My mother recently had her Amazon account (buyer, not seller) hacked. She is not a security expert but does work in database management, so she is definitely not computer illiterate. I am also not a security expert but I work as a software engineer, and still this situation is strange to me. She asked me for advice and despite our best efforts, the hack is still ongoing. I would like to know how this hack could have been carried out, and what steps should be taken to stop further damage.
Here is the sequence of events, to the best of my memory (as she told the story to me over several phone calls):
- Two weeks ago my mother noticed a $50 Nintendo eShop Gift Card ordered by her Amazon account. She immediately understood that her account was hacked.
- She immediately changed her password (I later learned that this was a 1-character change) and turned on two-factor authentication (2FA) going to her cell phone. She assumed that this process would "kick off" the hacker who might still be logged in, in their own browser session.
- A couple days later another unauthorized purchase was made, again for a Nintendo eShop Gift Card. During this time, my mother did not receive any messages related to 2FA.
- The hacker added a new credit card to the account, using a name and card number that we do not recognize. The billing address was left unchanged.
- My mother called me at this point asking for advice, since she didn't understand how the hacker still had access to the account after the password was changed and 2FA was turned on. I was also confused, and advised her to change the password to a completely different one, and then call Amazon for advice. I was unable to find an option on Amazon's website to force other account sessions to be logged out. I also hypothesized that her computer could be compromised, for example with a keylogger that would make password changes useless (but how does that get around 2FA?). I also considered the possibility of malware on her computer placing the fraudulent orders on her behalf, but it would take an incredibly specialized attack to do this, and it doesn't seem like an extremely skilled hacker would go through that trouble for a couple hundred dollars in gift cards.
- She spoke to an Amazon representative. The representative did not know whether the process of changing a password will automatically log out other sessions, but the representative did make a request for that to happen (by putting the account "on hold").
- My mother changed the password to a completely different one, using a different computer.
- Today another unauthorized purchase was made, $40 worth of Nintendo eShop Gift Cards. The hacker also added a credit card with my father's name and his work address, but we do not recognize the card number. Again my mother has not received any suspicious 2FA messages.
- How might this attack have occurred?
- What can we do to stop the attack?
So far all of the following has been unsuccessful: two password changes, the latest being a completely different password set on a different computer, adding 2FA, and having the account put "on hold" which according to the Amazon representative should log out other sessions.