Amazon account hacked - don't understand the end game...

[AlexB]

So yesterday someone managed to change my amazon email and password (I think it was an old password that wasn't strong, and was quite possibly the same as used on a site that I've found has had data stolen)

Seems to have been sorted now by Amazon, but I'm struggling to work out the benefit to the hacker:

• They only ordered one item, a £1 item that is seemingly on its way to my home address, but was paid for on a gift card, not using either of the cards linked to the account
• Although I couldn't log on using my email address the order acknowledgement and despatch notice came through to my address rather than the one they replaced it with
• They haven't changed any delivery addresses or other details
• The two cards have had no other activity on them
• From what I understand they can't use the cards linked to the account anyway as only the last 4 digits are visible and they don't have the 3 digit code (both cards are however now cancelled to be on the safe side)

The only things I can think of are:

• That they now have a name, email address and likely physical address that they plan to use in the future?
• They were hoping I would click on links in the emails or contact the seller (it was a marketplace item) that they could then get more data from me (I've done neither)
• They have access to my email account (although it was a different password to Amazon, and I have changed it since this episode) and plan to monitor correspondence to get more data?

Slightly confused tbh as I don't see why they just didn't order a bunch of stuff while they had access, and people don't generally do this just for fun I would imagine?

Anybody have any ideas?

[jeff061]

You covered my initial thoughts.

Start setting up 2-factor authentication where available. Is on Amazon and most email services.