iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The safest approach is layered: enable Amazon Two-Step Verification, use a password that exists nowhere else, secure the email and phone used for recovery, and treat every unexpected account or payment message as untrusted. Reach Amazon through its app, a saved bookmark, or an address you already know instead of using a message link.
For purchases, keep checkout on the merchant’s normal platform, prefer a payment method with useful dispute rights, complete any verification requested by your card issuer, and save your order and payment records. If you entered credentials or card details on a suspicious site, act immediately rather than waiting for an unauthorized charge.
What you are protecting
An Amazon account can expose more than a shopping history. It may contain saved addresses, order records, payment tokens or card details, digital purchases, gift-card balances, and a trusted email address that can be used to reset other accounts. A criminal who obtains the password may place orders, change contact information, or use the account to make convincing fraudulent requests to you or your contacts.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Payment information can also be stolen outside Amazon. A fake delivery notice, refund message, seller page, or sponsored search result may send you to a lookalike site that collects card details. The visible padlock is not enough: HTTPS encrypts the connection, but it does not prove that the site belongs to Amazon or that a seller is legitimate.
The Federal Trade Commission (FTC) reported in 2023 that online shopping scams were the second-most reported scam type in 2022. That historical ranking is not a current prevalence estimate, but it illustrates why account security and shopping judgment need to work together.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Harden your Amazon sign-in first
Turn on Amazon Two-Step Verification
Amazon describes Two-Step Verification as “a feature that adds an extra layer of security to your account log-in.” It requires your password plus a unique security code when you sign in, reducing the value of a stolen password by itself.
- Sign in through the Amazon app or a known Amazon web address.
- Open Your Account.
- Select Login & security.
- Find the Two-Step Verification setting and choose the option to enable or manage it.
- Follow the current on-screen instructions to register the method Amazon offers for your account.
Amazon’s cited help describes text messages and an authenticator app as code methods. Labels, supported methods, and recovery choices can change, so use the live settings page rather than relying on an old screenshot or guide. Keep a backup route wherever Amazon offers one, and store recovery information somewhere safe and separate from the phone you normally use.
Choose a practical verification method
When an account supports more than one method, evaluate four things:
- Phishing resistance: whether a fake site can easily capture or relay the code.
- Availability: whether you can reach the phone or device when traveling, changing numbers, or losing service.
- Recovery: whether you have a documented backup method if the primary device is lost.
- Compatibility: whether Amazon actually supports the method for your account and region.
A physical security key can be a strong form of two-factor authentication on services that support it. Amazon’s cited account instructions do not establish that every security key works for Amazon sign-in, so verify current compatibility before buying or depending on one. An authenticator app may avoid dependence on text delivery, while text messages can be simpler but rely on a reachable number. The secure choice is the method you can maintain and recover without bypassing protection.
Use a password that is unique to Amazon
Do not reuse your Amazon password on email, social media, banking, delivery, or any other service. If another service is breached, a reused password gives an attacker a ready-made attempt at Amazon. Keep the password confidential and do not enter it into a third-party tool that claims to “manage” your account.
A password manager can help generate and store a different password for each service; treat it as optional support, not a guarantee. Protect the manager with its own strong, unique credentials and multi-factor authentication where available. Never share your Amazon password with a seller, support contact, browser extension, or “verification” page reached from an unsolicited message.
Protect the recovery channel
Your Amazon email address and phone number are part of the account’s security boundary. Use an email account with its own unique password and two-step protection, keep the recovery phone number current, and review those details in Login & security. If someone controls the email account, they may be able to reset Amazon even when your Amazon password is strong.
Review account and payment settings
Check contact and sign-in details
Open Your Account > Login & security from a known route. Confirm that the email address, phone number, password, and two-step settings are yours. Remove obsolete phone numbers or addresses that you no longer control. If you see a change you did not make, change the Amazon password immediately and secure the associated email account before investigating further.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Audit stored payment methods
Amazon’s account controls place saved cards and other payment details under Your Account > Your payments. Review the list periodically, delete cards you no longer use, and investigate any unfamiliar payment instrument. Removing an old card reduces the number of payment credentials available if the account is taken over; it does not cancel the card with the issuer.
Keep a record of the cards you intentionally store, including their last four digits and the reason they remain on the account. That makes an unfamiliar entry easier to spot without recording the full card number in an unprotected note.
