5844 - Amazon's 'one time password' problems

From AARP...

Amazon’s One-Time Passwords Backfire On Customers...

Order something expensive on Amazon and the company may insist you give a password to its couriers to receive the package. But there’s one major problem: there’s no guarantee the package you’re handed contains the expensive item in question.

The one-time password (OTP) system “adds an extra layer of security to your packages”, according to Amazon’s website. However, Amazon customers are finding that even after giving the six-digit code to the courier, they’re not getting the expensive item they ordered. Worse still, Amazon may refuse to investigate the missing item, because the OTP is considered proof it was delivered.

How Amazon’s OTPs work...

Amazon’s OTP system is, in theory, fairly simple.

When an order for an expensive item is placed, Amazon sends a text message to the customer with a six-digit code. The customer must provide that code to the Amazon courier at the point of delivery to ensure that the parcel reaches the correct customer.

This is what happened to Alex Bloor, a manager for a broadband company in England, who ordered an Apple Watch last week.

The Watch was just one of three packages Bloor was expecting that day, and when the courier arrived at his home, Bloor provided the requested code. Only after the courier left did Bloor realize that the delivery contained only two of the three items he was expecting – the Apple Watch was missing.

When Bloor raised the missing Watch with Amazon, the company’s customer support team were dismissive of his complaint. “The Apple Watch was delivered so no it is not lost,” replied an Amazon support representative in a support chat, the transcript of which was sent to me.

After Bloor explained the situation, the customer support assistant asked: “How did the courier get the OTP to mark the item delivered?”

Password problems...

Bloor isn’t the only one to have suffered that fate. Posting on Reddit, another customer reported the same problem with multiple items being delivered simultaneously, but omitting the password-protected item.

The Reddit user said his courier rang asking for directions to his house, and while he was on the phone, asked for the password for the expensive item. “He turned up around 10 minutes later and handed me a bunch of parcels (I'd placed multiple orders but most were low-value items),” the Reddit customer said. “Turns out every single order was delivered except for the high-value item.”

The customer got little sympathy when he complained to Amazon, either. “Amazon is claiming it was delivered using a one-time password and therefore they will take no further action on the matter,” the customer wrote on Reddit. They were left more than a thousand pounds out of pocket.

Protecting Amazon, not customers...

The cases highlight the gaping flaw in Amazon’s password system. As Bloor told me: “I feel like Amazon has come up with a system that may highlight to couriers that this is a good one to steal.” Especially if the password-protected item is just one of multiple items being delivered to the customer.

Amazon declined to answer several questions on how the OTP system worked, but a spokesperson said: “We have very high standards for the delivery service providers we work with and how they serve customers. We’ve made things right with the customer and we are investigating the incident.”

In fact, at the time of writing, Bloor was still waiting for a replacement Watch to arrive, more than a week after his previous one went missing.

And if Amazon sends you an OTP for an expensive item? Make sure to check the package carefully while still in the presence of the courier.

***********

TLDR - If Amazon is sending you an expensive item they text you a One Time Password. But this also lets the delivery guy know he's delivering something expensive and he might steal it especially if he's delivering multiple packages. Make sure you have your item before the delivery guy leaves. Better yet, don't give him the OTP until you see your item.