An Amazon account holds saved payment methods, addresses, order history and often access to video, music and smart home services, so criminals who impersonate the Amazon brand work hard to trick customers into handing over sign-in details, one-time codes or money. The good news is that the controls that stop this are free, already built into the account and take a few minutes to switch on. This guide explains how sign-in works on Amazon, how to set up a passkey and two-step verification, how to keep recovery details safe, and how to recognise and report scams that pretend to come from Amazon. It is written for everyday customers and for the security, fraud and help desk teams who advise staff, families and customers. For general shopping safety across all retailers, read the Safe Online Shopping Guide; this page goes deeper on one account.
This is an independent guide from NHI Mgmt Group, based on Amazon's public documentation as of November 2026. It is not sponsored or reviewed by Amazon. Product features change, so confirm settings against Amazon's current documentation.
Key takeaways
- Set up a passkey first. Amazon supports passkeys in browsers and in its iOS and Android shopping apps, signing you in with your device's fingerprint, face scan or screen lock PIN, which Amazon describes as less susceptible to phishing than passwords and text message codes.
- Turn on two-step verification. Under Login & Security, choose an authenticator app where you can, and keep a current mobile number on the account for recovery.
- Check in the app, never in the message. Any message about an order, refund, account problem or payment can be checked by opening the Amazon app or typing the website address yourself and looking at Your Orders and your account.
- Know the rules Amazon states. Amazon says it never asks customers to buy gift cards, never takes payment by phone or email, never asks you to pay on another website or by bank transfer, and never asks you to install software or grant remote access for customer service.
- Report every impersonation attempt. Customers can use Amazon's self-service reporting tool and non-customers can email [email protected]; Amazon reports taking down tens of thousands of phishing sites and phone numbers each year from these reports.
How sign-in and account access work on Amazon
An Amazon account is a consumer identity: one sign-in that unlocks shopping, saved cards, addresses, digital content and connected devices. Security settings live in one place. In a browser or the Amazon Shopping app, go to Your Account, then Login & Security. From there you can change your name, email, mobile number and password, set up passkeys and manage two-step verification.
| Sign-in method | What it is | Where to set it up | Phishing resistance |
|---|---|---|---|
| Passkey | A cryptographic credential stored on your device or password manager, unlocked with fingerprint, face scan or screen lock PIN. Amazon states that it does not store your biometric data. | Your Account > Login & Security > Passkeys > Set up | Highest: cannot be typed into a fake site, written down or guessed |
| Password plus authenticator app | Password followed by a one-time PIN generated by an app such as Google Authenticator or Microsoft Authenticator | Login & Security > 2-Step Verification > Edit > Get Started | Good against password reuse; a code can still be talked out of you by a caller |
| Password plus SMS code | Password followed by a one-time PIN sent by text message | Login & Security > 2-Step Verification, choosing SMS | Better than a password alone; codes can be phished or requested by impersonators |
| Password only | A password of at least eight characters | Login & Security > Password | Lowest: depends on the password being unique and never entered on a fake page |
Amazon announced passkey support in October 2023 for browsers, the iOS and Android Amazon Shopping apps and the Audible apps. In its article updated on 20 October 2026, Amazon states that more than 500 million customers have enabled passkeys and that signing in with a passkey is six times faster than a traditional password. For a plain-language explanation of how passkeys work across all your accounts, see the Passkeys for Everyone Guide.
Why the method matters
Most account takeover starts with a password or one-time code typed into the wrong place. A passkey is bound to the genuine Amazon site and app, so a lookalike page cannot receive it. That is the main reason to set one up even if you already use two-step verification. Amazon also uses the passkey alongside its other security measures for sign-in and account recovery.
Recovery details and who can get into the account
Account recovery is where a strong account is often won or lost. The details on file decide who can reset the password and where verification codes go.
- Keep the mobile number current: go to Your Account, then Login & Security, select Edit next to your mobile number, enter the code Amazon sends and select Verify. Amazon notes this adds a layer of security and makes recovery easier.
- Protect the email address on the account: password reset links go there. Secure that mailbox with its own passkey or two-step verification, since whoever controls it can usually recover the Amazon account too. See the Two-Factor Authentication for Everyone Guide.
