Amazon Account Hacked? How to Recover It and Stop Scams

Quick fix: 5 steps in 15 minutes

Open Amazon by typing the address or using the app, then look at Your Orders.
Change your password (use a new, unique one).
Turn on Two-Step Verification: Your Account, Login & security.
Remove unknown addresses and cards, call your card issuer about charges you do not recognize.
Got a scary email or call instead? Read the fake order scam section and do not call the number.

How to tell your Amazon account was really hacked

Most people discover a hacked Amazon account in one of three ways: a confirmation email for something they never ordered, a login code they never asked for, or a package that shows up at a stranger's address. Each one points to a different problem, and the fix is not always the same, so it is worth ten minutes to work out what actually happened before you start changing settings.

Here are the signs that usually mean someone else is inside your account:

Orders you did not place. Open Your Orders from the Amazon website or app. Amazon's own scam help says that only legitimate purchases appear in your order history. If a real order you do not recognize is listed there, someone used your account or your saved payment method.
A changed email address, phone number, name or password. You get a notice that a detail was updated and you did not do it, or your normal password suddenly stops working.
New delivery addresses. A new address in your address book is a classic sign. Attackers often send goods to an address they control, or to a reshipper.
Login codes you did not request. A one-time code by text or in an authenticator app means someone typed your password or your email and reached the second step. That is a warning even if they did not get in.
Gift card balance gone, or gift cards sent to unknown email addresses. Attackers like gift cards because they are fast to spend and hard to trace.
Changed Prime, payment or device settings. Unfamiliar cards on file, an unexpected membership change or a device you do not own listed on the account.

Now the important part: a suspicious email by itself does not mean your account was hacked. A fake "Amazon order" email is usually a phishing attempt aimed at stealing your login or getting you to call a scam phone number. If your order history is clean and your settings are untouched, you were targeted but not breached. The fix is simpler: do not click, report it, and move on. We cover that case in detail in the fake order emails section further down.

Hacked, phished or just spammed? A quick triage

What you see	Most likely situation	What to do first
Real unknown orders in Your Orders	Account or payment method used by someone else	Secure the account, cancel what you can, contact your card issuer
Email or text about an order that is not in Your Orders	Phishing or fake order scam	Do not click or call, report it, no account change needed unless you responded
You clicked a link and typed your password	Credentials possibly stolen	Change your password right away, check account, turn on two-step verification
You gave a code or let a caller on your computer	Account and device at risk	Treat as a full compromise, see the remote access section
Package you did not order	Brushing scam or a gift from someone	Check with family, then report it as unsolicited
Login code appears with no action from you	Someone knows your password or email	Change the password everywhere you used it

The first hour: what to do before anything else

Speed matters, but order matters more. The steps below are in the order we use when a client calls us from a panic. If you can still sign in to Amazon, start at step 1. If you cannot, jump to when you cannot sign in.

Step 1: Open Amazon yourself, never from a link

Type the address of Amazon's website or open the official app. Do not use a link from an email or text, and do not search for "Amazon support" and click the first ad. Amazon's help pages warn that scammers build fake websites and fake support pages that look real, and that legitimate Amazon websites contain the Amazon domain for your country, for example amazon.ca for Canada. Go straight to the help section of the real site.

Step 2: Check Your Orders and stop what is still in progress

Go to Your Orders. Write down (a screenshot works) every order you do not recognize: date, item, amount, delivery address. If an order has not shipped yet, the order page normally lets you request a cancellation (the exact buttons change over time, so look at what Amazon shows you); cancel anything that is still cancelable. Do not worry about the rest yet. You are collecting evidence for your card issuer and, later, a police or CAFC report.

Step 3: Change your password and turn on stronger sign-in

Amazon's "Protect Your System" help page says that if you entered your password on a website you think might be malicious, you should go to Password Assistance and change it immediately. Choose a password you have never used anywhere else (a password manager makes this painless, see our password manager guide).

Then switch on extra protection. Amazon's help documentation gives this path for Two-Step Verification: Your Account, then Login & security, then Two-Step Verification (2SV) Settings, then Get Started. You can receive the code by text message or by an authenticator app. An authenticator app is the safer choice because text messages can be intercepted in SIM swap attacks. Amazon also describes passkeys, which let you sign in with your fingerprint, face or device PIN instead of a password, and says it does not store your fingerprint or PIN data. If you want the full walk-through of 2SV in general, read our two-factor authentication setup guide.

