top | item 8521845

Amazon just told me to log into someone else's account – and delete it

73 points| Roedou | 11 years ago |ousbey.com

70 comments

order
[+] macros|11 years ago|reply
The I have too much time on my hands approach is to self-publish a short story to this person on how to get in touch with you and buy it from their amazon account.
[+] Roedou|11 years ago|reply
That is... inspired.

It doesn't matter how little time I have on my hands, I really want to do that now. Or maybe an app that lets them live chat me?

[+] ChuckMcM|11 years ago|reply
This is brilliant. I would totally do that in a heartbeat. I don't know if I would have them buy it (although that might be necessary to get them to read it). You could presumably do the same thing with an app which ran and said, "Let's figure out what your real email address is shall we?"
[+] PeterWhittaker|11 years ago|reply
Oh, I so much I could upvote multiple times. Brilliant.
[+] r00fus|11 years ago|reply
So Amazon's Kindle account creation process doesn't ask the user to verify their email prior to associating it with an account?

Sounds very sloppy. Could it be a regression, or was it always this way? I wonder if this could be used to spearphish or scam someone somehow?

[+] wl|11 years ago|reply
I have a first initial last name gmail account and I see a lot of this kind of thing. Tons of companies don't verify email addresses and many make it impossible to do anything about it. Cell phone companies, banks, insurance companies, PayPal, eBay, Apple... it's getting rather ridiculous at this point.
[+] wmf|11 years ago|reply
Email verification probably reduces conversions which is lost money. Why refuse to take someone's money just because they don't know their own email address?
[+] dnorton|11 years ago|reply
Neither does Apple. Someone used my email address for their iCloud account. (no, not JL.)
[+] yoctonaut|11 years ago|reply
I managed to get (first name)@(popular).com, and man, it's a core sample into what a bunch of people all over the world are doing. Signing up for cable or satellite tv, buying iPads/iPhones, sending each other family photos, ordering dinner, taking cabs, buying bus tickets, getting divorced, offending their condo association, signing up for dating/hookup sites, opening stock-trading accounts, applying for jobs, posting jobs for people to apply to, and more. And none of them know their own email address.
[+] steanne|11 years ago|reply
given that my name can be seen as an abbreviation for sainte anne, i tend to get french churches that don't know their own email address.
[+] aroberge|11 years ago|reply
The practice of checking the validity of email addresses seems to be lost on many (most?) businesses. I've found in my mailbox, from at least 4 other "A Roberge" located in either the U.S. or Canada the following:

Health insurance form and other information for a child

School report for a child

Mortgage information

Book library late notice

Nail product order confirmation

Multiple confirmations of job applications

PS4 account information

Various invitations to family gatherings

etc.

Whenever I could find the relevant information, I contacted the various people that send me the original email to correct the information. Most did not respond (including the father of a child with the above mentioned information who was copied on one email).

Sometimes the emails contained an unsubscribe button (yay) but, upon trying to use it, it asked for a password (which I obviously did not have). So, off to the spam folder...

So, I completely agree that Amazon's registration process is very flawed ... but there seems to be a lot of clueless people and businesses out there as well.

[+] fencepost|11 years ago|reply
I get these regularly, and for purchase notifications on sites where I expect the person will come back, I make an effort to track them down and notify them.

The only one where I actually put in quite a bit of effort was when I was getting the email notifications for downloading someone's CME (Continuing Medical Education) certificates as they completed courses. It turned out to be a real pain - I could find the person, but couldn't get hold of them. Approaching retirement age, rural, etc. - I think I finally ended up leaving voicemail on their son's # and with their church, though it probably would've been easier at that point to just sit down and actually write and mail a letter.

And the only one that really annoys me is the gun nut. I get more crap from whacked out black helicopter EEEEBOOOOOLLLAAAAA idiots now...... And he actually gave them money, so they just don't go away.

[+] pwarner|11 years ago|reply
I had a very similar problem with ebay. Account made with my email, not me. Again, no email verification. To make it worse I couldn't log in and delete the account since ebay required security questions to do a password reset. I ended up trying to track down and call the person, it was a while ago but I think I even sent them snail mail. (there was enough info in the emails to track them down, maybe a shipping address when they won an auction?)

Eventually they stopped, but no thanks to ebay.

Why is email address verification not more standard?

[+] russell_h|11 years ago|reply
Thats funny, a month or so ago I tried to sign up for an eBay account and never managed to make it through the buggy email verification. Last I checked I still can't use the account, or create another with the same email address.
[+] livingparadox|11 years ago|reply
I had this happen to me too, but no security questions. So I just deleted the account.
[+] anonbanker|11 years ago|reply
If we can use trust law as our starting point (trust = shared title to property), then we see that an Amazon/Kindle account is just a trust between you, amazon, and this other party. The only one investing money in the trust is this third party.

If you delete the account, you have two of the three parties' agreements documented. You need all three, in order to be able to claim that nobody's rights are being infringed. This can be done by making a good faith effort to notice the third party via multiple forms of communication. Even if they don't get to the party, you need to at least make the attempt. Send a first notice, wait ten days, if no response, send a second notice. If no response, consider that your acquiescence, and delete the account.

[+] jellicle|11 years ago|reply
It's not possible to contact the third party without logging into "their" account, which is a crime under the Computer Fraud and Abuse Act. The act of getting that contact info from someone else's account is precisely what the CFAA exists to illegalize.
[+] coldpie|11 years ago|reply
Yeah, trying to contact the user seems like a reasonable thing to do. If you've got her name, you can probably dig up an email or social media account.
[+] skamoen|11 years ago|reply
This guy doesn't seem to be willing to actually help you. I'd consider trying a new chat session with, hopefully, a new guy who's capable of doing his job.
[+] exelius|11 years ago|reply
Sounds more like he doesn't have the tools to help because Amazon had locked him out.

