicked the recovery link on their 2FA login form. Had to enter my account details and my phone number. Within 15 minutes (as stated on the website) a member of their service team called me. I explained the situation (lost 2FA app). Not a problem, the service agent told me. He then sent me an e-mail (to my AWS-associated mail address) with some random characters, which I had to read back to him. After that he simply removed 2FA, and I was able to log in with my username/password. For me the experience was quite pleasant, but had someone else have access to my e-mail account and knew my AWS username/password, he might have been able to take over my account, bypassing 2FA. I don't quite know how to feel about that.

EDIT: Ok, this probably only works if your phone number is also already associated with your account. So an attacker additionally would need access to my phone number, making things quite a bit more secure in my view.

Could the number be spoofed?

Unfortunately, yes - by going through the customer services of most mobile phone companies.

As of late, transferred phone numbers against the owners will is a thing.

I'm sorry for what you have to deal with, and I think as an industry we have definitely not thought through on the 2FA-over-phone system.

But I feel like asking for a notorized letter confirming you are actually "you" is quite reasonable. Otherwise it'll be all too easy for malicious social engineering.

What's the consequence of him being impersonated here though? Some fraudster pays his bill and gets nothing out of it?

Some fraudster shutting down an account that should actually be kept running, owned by someone who is merely very lax about paying bills.

If you aren't paying your bills, then you shouldn't be surprised that it gets shut down.

The idea being that it wasn't Amazon that shut it down, but the fraudster.

I guess I fail to see the importance of difference. Legal reasons?

Amazon is responsible for making a reasonable effort to prevent anyone unauthorized from doing anything to an account. Swap "shut down" with "read personal information tied to account" or "upload a heinous webpage to the AWS server," whatever.

This is not one of those "by any means, achieve the ends" type scenarios.

Who downvoted you for saying one shouldn't be surprised when an account gets shut down after not paying for 3 years?

On that note: why hasn't the account been shut down for nonpayment?

Presumably because that only happens when it crosses a threshold dollar amount, and $0.80/month isn't enough to get it over that threshold.

(That price is too small for there to be a running instance; it's most likely for storage belonging to an instance that was shut down, such as a 16GB EBS snapshot. It is reasonable that Amazon would be very careful about deleting that.)

Maybe the debt needs to be groomed on paper before it's sold.

Please don't complain about downvotes

That's not particularly relevant to the question of whether a fraudster should be able to shut down your account simply by offering to pay the current bill.

Someone gains unauthorized access to their data stored in AWS.

Wouldn't the consequence be that a fraudster gets complete access to the account and starts doing nefarious stuff?

The Amazon support employee gets fired during some internal audit for policy noncompliance?

> let me pay the bill and shut the account down

The account gets shut down

The problem is that as they get bigger, they may soon automate delinquent account notifications to debt collection agencies which could impact your credit rating sometime down the line.

You are unfortunately on the wrong side of an asymmetric relationship here.

That's solved by disputing the debt. Document the good faith attempts to pay.

I take it you haven't actually tried disputing debt. It's not a simple process, and can wreak havoc on your credit even if you are clearly not at fault.

I have disputed debt. Simple is relative, but I certainly did not have any trouble with the process.

It's true that your credit can be damaged by false reports. It's also true that damages resulting from false reports are recoverable.

If you don't feel like you can do it yourself, hire a lawyer and have them sue Amazon to recover their fee.

They are not recoverable. Good luck trying to get your rewards back once the credit card company cancels your card because some moron enter you social security instead of someone else's at the dept collector. Sure you can get a new account once your credit score is back but you get no simpathy from the credit card company. Even after more than 10 years with them.

Of course they're recoverable. See JOHN STEVENSON vs. TRW for example.

You seem to be saying lawsuits are a hassle. Yes, they are.

Still a hassle you shouldn't have to go through.

I sympathize with your predicament, but I can say I am very happy to know that Amazon won't just let anybody get access to a 2FA account without a substantial burden of proof.

We all read horror stories of people's accounts being compromised via trivial social engineering hacks. This will always be a balancing act. And to be honest I am all for erring on the side of caution.

You can get something notarized, at least in Illinois, for $1. Just go to a currency exchange. Most banks will do it for free.

The term "notarization" means very different things depending on the country you live in.

Outside the US this process can be lengthy and/or expensive as it can even result in official government stamps, translations, etc.

GP is in San Francisco. Standard notary fee is $20 in California, but some companies will subsidize it.

I feel sorry for those foreign countries where notaries are either rarified or unobtainably expensive, but it doesn't apply to this thread.

That said, I think Amazon's policy of notarization (at least in the US sense and fees) seems a reasonable policy from an account security standpoint. Not sure I can sympathize with GP who voluntarily added 2FA to their own Amazon account, then no longer had access to the phone number they previously used. $20 is not unreasonable for something that GP could have prevented with some forethought.

Yes, my bank branch notarizes for free.

This is quite different in Australia where notaries public are appointed either by the State Supreme Court or by an Archbishop. Almost all of which of which are solicitors or barristers, sometimes retired from practice.

As an Australian, if your workplace has a legal department - make friends with someone there.

It can save you a huge headache when you need to do something like apply for a home loan, and need tonnes of notarised papers.

In the US the bank sends a notary free of charge with all your paperwork to sign. What a pain that you don't get this service!

Their security worked, you lost access so this is entirely your problem. I'm happy to see that AWS requires notarization to get past 2FA.