Step 4: Tell your bank or card issuer

If any of the unknown orders were paid with a credit or debit card, call the number on the back of the card and tell them. Ask them to flag the transactions as fraud and to issue a new card number. Then remove the old card from your Amazon account and add the new one. Amazon's help page about entering your password on a suspicious site also reminds you to update the payment method on your Amazon account afterwards.

Many people hesitate to call because they worry about being blamed. Card issuers handle fraud calls all day. The faster you call, the easier it is to show the charges were not yours. Rules and timelines vary by issuer and card agreement, so ask your own bank what it needs from you and by when. We cannot promise a particular outcome and we do not guess at one.

The worst version of this problem is when the attacker changed your email, phone number and password and you are locked out. Do not panic: Amazon has a recovery path, and it is built around proving that you are you.

Try Password Assistance first

On the official sign-in page, use the "Forgot password" option. Amazon sends a code to the email or phone number on file. If the attacker already changed those details to their own, the code goes to them and you will not receive it. In that case, move to the account recovery options below rather than repeating the attempt over and over, which can trigger temporary lockouts.

If Two-Step Verification is blocking you

Amazon publishes a help page called "Recover Your Account after Two-Step Verification Fails". According to that page, you first try a registered backup method or a trusted device. If that does not work, the steps are:

Select Sign in with Amazon.
Enter the phone number or email associated with your account.
Enter your Amazon password. The page says you can also use a passkey or a sign-in code.
On the screen asking for the 2SV code, select Didn't receive the code.
Select Two-Step Verification Account Recovery and follow the on-screen instructions to verify your identity.

The same page says Amazon cannot change your Two-Step Verification settings until your identity is successfully verified. That is a protection for you: it stops an attacker from simply turning your security off. After you are back in, you manage the method under Your Account, then Login & security.

Contact Amazon through the official channels

If the self-service recovery fails, use Amazon's Customer Service from the official website or app (not from a search ad, and never a phone number from a pop-up or an email). Amazon's "Report a scam" page also offers separate paths depending on what you shared: nothing, Amazon account information, banking information, remote access to your computer or devices, or other information. Pick the one that matches your situation to get tailored advice.

Prepare these before you contact support: the email addresses and phone numbers that might be on the account, the last order you remember (item, approximate date, amount), the card used, and screenshots of any suspicious messages. The more specific details you can offer, the faster a legitimate support agent can match you to the account. Never send your password, one-time codes or full card number to anyone claiming to be Amazon support.

Your emails and your phone number are part of the problem

When an Amazon account is taken, the attacker usually did not start with Amazon. They started with your email account, or with a password you reused from another breached site. Amazon's own security guidance recommends adding both a mobile number and an email address to your account and warns that email-only accounts are more prone to attacks. If your email account was also taken, recovering Amazon is pointless until you recover the email first, because every reset code lands in that inbox. Use our email account hacked recovery guide for that part, then come back.

Also think about where else you used the same password. Credential stuffing, where attackers try one leaked password on dozens of sites, is a very common way accounts fall. Change the password on your bank, your main email, your PayPal and any shopping or streaming account that shared it. If PayPal is one of the places you used it, our PayPal account limited or hacked recovery guide covers the next steps.

What attackers actually do with a hacked Amazon account

Knowing the typical goals helps you check the right places. We keep this list general and based on how these accounts are commonly abused, rather than on invented statistics.

Buy things quickly. Using saved cards, saved addresses and one-click ordering. Electronics and gift cards are favorites because they resell easily or convert to cash.
Redirect deliveries. By adding a new address, then ordering. Some attackers intercept packages from a friend's or accomplice's door.
Harvest personal data. Your name, addresses, phone numbers and order history can fuel convincing follow-up scams. A caller who knows what you bought last month sounds credible.
Take over linked services. Amazon accounts can be tied to other things such as Kindle, Prime Video and voice assistants. Amazon's Protect Your System page notes that sharing credentials with third-party tools lets those tools act as you, including making purchases and exporting your Alexa voice history.
Reuse your email and password elsewhere. If the password matched another account, expect attempts there next.

After you regain control, plan to check each of those areas, not only the orders list. The next section gives the full cleanup checklist.

