Amazon account hacked · Disaster Lab

Your preparation

0 of 0 safeguards ready

What this means

Someone in your Amazon account can place orders to an address they control, spend gift-card balance, and use cards saved on the account. Amazon also watches for unusual payment activity and may put the account on hold itself. That hold is Amazon locking things while they check. It feels like a hack, and sometimes it is their response to one.

While an account is on hold, Amazon says access to Prime, Music, Kindle, Alexa, and Ring is held too. The way back is their own secure sign-in flow, not a caller who already knows your order history.

A charge on your card that you cannot match is a second problem. Amazon Pay’s help says that if no Amazon order explains the charge, call the bank or card issuer, and tell Amazon Pay as well. Use Scammed or fraudulent bank charge for the card, and this page for the account.

Screens differ by country. The steps below follow Amazon’s US and UK help pages where they describe the same actions. Open amazon.com, or the local Amazon site you actually use, by typing it.

Warning signs

An order you did not place, especially a gift card or a delivery to a new address.
An email from Amazon about an account on hold, a password reset, or a new sign-in.
A payment method or address you do not recognise.
A text or a call about a “compromised” order, pushing you to install software or read a code. Amazon’s scam page is where that belongs, not in the call.

Recover now

First 15 minutes

Open Amazon yourself. Use the app you already installed, or type the address. Do not use a link in an unexpected email or text, and do not call a number that arrived in that message.
If you can sign in, change the password to one you do not use anywhere else. Amazon recommends two-step verification, and a passkey if you want to sign in without a password. Add both a mobile number and an email if the account has only one of those. Amazon says email-only accounts are easier to attack.
If you see “account on hold,” use the notice Amazon sent you by email or text, then sign in and complete their form. Amazon says the fastest way to unlock it is that secure sign-in portal. Customer service can guide you, and they will ask you to follow the same instructions. You may get messages about pending orders while the hold is in place.
If you shared your Amazon password or a code with someone, go to Amazon’s Report a scam page and choose the option that matches what you handed over, including “I have shared Amazon account information.” Suspicious mail can also go to [email protected]. Amazon says they cannot reply personally to that address, though you may get an automatic confirmation.
If a card was charged and you cannot find the order, call the number on the card. Amazon Pay tells buyers to ask the issuer to block that payment method, and that a refund of an unauthorised charge goes through the issuer’s chargeback process, which may ask for documents. Then notify Amazon Pay from inside the signed-in activity page if the charge is Amazon Pay.

Today

Review recent orders, your addresses, and your payment methods. Remove anything you did not add. If Amazon cancelled legitimate orders while protecting the account, their UK help says you can report missing or wrongly cancelled orders from the account-security page, and that a mistaken lock can be reviewed with access restored within 24 hours after they verify a recent order.
Check the inbox that receives Amazon mail for forwarding rules you did not create. If that mailbox is shared with an attacker, they will reset Amazon again. Follow Personal email account hacked.
Update any subscriptions or automatic payments that used a card you just replaced.
Tell anyone else who orders on this login, so they do not “fix” it by clicking a fake mail.
If new credit accounts appeared in your name, not just Amazon orders, move to Someone is using your identity.

Verify recovery

You can sign in with the new password, and two-step verification or a passkey is on.
The only addresses and cards on the account are yours.
The latest orders are ones you placed, or Amazon has confirmed which cancelled orders they are reviewing.
The email account on the login has no new forwarding rule.

After recovery

Keep the order numbers and the hold email until the card issuer finishes any dispute. If a package is in transit to an address you do not know, tell Amazon from the order page rather than confronting anyone at that address.

Prepare now

The account

Two-step verification is on, or you sign in with a passkey. Amazon lists both as the way to harden the account.
The account has a mobile number and an email, not email alone.
The password is not reused on your email or your bank.

Cards and mail

You get an email or a push for new orders, and you have noticed one recently, so the alert actually arrives.
Saved cards that you no longer use are removed.

Practice

You have opened the orders page once and you know what your real address book looks like.
[email protected] is the address you would use for a suspicious message, and you would still open Amazon by typing it.

Common mistakes

Calling the number in the text. Amazon tells you to report suspicious calls and texts to the FTC at ReportFraud.ftc.gov, and to use their own scam page for the account. The caller is not the recovery path.
Letting a stranger “screen share” to cancel a fake order. Amazon’s scam report includes a path for people who gave remote access. Disconnect that session, then change the password from another device.
Only disputing the card and leaving the account open. The next order goes out tonight.
Ignoring an account-on-hold message because it might be fake. Open Amazon directly and see if the hold is there. The message can be real. The link in it is still optional.
Using the same password as your email. Whoever reads the mail can reset Amazon whenever they like.

Sources

Last reviewed October 31, 2026Guidance changes. Confirm provider-specific actions in the linked official sources.