Recognize phishing before it reaches your account
Urgency is a warning sign
Attackers commonly impersonate Amazon, a delivery company, a bank, or a seller. Typical messages claim that an order is blocked, a payment failed, an account will close, or a refund is waiting. The goal is to make you click before you verify. Amazon and the FTC advise treating unexpected messages as untrusted until you check independently.
- Do not click an unexpected email or text link to “fix” an account, delivery, or card problem.
- Do not call a phone number supplied in an unsolicited alert.
- Do not provide a password, one-time code, full card number, security code, or bank login in response to a message.
- Be suspicious of requests to keep a transaction secret or to act within minutes.
Verify from inside Amazon
Open Amazon with a saved bookmark, the official app already installed on your device, or an address you type yourself. Then inspect Your Orders, account notifications, messages, and Login & security. A genuine order or account issue should be visible through the account itself; do not rely on the message’s branding, logo, caller ID, or display name.
Amazon says suspicious or fraudulent correspondence claiming to be from Amazon should be reported through its current reporting process. Preserve the message, sender information, and any web address as evidence, but do not revisit a dangerous page merely to collect more details.
Spot payment diversion scams
Amazon Pay warns about demands that move payment away from the merchant’s normal checkout. Stop if someone asks you to:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- send a gift-card claim code as payment or as a condition of a refund;
- wire money to “guarantee” an order, release a package, or unlock a refund;
- pay through an unusual app, cryptocurrency transfer, or personal account when the transaction normally stays on the platform;
- send card details by email, text, chat, or phone to complete a purchase.
The FTC gives similar advice: sellers who insist on gift cards, wire transfers, payment apps, or cryptocurrency remove protections that may exist with a card transaction. Complete a normal purchase through the platform’s intended checkout and keep the conversation inside the service where possible.
Use safer payment practices at checkout
Prefer a payment method with meaningful dispute options
The FTC says, “Paying by credit card best protects you and your money in case of a scam, or if something else goes wrong.” Credit-card protections can help when a purchase is charged incorrectly, never arrives, or differs materially from what was ordered. Coverage, deadlines, and procedures vary by issuer and jurisdiction, so read your card agreement and contact the issuer promptly when something is wrong.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
No payment method eliminates fraud. A card can still be compromised, and a dispute is not a substitute for checking the seller and order details before paying. Keep the order confirmation, seller name, item description, promised delivery date, return terms, receipts, and payment record together until the transaction is resolved.
Understand issuer verification
Amazon Pay says your card issuer may redirect checkout to the bank or issuer for an additional verification step. Depending on the bank, card, payment type, and location, that may involve a one-time code or approval in a banking app.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Confirm that the verification page is the issuer’s genuine site or app, not a page opened from an unrelated message.
- Read the transaction description and amount before approving.
- Complete the issuer’s requested step and return to checkout only through the displayed flow.
- If verification fails repeatedly, contact the issuer using the number on the card or its official app. Amazon Pay also advises trying another payment method when the issuer cannot complete verification.
Never disclose an issuer code to a caller or message sender who claims to be Amazon support. A legitimate verification prompt is tied to a transaction you started, not an unexpected request for a code.
Do not confuse HTTPS with legitimacy
HTTPS indicates that data is encrypted in transit between your browser and the site. It does not confirm that the domain is Amazon, that a marketplace seller is genuine, or that the offer is safe. Check the exact domain, avoid lookalike spellings, and reach the service through a known route. A polished design and a padlock are not independent proof.
A routine that keeps protection current
Before you shop
- Install operating-system, browser, and Amazon-app updates from their normal update channels.
- Confirm that Two-Step Verification still has a working primary method and backup.
- Check that the recovery email and phone number are current and protected.
- Decide which payment method gives you the dispute rights you want for this purchase.
While you shop
- Start from a bookmark or the app, not an unexpected advertisement, email, or text link.
- Check the seller, price, delivery promise, return terms, and domain before entering payment information.
- Keep checkout on the platform’s normal payment flow.
- Approve bank or card verification only after confirming the amount and merchant.
After you pay
- Save the order confirmation and payment record.
- Watch Amazon orders and your card activity for unfamiliar transactions.
- Keep return and dispute deadlines on your calendar.
- Remove a payment method you no longer need to store on the account.