After you are back in: the cleanup checklist

Getting back in is only half the job. A careful attacker leaves things behind: a second address, an extra payment method, a saved device. Spend fifteen minutes going through each of these areas.

Orders, returns and subscriptions

Review everything from the last several months, not just the last few days. Look for orders placed from an unfamiliar location or device, anything with an unusual shipping speed, and subscriptions you did not start such as Subscribe and Save items or a membership. Cancel what you can. For deliveries already made to an address you do not control, report them to Amazon and to your card issuer. Do not try to chase a package yourself.

Addresses and payment methods

Open your address book and delete any address you do not recognize. Check Wallet or Payment options and remove any card, bank account or gift card balance you did not add. Remove cards you no longer use, even if they look familiar, since fewer saved cards means fewer ways to lose money next time.

Email, phone and login details

Under Your Account, then Login & security, confirm the name, email, mobile number and password are all yours. If the attacker changed them, change them back and confirm with a fresh code. Make sure your two-step verification method is one you control (your own authenticator app or phone number) and not a number the attacker added.

Devices, apps and third-party access

Think about every device and service connected to your Amazon account. Sign out of devices you no longer use or do not recognize where the account settings allow it, and revoke any third-party tool or website you gave your Amazon credentials. Amazon's help page is explicit: do not share your Amazon credentials with third-party tools or sites, because they can then act as you. If you used a browser extension or app that offered to "track prices" or "find coupons" by logging into Amazon for you, remove it now. We explain why browser extensions are risky in our browser extension security guide.

If you entered your password after a pop-up said your computer was infected, or you let a caller connect to your computer, your device may also be compromised and a password change alone will not be enough. See the next part.

Hands holding a smartphone with a padlock icon beside a closed-screen laptop and delivery boxes, checking account security after unauthorized orders

If you let someone onto your computer or gave them a code

This is the scenario people are most embarrassed about, and the one where acting fast pays off most. Amazon's guidance on fake phone calls lists exactly this pattern: callers who ask you to install an app, to share a one-time password you received, or to pay outside of Amazon. If it happened to you, treat both your account and your device as compromised.

Disconnect. Turn off Wi-Fi or unplug the network cable. If you can, close the remote access program (common ones are AnyDesk, TeamViewer, Quick Assist or a "support" tool the caller made you download). Do not just close the window and carry on.
Call your bank now if you gave card details, banking logins or sent a transfer. Say plainly that you were the victim of a remote access scam.
Change passwords from a different, clean device: your phone on mobile data, or a family member's computer. Start with email, then Amazon, then banking.
Have the computer checked before you use it for anything sensitive. We explain how to look for the signs in our fake tech support scam aftercare guide, and you can book a remote session if you want a technician to do it with you.
Report it to the Canadian Anti-Fraud Centre. Amazon's own pages direct Canadian customers to the CAFC.

If the caller said they were from Amazon, the real Amazon says this about phone calls: it's OK to hang up. If you feel uneasy on a call with someone who claims to be from Amazon, end the call and contact Customer Service through the Amazon app or website. And: Amazon states that it will never ask for your password, OTP, gift card details, bank card details or any other confidential information over the phone.

Fake Amazon order emails, texts and calls: how the scam works

This is the other half of the story, and for many readers it is the real problem. You received a message saying a large order was placed on your account, and a phone number to call if it was not you. There is no breach. The message is the whole attack.

Amazon's "Scam trends" help page describes this exactly. It calls it an order confirmation scam: unexpected communications, often about an unauthorized purchase, where scammers ask you to act urgently to confirm or cancel. They may try to get you to provide payment details, install software or purchase gift cards. Amazon's advice: if you get an unexpected message about an order, verify your orders by logging into your Amazon account, because only legitimate purchases appear in your order history.

The typical flow

An email or text arrives with a believable subject: an expensive item, a quantity of several units, a shipping address in another city or country. The amount is large on purpose, to make you worry.
It does not link to an order page. It gives you a phone number to call "to cancel" or "to dispute" the charge.
You call. A calm person with a professional script "verifies" you, then says your account is compromised and that you need to "secure" it.
They ask you to install a remote access program, read out a code you receive, move money to a "safe account", or buy gift cards. Each of these is a red flag that Amazon lists on its own pages.
If you do any of it, you lose money. The original email was never from Amazon.

