Your Kindle and your Bank Account - you should read this! January 28, 2012

Well, that was some excitement.

About an hour ago, I got 3 e-mails in a row, thanking me for my purchase of this trilogy via my Kindle. I had a bit of a freakout, wondering if there was some way that people were able to clone Kindle’s the way they did with cell phones back in the day.  I had a fun time with a very nice lady at Amazon who suggested that my credit card must be stolen or that I clearly must have logged into a public PC somewhere and left myself logged into Amazon. Which I had to patiently and kindly explain to her didn’t make sense, because A) No, I didn’t leave myself logged in anywhere, and B) If you did manage to get access to my account, why is it that you would then purchase me several e-books? I just got my kindle yesterday, was there something I did wrong in setting it up?

Maybe it was my wife’s Kindle – I checked, and the books hadn’t shown up there. We both had been playing with some Kindle-related Chrome toolbars, maybe there’s something unsecure there? Could Amazon show me account activity by IP? Because I know what subnets we log in from – and no, they can’t show you that information. Could we put some sort of child lock or region lock on purchases? Actually, no – Amazon can’t do that. When I asked why, they said that they do that so they can then pride themselves on being able to deliver a book to someone in 30 seconds or less.

Even if it’s the wrong someone.

I had both my wife’s Kindle and my Kindle sitting in front of me, when the Amazon rep read off the names of the Kindle’s, and I realized that one wasn’t in front of me. You see, I purchased my Kindle over 2 weeks ago, but the delivery date came and went. And when I checked the tracking number, it had merely been transmitted to the courier, but never picked up by them. Nevertheless, Amazon was dogged in that I had to wait a week. And so I did, with no changes to that tracking #... and then a replacement was sent out free of charge. But, and this is the important part, that lost Kindle was already activated to my account and attached to my credit card. Amazon wants you to be able to start purchasing from them right away, which I get. But that’s dangerous, as has been illustrated by the above. Someone stole my Kindle in transit to me, and was able to make purchases without any sort of verification process at all. It’s only because I got e-mail notifications of the purchases that I knew what was going on, and I’m absolutely bloody paranoid about anything. I almost wrote it off, thinking my wife had bought it, until I looked at the titles and realized that they had nothing to do with her tastes at all. 

The good news is that Amazon has disconnected that Kindle from my account, although I’m grumpy that they simply didn’t do so the moment they issued a replacement when the first was “lost” in transit.

The better news is that before they did that, I was able to use the “Send to Kindle” function. And what did I send? A word document entitled “HEY FUCKNUTS!”, letting them know that Amazon can track the location of Kindle’s through Whispernet. Is that true? I don’t know – but if you’re dumb enough to steal a seriously networked device like a Kindle, you may not be fully aware of how much they can and cannot track devices. And maybe you’ll spend an hour freaking out… just like I did.

But the fact remains: In the interest of facilitating commerce at light speed, Amazon made my bank account vulnerable on a device that was stolen (both potentially, and eventually actually stolen), and they couldn’t provide the tools to help me either place safeguards, or provide IP address information for where my credentials have been used. I have a problem with this, and you should too.

Edit: If anyone from Amazon reads this, it should be noted that the rep I dealt with was fantastic, and did everything she could with what she knew and had access to. It was clear that she shared my concern, and I spent an hour on the phone with her while she talked to several people trying to find out how to answer my questions and needs. Amazon, the company, may ultimately be getting some serious side-eye from me, but Gina the rep was awesome. I don't even want to know how infuriating this would have been if she hadn't cared, but she did. Thank you Gina!