The safest way to shop on Amazon is to secure the account before you buy, verify every urgent message through Amazon’s own app or website, keep payment inside the expected checkout, and act immediately if credentials or card details may have been exposed. Turn on Amazon Two-Step Verification, use a password that exists nowhere else, protect the email and phone used for recovery, and keep records of orders and payments.
Start with Amazon account security
Enable Two-Step Verification
Amazon describes Two-Step Verification as an extra layer of security for account login. It requires your password plus a unique security code, so a stolen password alone should not be enough to sign in. Amazon’s cited account instructions describe text messages and an authenticator app as code methods. Available methods and menu labels can change, so use the options shown in your live account.
As an Amazon Associate I earn from qualifying purchases.
- Sign in to Amazon through the official app or a web address you entered yourself.
- Open Your Account.
- Select Login & security.
- Find Two-Step Verification and follow the on-screen setup instructions.
- Complete a test sign-in, then confirm that your recovery phone or authenticator device is still accessible.
Keep any backup route Amazon offers in a place you can reach if your primary phone is lost, replaced, or offline. Store recovery information privately; anyone who obtains it may be able to defeat the account’s recovery process. A physical security key can be a strong form of two-factor authentication for services that support it, but Amazon’s cited instructions do not establish that every security key works for Amazon sign-in. Check Amazon’s current methods and a key’s compatibility before relying on one.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesUse a password that is unique to Amazon
Do not reuse your Amazon password on email, social networks, banking, delivery services, or shopping sites. If another service suffers a breach, a reused password can let an attacker try the same credentials against Amazon. Never share the password with a third-party site or tool. Amazon notes that a third party with your credentials may act as the account holder.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you need a third-party sign-in, Amazon may offer a “Login with Amazon” option. That can avoid handing the third party your Amazon password, but it does not make the third party trustworthy automatically. Review the service’s identity, the permissions it requests, and whether you still need the connection. A password manager can help create and store unique passwords, but choose one based on your own security and recovery requirements rather than assuming any provider is risk-free.
Protect the recovery channel
Your email account and phone number are part of your Amazon security perimeter. Use a strong, unique password and two-step protection on the email account that receives Amazon notices. Keep your phone number current and secure your mobile account against unauthorized number transfers where your carrier provides that option.
From Amazon’s account controls, review contact information and password under Login & security. Review cards and other stored payment methods under Your payments. Remove payment methods you no longer need, especially from an account used by several people or devices.
Free tools Windows power users keep installed
One-click scans. No signup required.
Recognize phishing before it reaches your account
Assume unexpected urgency is untrusted
Attackers imitate familiar companies and claim that an order failed, an account will close, a refund is waiting, or a payment must be confirmed immediately. The goal is usually to make you click a link, disclose a password, read out a security code, or provide card details.
- Do not click a link in an unexpected email, text, call-back message, or social-media direct message.
- Do not call a phone number supplied by an unrequested alert.
- Do not provide an Amazon password, one-time code, full card number, security code, or bank login in response to a message.
- Do not install software or give remote access because a message says your account or payment is at risk.
Instead, open the Amazon app or type a known Amazon address yourself. Check Your Orders, account notices, messages, and security settings from inside the account. If the alleged problem is not visible there, treat the message as a scam. Amazon advises reporting suspicious or fraudulent correspondence that claims to be from Amazon.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Inspect the domain, not just the design
A polished page, an Amazon logo, or a padlock does not prove that you are dealing with Amazon. HTTPS indicates that the connection is encrypted in transit; it does not prove that the domain belongs to Amazon or that a seller is legitimate. Look at the actual domain and navigate through a saved bookmark, the official app, or an address you already know.
Be especially cautious when a message sends you to a look-alike domain, a shortened link, a page with unusual spelling, or a site that asks you to enter information that Amazon normally collects only inside your account. Close the page rather than testing it with a “harmless” password: attackers can reuse any credential you submit.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Reject payment demands that bypass checkout
Amazon Pay warns against moving a payment away from the merchant’s intended checkout, sending gift-card claim codes, or paying by wire transfer to guarantee a purchase or refund. Federal Trade Commission guidance similarly warns about sellers who insist on gift cards, wire transfers, payment apps, or cryptocurrency. These methods can make recovery difficult or impossible.
Complete a normal purchase through the platform or seller’s stated checkout. Never send card credentials in reply to a message, and do not pay a supposed support agent who contacts you unexpectedly. A request to “verify” a refund by buying gift cards or transferring money is not a normal refund process.
Choose payment methods with practical protections
Why a credit card is often the safer default
The FTC says paying by credit card best protects you and your money if a purchase is a scam or something else goes wrong. Credit-card rules can provide a dispute path when a purchase is charged incorrectly, never arrives, or differs materially from what was ordered. The exact rights, deadlines, and procedures depend on the card issuer and applicable law, so read the issuer’s instructions and report a problem promptly.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Keep the order confirmation, seller identity, item description, promised delivery date, return terms, receipts, and payment record. Those documents help the issuer understand what happened if you need to dispute a transaction.
| Payment approach | What to check | Important limitation |
|---|---|---|
| Credit card | Issuer’s dispute process, notification deadline, and fraud-monitoring controls | Protections and deadlines vary by issuer and transaction |
| Debit card | Bank’s unauthorized-transaction reporting rules and account-monitoring alerts | Money may leave your deposit account before a dispute is resolved |
| Amazon Pay or another wallet | Provider’s dispute terms, transaction records, and verification prompts | Coverage is governed by that provider’s terms and may differ from card rules |
| Gift cards, wire transfers, cryptocurrency, or payment apps sent to a stranger | Whether the seller has a legitimate, documented reason to use the method | Recovery can be difficult; an unexpected demand is a major warning sign |
No payment method eliminates fraud. Use the method whose dispute rights, alerts, and account controls you understand, and keep the transaction inside the legitimate checkout flow.
