8 months ago I got the honors to sit with Jeff Bezos for 20 minutes. I had about 25 questions which I wanted to ask him about his success and mindset. Instead, I asked him if he could give me an example of a problem within Amazon which they couldn’t easy fix. He told me that it is difficult for their support department to verify the identity of the end-user. Amazon is confronted with scammers and impersonators every single day and they don’t know how to stop them. I couldn’t offer Jeff a solution to stop them, but I did find a way to slow them down. We extended their existing service portal with new options to verify the identity of their end-users. Enforcing user authentication is the key aspect of preventing frauduleus actions.

The flaws of X (Twitter)

in July 2020, Twitter experienced a major security breach when hackers used a vishing (voice phishing) scam to successfully access thousands of high-profile accounts, including the profiles of Barack Obama, Joe Biden, Jeff Bezos himself, and Elon Musk.

The hackers used these accounts to tweet a large bitcoin scam, resulting in the swift theft of just over $100,000. Unlike the traditional scams, these attacks target carefully selected individuals by gathering extensive information from the account holder from social media and other public sources. This details are then used to identify employees who are most likely to cooperate and have access to the desired resources, at which point attackers are primed and ready to wreak havoc.

Hackers who call Amazon support & impersonate end-users

For Amazon to be verifying user identity in this vishing age is more important than ever before. With the solid rise of cyber-attacks and social engineering, it has become crucial for Amazon to have security measures in place to safeguard their employees, protect their sensitive client information, and prevent any unauthorized access to their systems and data.

One effective way to safeguard against these types of attacks was to implement a extra secure service desk solution, which allows the support employee for the verification of user accounts with existing data beyond the just knowledge-based authentication. This new method is successfully achieved by sending a one-time code to the mobile number of the clients account or using existing authentication services to verify the callers ID.

In addition to verifying and enforcing user authentication, this new feature for Amazon also allows for the secure reset or unlocking of user accounts. This is done only after Amazon has successfully verified the user and this can be combined with a self-service password reset tool to assist with account unlocks and the password reset process.

Jeff was more than happy with what we did. This project was a great learning experience for our organization. When I met Jeff, I wanted to ask him questions for myself. Instead I asked a question which benefited my entire organization and gave us the opportunity to earn a living. We are grateful for Amazon that they allowed us the chance to prove ourselves to them and that we already received a request for another project from them.

Good things happen when you get your priorities straight.