Short answer: To set up 2FA on Amazon, sign in and go to Account & Lists → Your Account → Login & Security → Two-Step Verification (2SV) Settings → Turn on, then choose Authenticator App. Scan the QR code, enter the six-digit code, and add a backup phone number. Amazon calls it two-step verification, but it is the same thing as 2FA.
Why an Amazon account is worth stealing
People underestimate this one because they think of Amazon as a shopping site. An attacker sees something different: a saved card, one-click ordering, a default delivery address they can change, gift card balances that can be drained instantly, and — if you use Alexa, Kindle, Prime Video or AWS — a key to a much bigger estate.
Gift card balance is the favourite target because it moves fast and is effectively untraceable. The pattern is depressingly simple: log in with a password reused from some unrelated breach, buy digital gift cards, send them to a throwaway address, done in ninety seconds.
If you sell on Amazon, two-step verification is not optional at all — Seller Central requires it, and a compromised seller account can have its bank deposit details rewritten.
Step 1: Find Two-Step Verification settings
- Sign in to Amazon on desktop or mobile web.
- Hover over (or tap) Account & Lists and choose Your Account.
- Select Login & Security. Amazon will ask you to re-enter your password here.
- Find Two-Step Verification (2SV) Settings and click Turn on or Edit.
In the Amazon shopping app the path is Menu (☰) → Your Account → Login & Security. The settings page is the same either way.
Step 2: Choose the authenticator app, not the phone number
Amazon presents two options: Phone number (a code by SMS) and Authenticator App. It nudges most people towards SMS because it is easier to onboard.
Choose Authenticator App. SMS codes travel through the mobile network, which means an attacker who convinces your carrier to move your number onto their SIM receives them without ever touching your phone. That is a SIM swap attack, and it is not rare. Our full comparison of SMS 2FA vs authenticator apps explains the gap.
Amazon shows a QR code with a “Can’t scan the barcode?” link underneath that reveals the secret key as text — useful when you are setting this up on the same device that displays the code.
Step 3: Scan and confirm
- Open your authenticator app and add a new account.
- Scan Amazon’s QR code, or paste the text key into the app’s manual-entry field.
- Type the six digits your app displays and click Verify OTP and continue.
Do not screenshot the QR code. It encodes your raw secret key, and anyone who obtains that image can generate valid Amazon codes indefinitely. Screenshots also tend to sync straight into cloud photo libraries. If you want the token on a second device, scan the same code twice while it is still on screen.
Curious what your app is calculating? Our explainer on how TOTP codes work covers it in plain language, and if you have not picked an app yet, our roundup of the best authenticator apps is a good starting point.
Step 4: Add a backup method — carefully
Amazon requires a backup method before it will finish enabling 2SV. Your options are a second phone number or a voice call.
This is a genuine weak spot: it means your account still has a phone-based route in. Two ways to handle it sensibly:
- Use a number that is not your primary mobile — a landline, a family member’s phone, or a secondary line. A SIM swap of your main number then does not hand over the backup route.
- Whatever you choose, treat that number as part of your security perimeter and add a port-out PIN with the carrier.
Amazon does not issue printable backup codes the way GitHub or Google do, which makes the backup number more important than usual. If you lose access to everything at once, recovery means Amazon customer support and identity documents — see our guide on recovering accounts after losing your 2FA phone.
Step 5: Decide about “Don’t require OTP on this browser”
After verifying, Amazon offers to stop asking for a code on the device you are using. On your own laptop at home this is a reasonable convenience. On a shared, work or public computer, leave it unticked — it creates a standing exception that survives until cookies are cleared.
You can revoke these exceptions later from the same 2SV settings page by choosing to require OTP on all devices again. It is worth doing once a year, or immediately after you sell or give away a device.
Step 6: Clean up the rest of Login & Security
While you are on the page, five minutes of housekeeping:
- Password — if it is reused anywhere else, change it. Credential stuffing from unrelated breaches is how most Amazon accounts fall.
- Passkeys — Amazon now supports passkeys, which are phishing-resistant in a way that typed codes are not. Adding one alongside your authenticator is a straightforward upgrade; see passkeys vs 2FA.
- Your Payments — remove cards you no longer use.
- Login with Amazon — under Your Account, revoke third-party sites you have signed into with your Amazon identity.
- Amazon Household / shared accounts — check who still has access.
Frequently asked questions
Is Amazon’s two-step verification the same as 2FA?
Yes. “Two-step verification” is Amazon’s branding for what everyone else calls two-factor authentication. A password plus a one-time code from a device you hold. Our complete guide to two-factor authentication covers the terminology.
Which authenticator app works with Amazon?
Any standard TOTP app: Google Authenticator, Authy, Microsoft Authenticator, Aegis, 2FAS, or a password manager with TOTP built in. Amazon uses the standard algorithm with no proprietary extensions. If you are choosing between the two most common apps, see Authy vs Google Authenticator.
Why does Amazon keep rejecting my code?
Usually your phone’s clock has drifted out of sync with Amazon’s servers. Switch on automatic network time in your date and time settings. Our guide to 2FA codes being rejected lists the other six causes.
Does 2FA on Amazon.com cover Amazon.co.uk, AWS and Audible?
Amazon’s regional storefronts are separate accounts unless you have merged them, so check each one you use. AWS accounts have their own, separate MFA settings in the IAM console — enabling 2SV on your retail account does not protect AWS.
Can I turn off two-step verification later?
Yes, from the same 2SV settings page — though on Seller Central it is mandatory and cannot be removed. Turning it off is rarely a good idea; if it is annoying you, use the “don’t require OTP on this browser” option on your own devices instead.
What if someone already has access to my account?
Change your password first, then enable 2SV, then check Your Orders, Your Addresses, Your Payments and gift card balance for anything unfamiliar. Enabling 2FA does not by itself kick out an attacker who already holds a valid session — sign out of all devices from Login & Security afterwards.
The bottom line
Amazon’s setup takes about four minutes and the only real decision is refusing the SMS default. App first, a backup number that is not your main mobile second, and a passkey on top if you want the strongest version. Then spend the extra two minutes on saved cards and old app permissions — that is where the actual money sits.
Need to check a code while you test the setup? Our free online 2FA code generator runs entirely in your browser and never sends your key anywhere.