How to check an email in 60 seconds

Amazon's page on fake emails gives a practical set of checks. We have rephrased them as a routine:

Check Message Centre. The Message Centre in your Amazon account holds all email communication sent by Amazon. If the email does not appear there, Amazon did not send it.
Read the sender address character by character. Look for misspellings, added or substituted characters. Real Amazon emails come from an address on the Amazon domain for your country. Amazon also says that some email providers display the Amazon smile logo icon in your inbox when Amazon is the actual sender, but do not rely on a logo alone.
Look at the links before clicking. Hover or long-press. Amazon says that legitimate Amazon website addresses have a dot before the Amazon domain, such as something.amazon.ca. A link to a lookalike domain is a scam.
Typos and odd grammar are warning signs, but AI now writes clean text, so a polished email proves nothing. See our guide on how to spot AI-generated phishing emails.
Attachments. Amazon notes that it may send attachments as links to secure Amazon pages. Be suspicious of unexpected attachments and make sure any link goes to an Amazon domain.

If you want the basics of the technique itself, read what is phishing. For text messages, read what is smishing.

Text messages

Amazon's help page on fake text messages says these are not from Amazon if they include phone numbers you do not recognize or numbers with a country code that differs from your country of residence, messages about orders or deliveries you are not expecting, or phishing links with misspelled URLs, typos or an IP address as the link. It adds an important note: Amazon will never ask you via text message to provide personal information, payment details, gift card codes or to call a phone number. Amazon may send texts about order updates, payments, deliveries or account status, so one real text is not proof of a scam; the test is whether it asks you for something sensitive or sends you to a number or link you did not initiate. A related, very common variant is the fake delivery text. See our fake delivery text scam guide.

Phone calls

Per Amazon's page on fake calls, be alert if the caller asks for payment over the phone or outside the Amazon website (bank transfers, emailing card details, sharing gift card details), tries to remotely access your device or asks for a one-time password, asks for your Amazon password or card or bank details to "unlock" your account, or creates a false emergency such as an expiring subscription or unauthorized purchases. Amazon states that legitimate representatives never ask for OTP codes over the phone. The safe move is always the same: hang up and contact Amazon through the official website or app.

Fake websites and fake support pages

Amazon lists red flags for fake websites: numerical addresses, misspellings in the address, links that lead to a site outside Amazon, and a hover address that differs from the displayed one. Use secure addresses beginning with https. A related trick is the fake tech support page: Amazon says scammers create fake websites claiming to provide tech support for Amazon devices and services, and customers who land on them are lured to contact the scammer. Go directly to the help section of the real Amazon site, and be careful with search engine results and ads.

Illustration of a shopping cart full of parcels, a padlock shield and a phishing hook pulling an envelope

Gift card fraud: the one rule that protects you

Gift cards are the payment method scammers love, because the money moves in seconds and cannot be pulled back by a bank. Amazon's own page on common gift card scams gives the simple rule: Amazon.ca gift cards can only be used for purchases online at Amazon.ca, so any request to pay another business, a government office, an employer or a person with Amazon gift cards is a scam. Amazon says not to give the claim code on the back of the card, or codes received by email, to someone you do not know or trust, and to buy Amazon gift cards only on its website or from authorized retailers.

The page lists several scam types. We summarize them in plain language:

Impersonation scams. A fake government or police officer demanding an immediate gift card payment for fines or legal problems; a fake relative or friend in urgent need; a fake boss or colleague asking you to buy cards "for work". Amazon's advice: be skeptical, check through a channel you trust, and talk to someone else before acting.
Retail gift card tampering. A scammer swaps the barcode on a store card or scratches off the PIN and reseals the package, then drains the funds after you activate it. Inspect the card before buying, especially for tears or glue marks around the packaging edge.
Fake activation websites. Lookalike websites that copy the brand's activation page and steal the details you enter. Log in to your Amazon account through the app or the official address to redeem a card.
Romance and emotional scams. A long-distance online relationship that suddenly needs gift cards for a medical or travel emergency. Our guide on romance scams explains the pattern.
Prize winning scams. You "won" something but must pay taxes or fees first, by gift card. Legitimate organizations never ask for gift card payment.

Amazon also says that it will never call you to ask you to purchase gift cards to unlock your account. If you already read the numbers to someone, contact the gift card issuer immediately, because some funds can sometimes be frozen if the card has not been spent yet. We cannot promise it will work, and the timeline is short, so do not wait. Then report to the Canadian Anti-Fraud Centre.

