An attacker used social engineering techniques to trick Amazon customer service into revealing a user's personal information.
Eric Springer, an Amazon and victim, describes his story on the Medium blog. It all started with a thank you email from the company’s customer service. Eric is an Australian programmer who worked at Amazon as a software development engineer. He left a few years ago and worked on several Bitcoin projects, one of which he sold.
Although Eric describes himself as very security conscious, after contacting Amazon customer service, he discovered that someone claiming to be him had contacted a representative of the popular e-commerce company and tricked them into revealing his real shipping address and phone number. He was also able to retrieve a conversation log between someone claiming to be him and an employee.
The attacker succeeded by giving the representative a fake address: that of a nearby hotel that Eric had used to register some domains, knowing that the information would eventually become public. He was then able to easily obtain Eric's real address and phone number, as well as his credit card balance.
But the social engineering attacks didn't stop there
Despite asking customer service not to provide his personal information, Eric received another email from Amazon a few months later that another incident had occurred. The attacker had attempted another attack.
Eric Springer is not happy, mainly because he believes Amazon let a dangerous stranger into his account. In a blog post on Medium, Springer revealed that he was the victim of a “social engineering” hack that exposed his information to an unknown person. With only a rough idea of Springer’s location and email address, the attacker tricked customer service into revealing almost all of his personal information. Unfortunately, the attacker resurfaced, contacting Amazon over the phone.
This incident has already been circulating online, including on Reddit, where former customer service employees (not from Amazon) have described the social engineering training they received and expressed their frustration at Amazon's failure to provide the same training.
