Recently, Groove Life, a U.S.-based brand that's been selling on Amazon for nearly a decade, lost $375,000 after their Seller Central account was hacked. Despite having two-factor authentication enabled at every allowable point and running a tight security operation with only one admin login, Amazon allowed a Swiss bank account to be added to their disbursement settings. Every dollar of their balance was swept out without any warning or secondary verification.

The founder, Peter Goodwin, shared the devastating details on LinkedIn: Amazon kept all $302,000 in ad spend and fees that drove that revenue, offered no phone support (only email tickets with random agents), and after a week replied with: "We are not liable, as the transfer originated from your account." There was no record of a foreign login, no evidence of compromised credentials, no IP evidence, no two-step authenticator logs. Just "sorry, have a nice day."

If you're using your original Amazon Seller Central login (the one you used to set up your account) for everyday work, you're leaving your business vulnerable to a catastrophic hack. Here's why this matters and what you need to do immediately to protect your account.

Why Your Admin Login Is a Security Liability

Think of your Amazon Seller Central admin account like the master key to your entire business. It has unrestricted access to:

1. Bank account and payment information
2. Tax documentation and business details
3. Advertising credit cards
4. User permissions and account settings
5. Email and phone number changes for notifications

When hackers gain access to an admin account, they can change everything - including the notification email address that would normally alert you to suspicious activity. By the time you realize something is wrong, your disbursements could be flowing to a Swiss bank account (as Groove Life discovered), and Amazon will likely claim zero responsibility for recovering your funds.

How Hackers Gain Access

The Notification Email Vulnerability

The Solution: Never Use Your Admin Login for Daily Tasks

Step 1: Create a New Standard User Account for Yourself

Step 2: Set Proper Permissions for Your New Account

Step 3: Secure Your Admin Account

Step 4: Establish an Admin Access Schedule

Complete Amazon Seller Account Security Checklist

Beyond fixing the admin login mistake, here are additional security measures every Amazon seller should implement:

User Management Best Practices

Remove Unused Users Immediately

1. Delete any users who were added but never fully set up
2. When employees leave your company, remove their access the same day
3. Notify your agency or VA team if you part ways with someone who had account access

Audit Existing Users Quarterly

1. Review who has access to your account
2. Verify permission levels are appropriate for each user's role
3. Remove admin rights from anyone who doesn't absolutely need them (hint: almost nobody needs them)
   
   

Use Role-Based Permissions

1. Give team members only the access they need for their specific responsibilities
2. Marketing team doesn't need inventory access
3. Product team doesn't need advertising access
4. Finance team doesn't need listing access

Technical Security Measures

Enable Two-Factor Authentication (2FA)

1. Required for admin account (non-negotiable)
2. Highly recommended for all user accounts
3. Use an authenticator app rather than SMS when possible

Use a Password Manager

1. Generate strong, unique passwords for each account
2. Never reuse passwords across different services
3. Popular options: LastPass, 1Password, Bitwarden, NordPass
4. Keep the password manager itself secured with a strong master password

Maintain Computer Security

1. Keep antivirus software updated and active
2. Don't click suspicious email links, even if they appear to be from Amazon
3. Use a VPN when accessing Seller Central from public WiFi
4. Regularly scan for malware, especially if your computer behaves strangely

Monitor Bank Account Changes

1. Amazon implements a 3-day hold on bank account changes, but hackers have found ways to manipulate this
2. Check your deposit methods monthly by signing in as admin
3. Set up alerts with your accountant to flag any missed disbursements
4. Know your normal disbursement schedule (typically every 2 weeks on the same day)

Notification and Monitoring

Verify Notification Settings

1. Sign in as admin quarterly to confirm notification emails are correct
2. Check that your phone number for emergency contacts hasn't changed
3. Review all email addresses receiving account notifications
   
   

Financial Monitoring

1. Track every disbursement on a shared calendar
2. Set up accounting alerts for missing Amazon payments
3. Reconcile your bank account against expected Amazon payouts weekly

Activity Monitoring

1. Review your Account Health regularly for unauthorized changes
2. Check for unfamiliar products added to your catalog
3. Monitor for unexpected changes to existing listings

What to Do If Your Account Is Already Compromised

If you discover your account has been hacked:

Immediate Actions

1. Attempt to change your password immediately if you still have access
2. Contact Amazon Seller Support through every available channel (phone, email, chat)
3. Contact your bank to alert them about potential fraudulent transfers
4. File a report with the Internet Crime Complaint Center (IC3)
5. Document everything : Take screenshots, save emails, note timestamps
   

Recovery Process

Amazon's recovery process can be slow and frustrating. Be prepared to:

1. Verify your identity using registered email, phone number, and billing information
2. Provide business documentation proving ownership
3. Wait days or even weeks for account restoration
4. Potentially lose revenue during the recovery period
   

Post-Recovery Security

Once you regain access:

1. Immediately change all passwords
2. Remove any unauthorized users
3. Verify bank account and payment information
4. Check notification settings
5. Implement all security measures outlined in this article
6. Consider engaging an Amazon account security specialist
   

The Real Cost of Poor Security

The Groove Life case illustrates the true cost of inadequate account security:

1. $375,000 stolen and unrecoverable
2. $302,000 in ad spend and fees that Amazon kept while offering no support
3. No phone support, only email tickets with random agents
4. Amazon's response: "We are not liable". Zero accountability despite the platform allowing international bank account changes without proper verification
5. Countless hours dealing with unhelpful support
6. The devastating realization that even "doing everything right" (tight security, 2FA, single admin) may not be enough

And here's the truly frightening part: Peter Goodwin noted there was no evidence the hack came from their account. No foreign login records, no compromised credentials, no IP evidence. Yet Amazon claims it "originated from your account" and accepts zero liability.

For a smaller seller, even a fraction of this impact could be business-ending. The time to implement proper security isn't after you've been hacked. It's right now.

A Simple Change That Makes All the Difference

Creating a separate user account for daily operations takes less than 10 minutes. Securing your admin credentials and implementing the other measures in this checklist might take an hour.

Compare that to $375,000 in stolen funds, Amazon keeping your ad spend while offering no support, and discovering that even with proper security measures, you may still be vulnerable to sophisticated attacks.

The security mistake isn't complex, and neither is the solution. Stop signing in as the Amazon account owner for daily tasks. Create a standard user account, lock down your admin credentials, and only access that admin account when making high-level changes a few times per year.

Your future self and your bank account will thank you.

Need Help Securing Your Amazon Business? At Elbert Mountain, we help Amazon Brands implement robust security practices and optimize their operations for sustainable growth. If you're concerned about your account security or want expert guidance on protecting your Amazon business, contact us today.