- Use a unique password: Amazon advises at least eight characters, not reused on other sites, and suggests a password manager. A password manager also refuses to fill in on a lookalike domain, which is a useful extra warning.
- Register more than one passkey: add one on your phone and one on another device or in a synced password manager, so losing a phone does not lock you out. See the Passkey account recovery guide.
- Protect the devices themselves: Amazon recommends a screen lock PIN, up-to-date device software and a strong, unique Wi-Fi password, because the device is now the key.
Shared and family use: if several people use one household's devices, make sure each adult signs in with their own credentials and that nobody shares one-time codes. A code is only ever needed by the person signing in, at the moment they sign in.
Apps, devices and one-time codes
Customers rarely think of it, but an Amazon account is also signed in on phones, tablets, browsers, smart speakers and TV devices. Each one is a standing session. Good habits:
- Install only the official app: get the Amazon Shopping app from your device's official app store and use it to check orders and messages.
- Treat a code you did not request as a warning: an unexpected one-time PIN usually means someone has your password and is trying to sign in. Do not share it with anyone, change your password from Login & Security and confirm your two-step verification settings.
- Never read a code to a caller: Amazon lists a caller who claims there is a problem with your account and asks for a one-time password, or asks you to install software, as a sign of a scam.
- Review settings often: Amazon advises reviewing security settings regularly and changing them as needed, for example after a new phone or a change of email address.
For organisations, the same principle applies to staff who use business purchasing accounts: one person, one sign-in, a passkey or authenticator app, and no shared codes. The Account Takeover Prevention Guide covers the wider controls.
Recognising scams that impersonate Amazon
Criminals impersonate well-known brands because customers recognise and trust them. Amazon itself publishes guidance to help customers spot and report them. In Amazon's 2025 figures, 28% of reported Amazon impersonation scams involved attempts to get into customer accounts, and in 2023 more than two-thirds of reported impersonation scams globally related to supposed order or account issues.
| Scam pattern | What the criminal says | What Amazon states | Safe action |
|---|---|---|---|
| Fake order or charge | A purchase you did not make, often expensive, needs urgent confirmation or cancellation | Check purchase history by signing in to the website or app; do not click links in the message | Open the app, look in Your Orders; if nothing is there, the message is fake |
| Account suspension or deletion | Your account will be locked unless you verify details or payment on a linked page | Amazon does not ask for payment by phone or email, or on another website | Go to Your Account yourself and check for any notice |
| Membership or renewal problem | A subscription renewal failed or was charged at a higher price and must be fixed now | Payments happen only in the app, on the website or in physical stores | Check your membership and payment settings in the app |
| Fake customer service number | A number in a text, email or search result offers help with a refund or cancellation | Contact Amazon only through the app or website; do not call numbers from texts, emails or search results | Use the contact options inside the app |
| Remote access "support" | Install an app so we can fix your account or process a refund | Amazon will not ask you to download software or grant remote access, and does not charge for support | Hang up; never install software at a caller's request |
| Gift card payment | Pay a fee, fine or refund correction with gift cards and read out the codes | Amazon never asks customers to buy gift cards; no legitimate transaction requires them | Stop: a request for gift card codes is always a scam |
The most reliable signals are behaviour, not appearance. Criminals copy logos and wording well, so look for false urgency, a request to pay outside the app or website, a request for a one-time code, or a request to install software. Any one of these is enough to stop. For voice and text variants, see the Vishing and Smishing Guide, and for gift card schemes in general the Loyalty Points and Gift Card Fraud Guide.
Checking whether an email is genuine
Amazon uses email authentication so that genuine Amazon emails show the Amazon smile logo next to the message in supported inboxes such as Gmail and Yahoo!. Amazon says this verification technology is used in more than 20 countries. A logo is a useful hint, but the safe habit is the same either way: do not act on the email, open the app instead.