What to do after a suspicious click or disclosure
Speed matters, but use a known device and known route for every recovery step. Do not return to the suspicious page to “undo” what happened.
If you entered your Amazon password
- Open Amazon through the app or a known address and change the password immediately.
- Change the same password anywhere else it was reused, starting with your email account.
- Review Login & security for changed contact details, active sign-in information, and Two-Step Verification settings.
- Review orders, messages, and saved payment methods for activity you did not authorize.
Amazon specifically advises changing the password immediately when it was entered on a site suspected of being malicious. Do not wait for a warning email or an unauthorized order.
If you submitted card information
- Contact the card issuer through the number on the card or its official app and explain that the details were submitted to a suspicious site.
- Ask what monitoring, replacement, or transaction-blocking steps it recommends.
- Remove the exposed card from Amazon’s Your payments area to prevent improper reuse, while remembering that removal does not replace the issuer’s action.
- Monitor statements and notifications and dispute unauthorized charges through the issuer’s process.
Use the issuer’s instructions even if no fraudulent charge has appeared. The issuer can tell you whether replacement is necessary and which deadlines apply.
If an Amazon Pay charge is unauthorized
Review Amazon Pay activity and report the transaction to Amazon Pay or the relevant bank or card issuer, depending on how it was paid. Amazon Pay’s Shopper FAQ states that unauthorized Amazon Pay charges may be disputed no later than 13 months after the transaction, subject to its terms and exceptions. That is a service-specific condition, not a universal deadline for credit-card disputes or for every Amazon purchase; use the current dispute instructions and contact the provider promptly.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If personal information may have been stolen
Secure the email account and any other account that used the exposed password. Watch for password-reset messages, new-account notices, and changes to financial records. The FTC directs people with suspected identity theft to IdentityTheft.gov for recovery guidance and advises reporting phishing through its consumer-protection channels.
How to report and document the incident
Keep the original message, sender address, full headers where available, screenshots, order number, web address, dates, and support case numbers. Do not forward malicious links to friends or coworkers without warning.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Report impersonation or suspicious correspondence to Amazon through its current reporting option.
- Report payment fraud to the card issuer, bank, or Amazon Pay as applicable.
- Report phishing and identity-theft concerns to the FTC using its current consumer reporting process.
- Record when you changed passwords, contacted the issuer, removed a card, and disputed a charge.
Documentation helps distinguish an account takeover from a merchant dispute and gives the issuer or service provider the timeline it needs.
Common mistakes that undermine otherwise good security
Following a “support” link to change a password
An unexpected link can lead to a convincing copy of the sign-in page. Navigate independently and change the password from the known account interface.
Reusing a password after an incident
Changing only Amazon’s password leaves every reused account exposed. Change each reuse, beginning with email and financial services.
Approving a code you did not request
A one-time code can confirm an attacker’s sign-in attempt. Deny unexpected prompts, change the password through a known route, and review security settings.
Recommended Free Tools
Paying outside the normal checkout
Gift cards, wires, cryptocurrency, and unusual payment-app requests can remove dispute options. Stop the transaction and contact the platform through its official support path.
Assuming a saved card is harmless
A stored method is convenient but increases what an intruder can use after an account takeover. Keep only current methods and monitor activity.
Waiting for certainty
You do not need proof of fraud before changing an exposed password or calling the issuer. Early action limits the time an attacker has to use the information.
A compact protection checklist
- Two-Step Verification is enabled in Your Account > Login & security.
- The Amazon password is unique and confidential.
- The recovery email and phone number are current and secured separately.
- Saved payment methods in Your payments are recognized and necessary.
- Unexpected messages are verified inside Amazon, never through their links or phone numbers.
- Checkout remains on the platform’s intended payment flow.
- Issuer verification is approved only for a transaction you initiated and checked.
- Order, seller, return, and payment records are saved.
- Exposed credentials or card details trigger immediate password changes, issuer contact, and activity review.
The practical bottom line
Secure Amazon shopping is not one setting. Enable Amazon Two-Step Verification, isolate the account with a unique password, protect the recovery channel, verify every problem from inside Amazon, and keep payment inside the normal checkout. Prefer payment methods with dispute protections, preserve records, and contact the issuer immediately if card data may have been exposed. Those steps reduce both the chance of account takeover and the damage when a phishing attempt gets through.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