Gift card balance stolen from a hacked account

If an attacker used your Amazon account to buy gift cards or spend a gift card balance, include these purchases in the evidence you gather in your first hour: date, amount, and the email address the cards were sent to. Contact Amazon Customer Service through the official site, and tell your card issuer. Do not try to buy "replacement" balance from a third-party "recovery" service. People offering to recover your funds for an upfront fee are a second wave of scammers. If your identity details were exposed along the way, our identity theft recovery guide lists the next steps.

Packages you never ordered: brushing scams

Strange packages are a different problem from a hacked account, though people often connect them. Amazon's help page says third-party sellers are prohibited from sending unsolicited packages, and that unordered packages may be a scam called brushing, where bad actors send packages to publicly available names and addresses.

What Amazon says to do:

Confirm that the package was not a gift for you. Check with friends and family.
If neither you nor anyone you know ordered it, report it using Amazon's online form for unsolicited packages.
If the package is addressed to someone else and unknown to you, contact Customer Service.
When contacting Customer Service, give the number of unwanted packages and a tracking number from at least one package label, plus any other helpful details.
You do not need to return the item.

Amazon states that it investigates brushing reports and may suspend or remove selling privileges, withhold payments and work with law enforcement. We do not give legal advice on keeping unsolicited items; if you are unsure, follow Amazon's page and local rules. And one practical note: a brushing package can mean your name and address are circulating in a leaked list, which is a good reason to also check your accounts, but it does not by itself prove that your Amazon password was stolen.

Other Amazon impersonation scams worth knowing

Amazon's "Scam trends" help page lists several more patterns. It says the list is not comprehensive and that scammers shift tactics constantly. It also says Amazon partnered with the Better Business Bureau on a Scam Tracker, a searchable database of reported suspicious communications that lets you look up emails, URLs and phone numbers.

Scam type	What the scammer claims	The safe check
Order confirmation	A big unauthorized purchase needs urgent cancelation	Log in on your own and look at Your Orders
Tech support	You can call "Amazon support" from a web page	Use only the help section of the real Amazon site
Prime membership	A fee is owed or your membership has a problem	Check Prime Membership under Your Account; Amazon never asks for payment details by phone
Account suspension or deletion	Your account will be closed unless you "verify" now	View account status on the official site or app; check Message Centre
Fake recall or refund	A product you bought is unsafe, here is a refund link	Amazon says it does not send recall texts; check Your Recalls and Product Safety Alerts in your account
Recruitment	A job offer from Amazon that asks for a fee or personal data	Legitimate jobs never require upfront payment; real postings are on Amazon's official jobs site

The pattern repeats: a made-up problem, urgency, and a request that moves you off Amazon's website. The antidote is boring but effective: close the message, open Amazon yourself, and look. If there is a real problem, you will see it there.

If the account is used for a small business

Amazon accounts are often shared in small firms: one login for the office supplies, one card, three employees who know the password. That is exactly the setup attackers hope for. If your business buys through Amazon, ask yourself whether a former employee still knows the password, whether the card on file has a low limit, and whether the account email is a shared inbox that many people can read. Amazon has a separate business account type with enhanced security settings for members; its help documentation describes turning on mandatory enhanced security settings under Business Settings. If you want to harden your whole team's logins at once, our guides on passkeys for business and spear phishing and employee protection go further.

Fan of blank gift cards beside a smartphone showing a red warning triangle, illustrating gift card scams

How to make your Amazon account hard to hack again

You do not need to become a security expert. Four habits stop most account takeovers, and Amazon's own "How to keep your account safe and secure" page recommends the first three.

Protection	What it stops	Effort	Our take
Passkey	Stolen or guessed passwords, fake login pages	5 minutes	Best option when your devices support it; Amazon says it does not store your fingerprint or PIN data
Two-Step Verification with an authenticator app	Password-only logins	10 minutes	Strong and widely supported; keep backup codes or a backup method
Two-Step Verification by text message	Most casual attackers	5 minutes	Better than nothing, weaker than an app (SIM swaps, intercepted codes)
Unique password in a password manager	Credential stuffing from other breaches	15 minutes to start	Essential for every account, including Amazon
Mobile number plus email on the account	Silent changes you do not see	2 minutes	Amazon says email-only accounts are more prone to attacks, and a mobile number adds alerts

If you never enabled any of these, do passkey or 2SV today. Then use the habit list below.