As a side note, this is how customer service becomes terrible. Security audits turn up processes that allow social engineering attacks, so they lock down the customer service tools. Agents get confused, so they implement rigid procedures (i.e. you can be fired for going off-script). These rigid procedures can be executed by a trained monkey at minimum wage, so agent quality declines. Rinse and repeat for a few decades and you get Comcast customer service.

[+] jawns|11 years ago|reply
Yes, based on the format of their responses, it looks like OP is dealing with support workers who are low on the totem pole.

Of course, one could argue that there's only so much effort OP should have undertake to get this problem resolved; dealing with chat-support roulette until you find someone competent might be pushing those expectations.

[+] TwiztidK|11 years ago|reply
I don't think there is much he can do. He said that he couldn't see the account details without answers to the security questions. So, the best route of action might be to reset the password, find the contact info of the Kindle owner and reach out to her directly.
[+] pessimizer|11 years ago|reply
It's just bad customer service workflow (that you weren't escalated, but locked into the script) and bad interface design (that addresses aren't verified.)

It's some ratio of lack of imagination:care.

I called paypal last week to remove an expired card from my account. At some point, Paypal has started doing background checks to come up with security questions after the fact, all three of which have to be answered correctly in order to have a discussion about your account.

One of the questions was my father's wife's (who he married when I was in my late teens and both lived in a different state) birthday month. Another was a friend's street address that I used to get an Oregon ID, and slept on her floor for about 3 months 20 years ago.

The operator was sympathetic, but what could she do? She had no way to escalate, and there was no contingency for if a question was asked that the customer may never have had the answer to. It's just sloppy.

[+] zem|11 years ago|reply
> At some point, Paypal has started doing background checks to come up with security questions after the fact

wtf? paypal keeps pestering me to link it to my bank account, with the incentive that i won't have to pay fees to transfer money to friends. i've held off out of a vague feeling that they'll find some way or the other to screw me over once i do; stories like this make me happier that i've listened to that instinct.

[+] neomech|11 years ago|reply
Reading the chat log it doesn't seem like the replies are from an actual person. Are Amazon outsourcing their customer support to a collection of AI constructs. :-)
[+] robododo|11 years ago|reply
This is the burden of having [email protected] email address.

Once, my wife had someone setup some sort of financial account with her email (CC, IIRC). They didn't verify the address!

My wife called and tried to do the right thing, but the people on the phone just didn't understand the concept that the email address was wrong. It simply wouldn't compute for them. Since my wife had the email address, she /must/ have been the account holder. Right?

[+] AjithAntony|11 years ago|reply
Me too. I'm particularly noticing in my case, since I get lots of people in India using my eponymous gmail address, that Indian banks, mobile carriers, and ISPs are terrible at every facet of this experience. Lots of spam, no unsubscribe opportunities, sending passwords in plain text in email, all mails are embedded images only with no text.
[+] colinbartlett|11 years ago|reply
"Low level customer service rep at Amazon just told me to log into someone else's account - and delete it."

Clearly, someone made a mistake. This is not some official policy sanctioned by Bezos and handed down from above, despite what the clickbait headline reads.

[+] robbrown451|11 years ago|reply
Here's how you can send the original owner a message so that you don't have to delete the account.

Log into their account, and order, to be delivered to their address, something that gives them the first letter of your message. For instance http://www.amazon.com/Sterling-Silver-Initial-Pendant-Neckla...

Then do it over and over to send them a message that their email address is wrong. You'll have to space them out by a few days, so they arrive in order.

[+] Justin_K|11 years ago|reply
I had the same issue with my Adobe account. Someone created an account in another country, with my email address. I took the liberty of doing a password reset own my to reclaim the address. Luckily, the user had purchased nothing.

I had to then go through Adobe support to reset the country, as I couldn't do it on my own.

I too was surprised that there was no process to verify the email address. What a joke!

[+] robbrown451|11 years ago|reply
I would place a bet that now that this is on HN, someone at Amazon will tell you no, don't do that, we'll fix the issue.
[+] Roedou|11 years ago|reply
It's as if that was the plan all along... ;)
[+] whiddershins|11 years ago|reply
Madness. My friend is getting emails from 3 different dating sites, all to a person who has a very similar name and managed to sign up for all these sites using the wrong email address.

Somehow none of them bothered with email authentication.

It seems as if, technically, these sites (including Amazon in this scenario) are engaging in illegal spam practices. But who knows.

[+] bryanrasmussen|11 years ago|reply
whoa, that explains what's been happening to me. I've been getting some mail from some match.com and I've never signed up.
[+] cddotdotslash|11 years ago|reply
Shouldn't Amazon be verifying the email address before they just start treating it as valid?
[+] rogerallen|11 years ago|reply
It is such negligence that so many companies do not validate email addresses.

It is especially frustrating that nearly every time this happens it comes from a "do not reply" address within the company so you can't do anything about it.

[+] jmsduran|11 years ago|reply
I recently bought a Kindle Paperwhite, and also noticed how easy it was to tie the Kindle to an email account upon purchase, all without verification. This seems like something Amazon definitely needs to fix.
[+] ck2|11 years ago|reply
It's gmail, sheesh just create a filter to delete the emails.

If you delete their account you may be committing a crime somehow, just logging in may be committing a crime, not worth it.

[+] jpetersonmn|11 years ago|reply
Why not just create a filter to send those emails to the trash? I certainly wouldn't log into the account, that's likely illegal.