Handle extra verification during checkout
Amazon Pay says a card issuer may redirect you to the issuer’s website or banking app for an additional check. The prompt might request a one-time code, an approval in the bank app, or another issuer-controlled confirmation. This can be a legitimate part of checkout, and the process varies by bank, card, payment type, and location.
- Read the verification screen and confirm that it is the bank or card issuer you expect.
- Use the issuer’s normal app or website if the prompt gives you a choice; do not follow a separate, unexpected message to “complete” verification.
- Approve only a purchase you initiated and recognize for the correct amount and merchant.
- Never disclose a one-time code to a caller or message sender. Enter it only in the issuer’s authenticated flow.
- If verification repeatedly fails, contact the issuer through the number on the card or its official app. Amazon Pay also says you may need to choose another payment method.
Repeated failures can result from an issuer block, an outdated phone number, an unavailable bank app, or a card restriction. Treat a request to bypass verification by paying someone directly as a fraud signal, not a workaround.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Build a safer shopping routine
Before placing an order
- Confirm that you are in the official Amazon app or a known Amazon address.
- Review the seller name, item description, delivery promise, price, return terms, and total charge.
- Use a payment method whose dispute process you know.
- Check that the card’s billing details and your Amazon contact information are current.
- Turn on transaction alerts from your card issuer or bank when available.
After placing an order
- Save the confirmation and retain the seller and return information.
- Check the order in Your Orders rather than relying on an emailed receipt alone.
- Monitor the card or account for the expected amount and unfamiliar activity.
- Remove a stored payment method when you no longer need it, particularly after using a shared or temporary device.
On shared or public devices
Avoid saving passwords or card details in a browser that other people use. Sign out when finished, close the browser, and do not allow a site to remember payment information on a device you do not control. Keep your phone, email, and authenticator device protected with their own screen lock.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What to do if you clicked, entered, or disclosed information
Speed matters, but use a known route for every recovery step. Do not return to the suspicious page or use contact details from the message.
If you entered your Amazon password on a suspicious site
- Open Amazon through the official app or a known address and change the password immediately.
- Change the same password anywhere else it was reused. Make every replacement password unique.
- Review Login & security for unfamiliar contact details or account changes.
- Confirm that Two-Step Verification and its recovery methods still belong to you.
- Secure the email account used for Amazon recovery and review it for unauthorized forwarding rules or sign-ins.
- Check orders, messages, and payment activity for changes you did not make.
Amazon specifically advises changing the password immediately when it was entered on a suspected malicious site.
If you submitted card information
- Contact the card issuer using the number on the card or its official app.
- Explain that the card details were submitted to a suspicious site and ask what replacement, freeze, or monitoring steps are appropriate.
- Remove the card from your Amazon account if Amazon Pay’s guidance applies, then confirm the issuer’s current instructions.
- Review recent and pending transactions and continue monitoring for unfamiliar charges.
Do not wait for a charge to appear before notifying the issuer. The issuer can tell you whether the card should be blocked or replaced and how to document a dispute.
If you see an unauthorized Amazon Pay charge
Check whether the transaction appears in your Amazon or Amazon Pay activity, then report it to Amazon Pay or the bank or card issuer responsible for the payment. Amazon Pay’s shopper help states that unauthorized Amazon Pay charges can be disputed when reported no later than 13 months after the transaction, subject to its terms and exceptions. That is a service-specific notice condition, not a universal deadline for credit-card disputes or every Amazon purchase. Use the current dispute instructions and contact the relevant provider promptly.
Recommended Free Tools
If personal information may have been stolen
Secure the affected accounts first, preserve messages and transaction records, and watch for follow-up impersonation attempts. For broader identity-theft recovery steps, the FTC directs consumers to IdentityTheft.gov. The FTC also advises reporting phishing. Do not assume that deleting the original message resolves the exposure; attackers may use the information later.
How serious is the risk?
The FTC reported in 2023 that online shopping scams were the second-most reported type of scam in 2022. That is a historical ranking of reports for that year, not a current estimate of the probability that any particular Amazon order will be fraudulent. The practical lesson is to treat account credentials, card details, one-time codes, and urgent payment demands as high-value information every time you shop.
Quick Recap
A compact protection checklist
- Two-Step Verification is enabled in Your Account > Login & security.
- The Amazon password is unique and not shared with another service or tool.
- The recovery email and phone are current and protected.
- Unexpected messages are checked only through the official app or a known address.
- HTTPS is treated as encryption, not proof of a legitimate seller.
- Payments stay inside the intended checkout; gift-card, wire, cryptocurrency, or stranger-directed payment demands are rejected.
- The card issuer’s alerts and dispute instructions are understood.
- Order confirmations and payment records are retained.
- Possible exposure triggers immediate password changes, issuer contact, account review, and transaction monitoring.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
