Quick answer. Amazon requires Two-Step Verification for Seller Central, and its Business Solutions Agreement makes you solely responsible for any action taken under your password, including actions by users you add. Anything an intruder does in your account can become your policy violation. Give every employee and agency its own login with only the permissions it needs, use an authenticator app, secure the email inbox behind the account, and check every “Amazon” email inside Seller Central instead of clicking its links. If you are compromised, secure the email and login first, remove unknown users, correct bank and listing changes, keep the evidence, and build a dated timeline before you appeal.
Most sellers treat account security as a password problem. Amazon treats it as accountability. When a stranger logs in with a phished password, changes the deposit account or edits listings, Amazon sees those actions coming from your account, and you have to explain them.
Why account security decides whether you keep selling
Two documents set the rules, and both put the burden on the seller.
What the Business Solutions Agreement says about your password
The Amazon Services Business Solutions Agreement (the BSA) has a password security clause. It says you are solely responsible for keeping your password secure, that you may not disclose it to any third party other than those you authorize to use your account under the agreement, and that you are solely responsible for any use of or action taken under your password. If your password is compromised, you must change it immediately.
The Selling Partner API terms in the same agreement apply the same rule to developer credentials. Keep them secret and secure, because you are solely responsible for activity that occurs using them.
What Amazon says about the people you add
Amazon’s help page on setting and editing user permissions carries a direct warning. Granting access lets other users complete tasks, account credentials are unique, and confidential information should not be shared with anyone. It then says you are responsible for the actions of any users you add, including any misuse or illegal activities they conduct through your account, and you should grant access only to people you know and trust.
The seller code of conduct closes the loop. One of its examples of unfair activity is allowing other people to act on your behalf in a way that violates Amazon’s policies or your agreement with Amazon. Violations can lead to cancelled listings, suspension or forfeiture of payments, and removal of selling privileges.
Amazon does not separate the account from the seller. A shared password or a forgotten agency user is an open door, and whatever comes through it is recorded against you.
How Two-Step Verification works on Seller Central
Amazon’s Two-Step Verification help page describes it as an extra layer of security. You enter your login and password, then a second code sent to a device you choose by SMS, voice call or an authenticator app. Amazon states that Two-Step Verification is required to access Seller Central. It calls it your best protection against unauthorized access even if your password is stolen, and especially if you reuse a password across sites.
Primary and backup methods
When you activate it, Amazon has you designate two different methods, a primary one and a backup for when you lose the primary device. Amazon recommends authenticator apps because they are easy to use, need no network and are free. Its rules on combinations are specific.
| If your primary method is | Your backup can be | Rule to remember |
|---|---|---|
| Authenticator app | An SMS-enabled phone or a voice-enabled phone | An app cannot be both primary and backup |
| SMS-enabled phone | A different SMS or voice phone, or an authenticator app | The same phone number cannot serve as both |
| Voice-enabled phone (landline or mobile) | A different voice or SMS phone, or an authenticator app | A mobile phone is not required. A landline works |
If you lose your primary method, Amazon says to log in with the backup and update it. To make changes you need at least one of the two methods. If you have lost both, Amazon points to its separate Two-Step Verification account recovery process.
One login, one person
Two-Step Verification is tied to the login, not the business. Amazon notes that a login used for both your Amazon buyer and seller accounts protects both. It also recommends individual logins with different email addresses, created through User Permissions, for everyone who accesses your seller account. Not doing so, it warns, could pose a security risk and could cause loss of access for anyone else using that login. Each individual login must enable Two-Step Verification separately.
Trusted devices
After a successful login you can tick “Don’t ask for codes on this device.” In Advanced Security Settings you can see how many devices are trusted for your login and select “Require codes on all devices” to clear them all. Amazon says it cannot clear a single device. In a compromise, that button forces any device the intruder trusted to ask for a code again.
The FTC’s guide to two-factor authentication adds two rules to repeat to staff. Never share a verification code with someone who contacted you first, and only let an account remember devices you own.
If this is already affecting your Amazon account, our Amazon suspension team can review the notice and prepare the response with you.
User permissions for staff and agencies
The user permissions page lists every person and outside company that can touch your account, and few sellers review it after someone is added.
Who is who in Seller Central
Amazon’s user permissions help page defines three roles. The primary user, also called the account administrator, registered the account and can reach every page and feature the account type offers. Secondary users are employees the primary user invites, and they get only the permissions granted. An employee becomes an administrator when the primary user or another administrator grants View and edit permission on the user permissions page, and can then manage permissions for others. Service providers are third parties you authorize to reach specific tools.