Never type your Amazon password after clicking a link. Open the app or type the address yourself.
Never read a code to anyone. Amazon says its representatives never ask for OTP codes over the phone.
Keep devices updated. Amazon's Protect Your System page recommends keeping your operating system and necessary plugins up to date and installing only software from verified sources.
Ignore urgent pop-ups. Amazon's page says to ignore pop-ups that claim a virus infected your devices and ask you to click a link to fix it.
Do not shop on public Wi-Fi without care. Amazon recommends connecting manually to Wi-Fi rather than automatically, and disabling hotspots when not needed.
Never place an order by email with a seller and ignore emails asking you to pay for an order by bank transfer (also from Amazon's page).
Check your orders every few weeks. A thirty-second look catches problems early.

Hacked Amazon account checklist

 Print or copy this list
☐ I opened Amazon by typing the address or using the official app, not from a message.
☐ I took screenshots of every unknown order, address and message.
☐ I changed my Amazon password to a new, unique one.
☐ My email account is secure (changed password, 2SV on, no strange forwarding rules).
☐ I turned on Two-Step Verification or a passkey.
☐ I called my card issuer and asked for a new card number if cards were used.
☐ I removed unknown addresses, cards and devices from the account.
☐ I cancelled orders that had not shipped.
☐ I reported the scam message to Amazon and to the Canadian Anti-Fraud Centre if money or data was lost.
☐ If I gave remote access, my computer was checked and passwords changed from a clean device.
☐ I told family or coworkers who share the account, and changed the shared password.
☐ I will look at Your Orders again in 7 days and 30 days.

Realistic scenarios (illustrative)

These are illustrative examples to show how the advice works, not real client cases. Amounts are invented for explanation.

Scenario 1: The fake 1,200 dollar order

Nadia, a nurse in Laval, gets an email saying a laptop worth 1,200 dollars was ordered and shipped to another province. It gives a number to call. She does not call. She opens the Amazon app, sees nothing in Your Orders, and finds no matching email in Message Centre. Result: phishing, no breach. She forwards the message to the address Amazon lists for suspicious messages, deletes it and finishes in ten minutes. Cost: zero. The lesson: the order list is the truth, not the email.

Scenario 2: The call that went too far

Marc, a retired contractor in Sherbrooke, calls the number in a similar email. A polite agent tells him his account is "being used for fraud" and asks him to install a support program. Marc does, and reads out a code he receives by text. While the agent talks, 640 dollars of gift cards are bought on his account. Marc hangs up when the agent asks for his banking login. He then disconnects the internet, calls the card issuer, recovers the account through the 2SV recovery path, changes the password from his phone, reports to the CAFC, and books a session to have the computer checked. Outcome varies by bank and card; the key was acting within the first hour.

Scenario 3: The reused password

Sofia, who runs a small online craft shop from Gatineau, reuses one password for her email, Amazon and an old forum. The forum was breached. A login code arrives on her phone. She never requested it. She understands that someone has her password, changes it everywhere, turns on an authenticator app for email and Amazon, and the attacker gets no further. Cost: an hour of her evening and the price of a password manager, if she chooses one.

What this costs: DIY versus paying a technician

Item	Doing it yourself	With a technician
Securing the Amazon account	Free, 30 to 60 minutes	Included in a session
New card number	Usually no fee from the issuer, but confirm with your bank	We cannot call the bank for you; we sit with you while you do
Authenticator app	Free	Setup included
Password manager	Free to paid plans, check each vendor's current price	We can help you choose and set up
Checking a computer after remote access	Free tools, several hours and some risk of missing something	One remote session at 119.99$ CAD for 60 minutes
Lost money	Depends on your bank and how fast you reported	No technician can promise to get money back

Our honest view: most people can fix the account themselves in an hour. Where a technician adds value is the computer check, the multi-account cleanup, and the peace of mind of someone doing it with you.

Official resources

Amazon.ca: Report a scam, with paths for what you shared.
Amazon.ca: Identifying a scam.
Amazon.ca: Recover your account after Two-Step Verification fails.
Amazon.ca: Protect your system.
Canadian Anti-Fraud Centre: report fraud.

