I had some interesting situation: My Amazon account has 2FA enabled where my smartphone with google authenticator is my second factor.
Due to issues with this phone my second factor basically broke (no longer produced reliable pins). Since I was on a machine which was marked as trusted I could shop etc just with my email+password on this machine.
When I however tried to add a new smartphone as a replacement factor even on my trusted device I was prompted to enter the second factor, which I couldn't. I then had to resort to entering a phone number in the support area and a representative called me back.
Now what happened caused a little bit of doubt on the usefulness of my fancy 2FA: The agent asked me for my email address I used to log in to amazon which I told him. Then the agent sent me a pin to to this email address. After I read back this pin to the agent she suggested to disable the entire 2FA so I could log in, do my things and eventually enable 2FA back again.
Is this a plausible attack vector? I am aware that an attacker needs the password for my amazon account and the password to the mail account for this amazon account, which itself might be not trivial but I am a little irritated that without further ado I could remove the second factor from my authentication. No further information like birth date etc was asked.
(Since my email address did not reuse the amazon password (or any password) and it itself uses a 2FA I regard this threat quite low for my situation, but it still somehow feels odd)