Amazon says managing permissions is available only on the Professional plan, and adding users is not a way to transfer an account.
Adding employees the right way
Amazon’s path is Settings, then User Permissions, then Manage Employees, then Invite Employee. The new user follows the instructions in the email they receive. To change what someone can do, use Edit next to their name. Each invited person signs in with their own email and their own Two-Step Verification.
Agencies and software should be authorized, never given your login
Amazon describes a different route for outside providers. Either the provider generates an authorization link through its Solution Provider Portal, which you open to confirm access tool by tool along with a service duration, or you find the provider in the Service Provider Network and select Authorize Provider. Amazon says access granted this way lasts only for the duration you choose and is revoked automatically on expiry, and you receive reminders beforehand so you can renew or revoke it.
That expiry is a security control in itself. The pattern that causes trouble is the opposite, a contractor given the owner’s password years ago that still works.
Give each role only what it needs
Amazon does not prescribe a permission set for each job, so the table below is our working recommendation, built on its principle of granting access only to people you know and trust. Adjust it to your business.
| Role | Usually needs | Usually should not have |
|---|---|---|
| Owner (primary user) | Everything, used rarely | Shared with anyone, used for daily tasks by others |
| Operations or shipping staff | Orders, shipment confirmation, inventory views | Deposit methods, user permissions, account info |
| Customer service staff | Buyer messages, returns, order views | Pricing, listing edits, financial settings |
| Advertising agency | Advertising tools, reports for the contract term | Bank details, user management, listing ownership changes |
| Listing or catalog agency | Catalog and inventory tools for the project | Payments, settings, permanent access |
| Bookkeeper | Payments and reports, view only where possible | Edit rights on listings or users |
Removing people the day they leave
For an employee, Amazon’s path is Settings, User Permissions, Manage Employees, then Remove user from the dropdown. For a provider, it is Manage Services, then Disable Authorization. Do both the day a person or contract ends.
Phishing emails that imitate Amazon
Attackers rarely break Amazon’s security. They persuade someone with access to hand over a password, a code or both.
The stories phishers use
The FTC’s guide to recognizing and avoiding phishing scams says these messages often look like they come from a company you know and may carry its logo. Common stories include suspicious login activity, a problem with your account or payment, a request to confirm information, an invoice you do not recognize, and a link to make a payment. Each one maps onto a seller’s daily worries, such as a policy warning, a held disbursement, a verification request or a listing removal.
CISA’s guidance on recognizing and reporting phishing lists the warning signs. They are urgent or emotionally appealing language, requests for personal or financial information, untrusted shortened links, and wrong email addresses or links. CISA’s own example of a lookalike address is “amazan.com.” It also warns that good grammar proves nothing, because some phishing emails now have perfect spelling.
The one habit that defeats most of it
Both agencies give the same core advice. The FTC says that if you have an account with the company, contact it using a phone number or website you know is real, not the contact information in the message. CISA says not to use a message’s links or phone numbers and to go through a verified website or channel you already trust. For a seller this becomes one rule. Never sign in to Seller Central from an email link. Type the address or use a saved bookmark, open Account Health or Performance Notifications, and see whether the message is there. A real warning will be waiting inside the account.
Reporting a phishing attempt
The FTC says to forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, forward phishing texts to SPAM (7726), and report the attempt at ReportFraud.ftc.gov. CISA suggests using the report or spam button in your email program. For Amazon’s own reporting address, use the one Seller Central help lists today, not one quoted elsewhere.
What to do in the first hour if your account is compromised
Signs of a compromise include a login alert or code you did not request, unfamiliar users, changed deposit details, edited listings, or buyer messages you did not send. The FTC’s guide to recovering a hacked email account lists similar signs for inboxes. You cannot log in, you get alerts about changes you did not make, or you see logins from unfamiliar devices or locations.
Order matters. Nothing is resolved while the intruder still has a way in, and that way in is usually the email account.
What not to do in the first hour
Do not reply to the message or follow its links. Do not hand your password to anyone who offers to “fix it”, because a legitimate helper never needs your credentials. Do not delete evidence while tidying up. And do not open a new seller account while this one is locked. The code of conduct allows a second account only with a legitimate business need and all accounts in good standing, and our guide on whether you can have multiple Amazon seller accounts explains why that turns one problem into two.