Regardless of the size of the bill, comparing it to cost of a notary (which is very minimal) is irrelevant.

The exact same thing happened to me. In my case I still had a t2 instance running and was billed ~15$ a month. Eventually I shut down the instance over ssh, but that didn't change the overall situation.

I was studying in Germany at the time and access to a notary public costs about 40$ USD there. I asked the AWS support on the phone if letting the payments bounce would suspend my account which they confirmed.

Unfortunately every time I disputed the payment with my bank, AWS send me a physical copy of their terms and my billing address as a proof of contract and my bank would process their payment. Eventually, 3 months in, my credit card expired anyway, solving at least that part.

They still tried to charge me for about 6 months afterwards, but I haven't heard back from them since. Interestingly, I opened a second account, with the exact same billing address, but a different credit card without problem. But I don't really use AWS anymore since then.

I totally believe that they (AWS) just stuck to their process, which was enacted in good faith. But switching my phone number should have not caused that entire fiasco.

I recently noticed a $20-30 charge each month from 'Amazon Web Services' on the credit card and vaguely recall signing up and trialing it one day (must have left a small instance running I guess too).

I had to cancel that credit card in the end as I couldn't get access to the account and their support is, as far as I can tell, automated email responses. I also had the threat to suspend my account over many days (to which I was responding, 'Yes, please do'), but they stubbornly just kept threatening instead of closing the account. The support person did not seem to respond to what I wrote in my replies at all, just pasted a stock response that didn't make sense in context.

They really cannot seem to handle their scale in terms of their customer support (and I wonder how many people are getting bitten for small chunks of cash).

Have you made any attempt to work something out with whoever may have your old phone number? Explain the situation to them? Maybe they'd be kind enough send you the 2FA code for the account?

The UPS store will notarize stuff for like $10-20 bucks FYI.

Unless you live in Kansas, Iowa, Maine, Alaska, or Louisiana, you won't be charged over $10.

I'd be worried about them sending your account to collections -- would be annoying to take a credit hit over this ... insane as it is that you have no ability to resolve this situation now without hardship, you also won't have hardship free resolution path after it goes to collections ...

I guess if it goes to collections you'll at least then be able to pay the debt collector -- but you'll still take a credit hit ...

at what point does the debt get sold to a debt collector thus causing you more trouble and pain than paying for a notary would cost? Also if you're in the US and maintain a bank account, many banks offer free notary services.

It depends - but once that happens he is likely in the clear. The FCRA(https://en.wikipedia.org/wiki/Fair_Credit_Reporting_Act) states that once a debt is acquired by a new party, you(the debtor) can demand a proof of debt. If you don't get it in 30 days after the demand, the debt is null and void. If you do get it - proceed directly to small claims court and dispute it with all your documentation, and ask for an immediate bench ruling. There are precedents for this type of thing, and they are on the poster's side.

IANAL

Most cities charge <$50 for small claims court hearings too.

Can't you also ask to recover any court fees from the defendant if you win?

I love your willingness to be blackmailed.

It's not blackmail. He locked himself out of his account, and Amazon is erring on the side of caution before turning off services and shutting down accounts.

While it might be a nuisance to get a document notarized, it's not some extraordinary hardship. The policy is there to prevent abuse. If he prefers to let his bill go unpaid as a result of locking himself out of his account, that's his choice.

The point of humans providing customer service is that they can judge that in this case the account can in fact be closed without harm.

You shouldn't have your credit ruined for not wanting to give up your documents to some shitty company.

That's not what's happening here. Not paying your bills does rightly deserve a warning on credit reports.

Not paying your bills because you lost access to your own account does not change this situation. The same way as that having no income or car or phone or internet and can't pay your other bills doesn't excuse those liabilities either.

It's practical advice.

Ask the office manager at your job if there's a notary public on staff.

It's not uncommon for one of the assistants or the office manager to get certified as a notary. It's very useful for small office situations and short deadlines.

your bank can usually notarize the document for free.

This. I do it all the time. They have no problems with it.

You're willing to pay the $30, $40, $50 AWS bill for services you aren't using but the $5 notary charge is some grave affront?

As said already in other comments of sibling thread: notary fees can differ hugely depending on state/country and may be more on the order of $40-$50.

Having a brief search around the standard UK price per page of document to be notarised seems to be £60. Or, as here, ~£200 per hour - http://www.premiersolicitors.co.uk/Legalisation,11332,10160,....

As said already in other comments: the poster is in San Francisco. Last time I had to get something notarized in SF, I went to a UPS Store and it cost me $15.

I don't understand, why don't you just notarize the form and send it back to them, notaries are really cheap.

They like having something to complain about. The poster lives in/near SF and has hundreds of notaries available to them for 0 to minimal cost, time, and effort.

Have you tried calling your old phone number and seeing if it's been recycled? You could have that person do the second factor for you.

Cancel your card. Problem solved.

To clarify, get a new number for your credit card account; don't cancel it entirely. If it's your oldest credit card account then canceling it outright will have bad repercussions for your credit score.

That's not necessarily sufficient. If the card is a Visa or MC and credit card uses the card update service that is available for such cards then that might give Amazon the new card number on the account. I believe that whether or not the update service works for a specific card is up to the entity that issued that card.

If you report the card as lost or stolen, I would guess that the update service wouldn't be used: the bank likely doesn't want to update the card number with someone who might have added it fraudulently.