What can we do to stop the attack?
The damage and the extent of the breach might be more than you think of. The email account that is tied to the Amazon account needs the same security steps implemented or re-implemented, like changing your passwords to one with a completely different set of characters & theme/nature and the setting up of 2FA.
It is possible for the breached access to have gotten past the need to enter 2FA. Under 'Two-Step Verification (2SV) Settings' > 'Require OTP on all devices'
#Do check on the number of 2FA apps enrolled as well.
Do check on the number of 2FA apps enrolled as well.
You can also rule out the possibilities of her cellphone being breached by using your phone's authenticator app as hers. Find the breach, plug it!