Related guide. How to Become a Successful Amazon Seller.
How a compromise turns into a suspension
What intruders typically change
A changed deposit account redirects disbursements. Edited listings can trigger listing policy or authenticity complaints, and our guide to defending your listings against hijacking covers how that looks from the catalog side. Marketing or off-platform messages to buyers break the code of conduct rule that communications go through Buyer-Seller Messaging and be necessary for the order. New users or authorizations give the intruder a way back after you change the password.
Why Amazon acts on the account, not the person
Under the BSA you are responsible for action taken under your password, so Amazon’s review starts from what the account did. Proving someone else did it is your job, which is why first hour evidence matters.
The claim Amazon looks at hardest
“My account was hacked” is a claim about who controls the account, and Amazon tests it. Claiming a hack to disown your own conduct is a false statement, and the code of conduct requires accurate information at all times. If the activity was yours or your staff’s, the honest appeal addresses that root cause. Our guide to being transparent with Amazon explains why candor holds up and a convenient story does not.
Proving the compromise and appealing
A hacked account case has two halves. You reclaim control, and you prove the harmful activity came from the intrusion and not from you. The second is usually harder. If you secure the account and skip the proof, Amazon is left with activity it cannot tell apart from yours.
Build the timeline first
The timeline is the central evidence. Lay out, with dates and times, your normal pattern of activity, the first sign of unfamiliar access, each unauthorized change, the moment you discovered it, and each step you took to secure and repair the account. It has to show that the harmful activity sits inside the window of unfamiliar access and does not match how you normally run the account.
Here is a hypothetical example. A seller’s operations manager received an email styled as an Amazon verification request on a Monday morning and entered their login on the linked page. That afternoon a new user appeared in User Permissions, the deposit method changed, and twelve listings were edited with unrelated products. The seller found the changes Tuesday morning, secured everything within the hour and saved the phishing email, alerts and screenshots. Every harmful action falls between Monday’s click and Tuesday’s discovery, and the evidence has to show exactly that.
Write the plan of action around the cause
A plan of action works when it gives a specific, owned answer. For a compromise, use this structure.
| Part | What it says | Evidence that backs it |
|---|---|---|
| Root cause | The specific failure. For example, a staff member entered credentials on a phishing page, or a former contractor still held a shared password | The phishing email, the alert emails, the permissions history |
| What the intruder did | Each unauthorized change, dated, kept separate from your own activity | Screenshots, timeline, notification emails |
| Corrective actions taken | Passwords changed, codes required on all devices, unknown users removed, deposit and listings restored, buyers contacted where affected | Screenshots of the corrected settings and permissions page |
| Preventive controls | Individual logins for everyone, authenticator apps, least permission, time limited agency access, alerts, a review cadence, each with a named owner and a start date | The written access policy, the review checklist, training records |
Avoid vague causes and do not blame Amazon’s tools. A promise to “be more careful” is not a preventive measure.
How to submit
Amazon’s page on appealing an account deactivation or listing removal sets out the path. Go to Account Health, click Reactivate your account at the top, follow the instructions (which may include a questionnaire, an acknowledgment, a quiz or supporting documents), and click Submit. Amazon says to monitor your email, use View Appeal if it asks for more information, and expect a reply within two days. For removed listings, it points to the Product Policy Compliance tab and Performance Notifications. For what to expect while you wait, see how long appealing on Amazon takes.
If the incident leads to identity or business verification, provide genuine documents only. Never edit or recreate a document to make it match, and never try to get around a verification step. If a genuine document is unavailable, say so and offer what you have.
An intruder’s changes got your account suspended?
Send us the case and we will tell you plainly what the evidence can show.
Where to verify each part of your security
Use this table as the map for a monthly review.
| Question | Where to check | What to look for |
|---|---|---|
| Who can access the account? | Settings, User Permissions, Manage Employees | Anyone who has left, anyone you do not recognize, more administrators than you need |
| Which outside companies have access? | Settings, User Permissions, Manage Services | Providers you no longer use, access with no end date that should have one |
| Is every login protected? | Each user’s Two-Step Verification setup. Advanced Security Settings | Shared logins, codes going to shared phones, more trusted devices than expected |
| Will alerts reach the right people? | Settings, Notification Preferences | Email addresses that are outdated or not yours, delivery failure alerts on the home page |
| Has anything changed that should not have? | Account info and deposit method. Manage Inventory | New bank details, edited listings or prices you did not approve |
| Is the inbox behind the login secure? | Your email provider’s security settings | Forwarding rules you did not create, recovery details that are not yours, no two-factor |
| Was a suspicious email real? | Seller Central opened directly, not from the link | Whether the same warning appears in Account Health or Performance Notifications |
Set notifications so you hear about problems early
Amazon’s Notification Preferences page sets which alerts go to which address, including listing and account notifications. An unselected box opts you out, and each locale is set separately. Send listing alerts to an address the owner reads daily, because an unexpected new or closed listing is often the first sign of an intruder.
