Forest Global Training Partners

Cyber Risks · Krebs on Security

How to Enable Multifactor Security on Amazon

Summary: Amazon added multi-factor authentication that requires a one-time code sent by text message, automated phone call, or a third-party app such as Google Authenticator, so an attacker would need the username, password, and access to the customer's mobile device or a mobile-provider impersonation to hijack the account. Setup runs through three steps: adding a mobile number, adding a backup phone number or authenticator app, and a final screen that explains the process and lets users skip future codes on personal devices.

Why it matters: Amazon prompts for the second factor only when it sees a login from a device it does not recognize, and users can mark devices to skip prompts - so the protection depends on how carefully those trusted devices are managed. Krebs also notes that thieves can call a mobile provider, pose as the customer, and have calls and texts forwarded to a number they control, which is why an app that works without an internet connection reduces the chance of diverted codes.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related