When to call a professional

Call us if you let a caller connect to your computer, if you cannot recover the account or your email, if several accounts were taken at once, if it is a shared business account, or if you simply want someone to sit with you while you check everything. IT Cares has offered remote and on-site IT support in Quebec and across Canada since 2014. Call 1 (888) 711-9428 or book a remote session. We never ask for your Amazon password, and you should be wary of anyone who does.

IT Cares is not affiliated with Amazon. This guide is based on Amazon's public help pages, read on November 11, 2026, and general security practice.

Still stuck? Get a technician on it now

Remote support from IT Cares: we connect to your device, fix it with you watching, and explain what happened.

Book a session 1 (888) 711-9428

Frequently asked questions

Is my Amazon account hacked if I got an email about an order I did not place?

Not necessarily. Amazon's help pages say that if you received correspondence about an order you did not place, it likely was not from Amazon, and that only legitimate purchases appear in your order history. Open Amazon yourself and check Your Orders. If nothing unknown is listed, it is a phishing attempt, not a breach. Do not click, do not call any number in the message, and report it.

What should I do first if my Amazon account was hacked?

Open Amazon by typing the address or using the official app, check Your Orders, change your password, turn on Two-Step Verification or a passkey, and call your card issuer about any fraudulent charges. Take screenshots first so you have evidence.

How do I recover an Amazon account if the hacker changed my email and password?

Use Password Assistance first. If Two-Step Verification blocks you, Amazon's recovery page says to select Sign in with Amazon, enter your phone number or email and password, choose Didn't receive the code, then Two-Step Verification Account Recovery, and complete the identity verification. If that fails, contact Amazon Customer Service through the official site or app.

Will Amazon call me about a problem with my account?

Amazon's help page says it's OK to hang up if you feel uneasy about a call claiming to be from Amazon, and to contact Customer Service through the app or website instead. Amazon states it never asks for your password, one-time password, gift card details or bank card details over the phone.

Can I pay Amazon or anyone else with gift cards?

Amazon says Amazon.ca gift cards can only be used for purchases online at Amazon.ca. Any request to pay a person, a government office, an employer or another business with Amazon gift cards is a scam. Amazon also says it will never call you to ask you to buy gift cards to unlock your account.

I received a package from Amazon that I did not order. Is my account hacked?

Possibly not. This is often a brushing scam, where bad actors send packages to publicly available names and addresses. Check whether someone sent you a gift, then report it using Amazon's unsolicited package form. Amazon says you do not need to return the item. Still, check Your Orders and consider changing your password as a precaution.

How do I turn on Two-Step Verification on Amazon?

Amazon's documentation says to go to Your Account, select Login and security, select Edit next to Two-Step Verification (2SV) Settings, choose Get Started and follow the instructions. You can choose a text message or an authenticator app. Authenticator apps are generally the safer choice.

Does Amazon support passkeys?

Yes. Amazon's account safety page recommends setting up a passkey so you can sign in with your fingerprint, face or device PIN instead of a password, and says it does not store your fingerprint or PIN data. Menus can change, so look under Login and security.

How do I check if an email is really from Amazon?

Check the Message Centre in your Amazon account: Amazon says it contains all email communication it sent. If the email is not there, it was not sent by Amazon. Also check the sender address for misspellings, look at where links really lead, and remember that real Amazon web addresses have a dot before the Amazon domain.

Where do I report an Amazon scam in Canada?

Use Amazon's Report a scam page, and report fraud to the Canadian Anti-Fraud Centre. If you do not have an Amazon account, Amazon says you can still send suspicious communication to reportascam@amazon.com. Amazon cannot reply personally to those messages.

I gave a scammer a one-time code. What now?

Treat the account as compromised. Change your password from a safe device, check Your Orders and your addresses, secure your email, call your card issuer if cards were used, and report the incident. Amazon says legitimate representatives never ask for OTP codes over the phone.

Is it safe to use a third-party app that logs into my Amazon account?

Amazon's Protect Your System page says not to share your Amazon credentials with third-party tools or sites because they can act as you, including making purchases and exporting Alexa voice history. Remove any such tool after an incident and change your password.

Can IT Cares recover my Amazon account for me?

No technician outside Amazon can recover an account on Amazon's behalf, and you should avoid anyone who claims they can for a fee. What we can do is guide you through Amazon's official recovery, secure your email and devices, check your computer after a remote access scam and set up stronger sign-in. IT Cares is not affiliated with Amazon.

Sources and official references

Last verified: November 11, 2026