Common mistakes that turn a breach into a long case
- One shared login for the whole team. Amazon recommends individual logins for everyone. With a shared login, one phished password exposes everything and nobody can show who did what.
- An unprotected email account. The FTC notes that whoever controls the inbox can reset other passwords. Two-Step Verification on Seller Central does not help if the inbox falls.
- Tidying up before recording. Removing a rogue user without a screenshot destroys the proof you need later.
- Claiming a hack that did not happen. It is a false statement to Amazon and tends to fail permanently once tested.
- Appealing before the account is secure. Amazon restores accounts to owners who can hold them securely, so an appeal that cannot show the door is closed is weak.
A security routine you can run every month
Run this checklist once a month and every time someone joins or leaves.
Who owns it
Give the routine to one named person and record the date of each review. An appeal reviewer discounts a control without an owner and a date, and that kind of control quietly stops. Once a quarter, walk the team through a recent suspicious email so checking inside Seller Central becomes a reflex.
This guide is educational information, not legal advice. If a compromise involves stolen funds or exposed personal financial data, talk to your bank and consider professional advice.
Frequently Asked Questions
Is Two-Step Verification required for Seller Central?
Yes. Amazon’s help page states that Two-Step Verification is required to access your Seller Central account, and each individual login must enable it separately.
What is the best Two-Step Verification method for sellers?
Amazon recommends an authenticator app, and the FTC rates apps as safer than text codes because they are not exposed to SIM swaps. Amazon requires a phone based backup if your primary method is an app.
Can I share my Seller Central login with my virtual assistant or agency?
You should not. The BSA makes you solely responsible for any action taken under your password, and Amazon recommends individual logins for everyone. Invite staff through User Permissions and authorize agencies as service providers with a set duration.
Am I responsible for what an employee or agency does in my account?
Yes. Amazon’s user permissions page says you are responsible for the actions of any users you add, including misuse or illegal activities, so grant only the access each person needs.
How do I know if an email from Amazon is real?
Do not use the email’s links. Open Seller Central directly and check Account Health and Performance Notifications, where a real warning will appear. CISA lists urgency, requests for information and lookalike addresses as warning signs.
Where do I report a phishing email that imitates Amazon?
The FTC says to forward phishing emails to reportphishing@apwg.org and report them at ReportFraud.ftc.gov. Amazon publishes its own reporting instructions in its help pages, so check there for its current address.
What should I do first if my seller account is hacked?
Secure the email account behind the login, change the Seller Central password, select Require codes on all devices, remove unknown users and providers, correct bank and listing changes, and save every piece of evidence with dates.
How do I prove to Amazon that my account was hacked?
Show a dated timeline that places the harmful activity inside the window of unfamiliar access, separate from your normal pattern, with the phishing message, alerts and screenshots, plus proof the account is now secured.
Get Help With a Hacked or Suspended Seller Account
If an intruder’s actions have led to a deactivation, removals or held funds, the appeal has to prove what happened and show the account is secure. You can submit your case for review, book a consultation, or read more about our Amazon suspension service.
This article is general educational information. It is not legal advice, and it does not guarantee any outcome, timeline or amount. Amazon’s policies and pages change, so confirm the current version in Seller Central before you act.
You can also see all our marketplace suspension services.
Sources
- Amazon Seller Central: Two-Step Verification
- Amazon Seller Central: Set and edit user permissions
- Amazon Services Business Solutions Agreement
- Amazon Seller Central: Selling policies and seller code of conduct
- Amazon Seller Central: Appeal an account deactivation or listing removal
- Amazon Seller Central: Notification preferences
- FTC: How To Recognize and Avoid Phishing Scams
- FTC: Use Two-Factor Authentication To Protect Your Accounts
- FTC: How To Recover Your Hacked Email or Social Media Account
- CISA: Recognize and Report Phishing
- FTC: ReportFraud.ftc.gov