Reporting and responding
Reporting helps Amazon remove the criminal's tools quickly. Amazon reports that in 2025 it initiated takedowns of more than 70,000 phishing websites and 14,000 phone numbers used in impersonation scams, up from more than 55,000 websites and 12,000 numbers in 2024, and that it can now take down reported phishing sites within a few hours.
| Situation | Where to report or act |
|---|---|
| Suspicious email, text, call or website (customer) | Amazon's self-service reporting tool |
| Suspicious message (not an Amazon customer) | Email [email protected] |
| Need to talk to Amazon | Contact options inside the app or at the website's Contact Us page, reached by typing the address yourself |
| Check whether others reported the same message (US) | BBB Scam Tracker, searchable by email, URL or phone number, as Amazon suggests |
| Money lost or bank details shared (UK) | Call your bank on 159, as Amazon's UK guidance relays, then report to Report Fraud (which replaced Action Fraud on 4 December 2025). In Scotland, report to Police Scotland on 101. |
If you think someone got in
- Secure the email account first, since it controls password resets.
- Change the Amazon password from Login & Security on a device you trust, and set up a passkey if you have not already.
- Check two-step verification settings and the mobile number and email on file, and correct anything you did not set.
- Review Your Orders, addresses and payment methods for anything you do not recognise, then contact Amazon through the app.
- Call your bank or card issuer if card details were shared or charges look wrong.
- Report the message that started it, using the routes above.
The What to Do If You Have Been Scammed Guide and the Consumer Reporting Routes Map cover national reporting routes in more detail.
Hardening baseline
| Control | Setting or habit | Why it helps |
|---|---|---|
| Passkey | Set up under Login & Security on each main device | Cannot be phished on a fake page |
| Two-step verification | Authenticator app preferred, SMS as a fallback | Stops sign-in with a stolen password alone |
| Recovery details | Current mobile number and a secured email address | Keeps recovery in your hands |
| Password | Unique, at least eight characters, stored in a password manager | Limits damage from breaches on other sites |
| Devices | Screen lock PIN, current software, secured Wi-Fi | The device unlocks the passkey |
| Checking habit | Verify every order, refund or account message in the app | Defeats fake order and suspension messages |
| Payment habit | Pay only in the app, on the website or in store; never by gift card or bank transfer at someone's request | Matches how Amazon says it takes payment |
| Contact habit | Reach Amazon only through the app or a typed web address | Avoids fake support numbers in search results |
Common mistakes
- Calling the number in the message: the number belongs to the criminal. Always use the contact route inside the app.
- Reading out a one-time code: a code proves you are signing in; anyone asking for it is trying to sign in as you.
- Relying on SMS alone when a passkey is available: a passkey is quicker to use and much harder to trick out of you.
- Leaving an old phone number on the account: codes and recovery messages then go to someone else.
- Searching for "Amazon customer service" and calling the first result: Amazon specifically warns against numbers found in search results.
- Buying gift cards to "fix" a problem: no legitimate Amazon transaction requires it, so stop and report.
Where identity fits
For security teams, an Amazon account is a good teaching example of consumer identity done well: phishing-resistant passkeys, a second factor, recovery tied to verified contact details, and a clear statement of how the brand will and will not contact customers. Awareness programmes can use Amazon's own rules (no gift cards, no payment by phone or email, no remote access) as simple, memorable tests that apply to most brands. See the Impersonation Scams Guide and the Phishing-Resistant MFA Guide.
Practitioner checklist
- Set up a passkey under Your Account, Login & Security, on at least two devices.
- Turn on two-step verification, using an authenticator app where possible.
- Confirm the mobile number and email address on the account are current and verified.
- Secure the email account linked to Amazon with its own passkey or two-step verification.
- Use a unique password stored in a password manager.
- Check every order, refund or account message by opening the app, never through the message.
- Never pay with gift cards, by bank transfer or on another website at anyone's request.
- Never share a one-time code or install software at a caller's request.
- Report impersonation through Amazon's self-service tool or [email protected].
- Brief family members and staff on the same rules, especially older relatives who receive calls.
Standards and references
- Amazon: Passwordless sign-in with passkeys
- Amazon: Shopping account security settings
- Amazon: 6 tips to help you spot and avoid scams impersonating Amazon
- Amazon UK: How to avoid scams impersonating Amazon
- Amazon EU: Six practical tips to avoid impersonation scams
- Amazon Singapore: Safe shopping on Amazon
Related NHI Mgmt Group resources: Safe Online Shopping Guide · Passkeys for Everyone Guide · Impersonation Scams Guide · Account Takeover Response Playbook · Online Marketplace Buying and Selling Safely Guide