I recently discovered that when I have two-step verification disabled on my Amazon account, Amazon will allow me to sign in to my account using only my phone number and an OTP code sent via SMS. I am never asked to provide my password. So unless I'm missing something, it seems Amazon is allowing an OTP to be used as a single factor of authentication. Is this really considered secure?
I understand OTP works well when combined with password in MFA, but I have doubts about using it as a single factor. It's bothering me that someone could gain access to my Amazon account without knowing my password, if they only manage to steal my phone or even just gain access to it for a few minutes.