Amazon and eBay 2FA: the setting buried too deep

Somewhere in your Amazon account sits a gift-card balance you have been meaning to spend since 2023, several saved payment methods, the complete purchase history of your household, your home address, and a Prime subscription holding it all together. The switch that protects this dossier exists, works fine, and is buried deep enough that finding it has become a standing search query. Amazon calls the feature Two-Step Verification, which does not help, because nobody goes looking for a setting by that name.

This is a guide to Amazon 2FA and eBay 2FA as of late 2026: where the settings actually live, why the authenticator-app option is worth the extra minute over the SMS default, and why shopping accounts deserve more security respect than they usually get. The mechanics of the codes themselves are in our TOTP primer; this post is about the menus, the quirks, and the fraud economics.

What a shopping account is actually worth

To you, Amazon is a store. To an attacker, it is a prepaid budget with your name on it. Saved payment methods convert a takeover directly into purchases — ordered fast, shipped somewhere new, disputed slowly — and reshipping fraud is quiet enough to run for days on a busy account. A gift-card balance is even better from the attacker's side: balances can be drained into purchases or forwarded gift cards, and recovery is close to irreversible in practice, with none of the chargeback machinery that makes credit-card fraud survivable.

Then there is the data. Years of order history turn a generic phishing email into a specific one: "your order could not be delivered," referencing a real item, arriving the same week you actually ordered something. Prime raises the stakes by holding subscriptions and household sharing. And an eBay seller account is a different category entirely — a feedback rating built over years, and performance standards that punish exactly the kind of disruption a takeover causes. For a seller, that is not an account, it is the front door of the livelihood.

Finding Amazon's setting

The path, hedged in advance because Amazon relabels things more often than it redesigns them: sign in, hover over the account menu, click Login & security, sign in again — the re-entry prompt is a good sign you are near something that matters — and scroll down to Advanced Security Settings. Under that heading sits Two-Step Verification and its Get Started button. Amazon's help pages walk the same path with current screenshots.

Enrollment offers SMS codes, voice-call codes, and an authenticator app, and the default flow leans hard toward the phone number. That is the one decision worth overriding: pick the authenticator app. There is no Amazon-branded authenticator to install — any TOTP app works with Amazon, which is the quiet advantage of the standard. Scan the QR code, type one six-digit code to confirm, and from then on the codes come from your device instead of your carrier.

The difference is not academic. SMS codes go to a phone number, and phone numbers can be moved to an attacker's SIM by someone who convinces your carrier — SIM swap protection covers how that attack actually runs, and our rundown of which 2FA methods can be bypassed ranks the damage. An authenticator-app enrollment gives the SIM mover nothing to intercept.

Amazon's quirks, in the order you will meet them

The OTP at login. Even with two-step verification switched off, Amazon will sometimes text or email an OTP code at sign-in when something looks unusual — a new device, a new country. People search "Amazon OTP code" constantly because an unexpected code arrived. Two things to know. First, that flow is Amazon's risk engine, not the 2FA you enrolled; it runs whether or not you have configured anything. Second, an OTP you did not request means someone has your password and is trying the door. Treat it as a fire alarm, not spam.

Trusted devices. During enrollment, Amazon offers to remember the browser you are on. Sensible for your own laptop, and the reason the feature stays livable — you are not typing a code for every afternoon purchase of batteries.

Regional sites. Amazon runs separate storefronts — amazon.de, amazon.co.jp, and the rest — and their account-security surfaces have historically been inconsistent, with settings configured on one regional site not always behaving identically on another. Coverage has improved, but if you actively shop a regional Amazon site, check its Login & security page separately rather than assuming the US settings traveled with you.

Recovery friction. If the phone holding your codes disappears, Amazon's account recovery is a process — identity documents, waiting, a support conversation — rather than a button. That slowness is the correct trade for an account holding payment methods, but it makes two habits worth forming: save the backup codes offered during enrollment, and keep a second enrolled factor where you can. The general playbook is in our guide to 2FA not working.

eBay's version, one menu shallower

eBay's two-factor authentication lives closer to the surface: Account settings, then Sign-in and security, then Two-step verification — the labels drift like everyone's, so treat that as a map. eBay's help pages describe the current method set, which as of this writing includes an authenticator-app option alongside SMS. The advice is identical with less complaint: take the app option, save whatever backup codes or recovery path is offered, and do not build on SMS where a choice exists.

eBay matters more than its menu depth suggests, because of the seller side. A buyer-account takeover costs someone a surprise package. A seller-account takeover touches a feedback rating that took years to build, orders that go unshipped while you argue with support, and performance metrics that record the disruption itself as damage.

The retail pattern, and the payment layer underneath

Amazon and eBay are roughly the ceiling of what shopping-site 2FA looks like in 2026. The pattern across retail generally is thinner: plenty of large retailers still offer SMS-only, and many offer nothing — the second factor arrives as an email code at best, which is one password away from useless. The practical rule is unglamorous: check the handful of shopping accounts that actually hold payment methods or balances, and enable the strongest option each one offers, even when that option is SMS. A texted code is a weak factor, not a fake one.

The account that deserves the most attention in this stack is often not a retailer at all. PayPal sits underneath half of these checkouts and supports a proper TOTP authenticator; our finance 2FA guide covers it alongside the banks.

One standard, five minutes

The quiet advantage of the authenticator-app option is that it is the same standard everywhere. The TOTP enrollment that protects Amazon works identically for eBay, PayPal, your email, and every other account that offers an app option — one app, one QR-scanning ritual, no per-site relearning. When the shopping entries start piling up next to work ones, create a free account: the vault is zero-knowledge, encrypting each secret in your browser before upload so the server stores only ciphertext, and it keeps shopping in its own folder, away from the entries that matter for work.

Five minutes, one QR scan, one set of backup codes saved somewhere that is not your phone. That is the whole job, and the cheapest insurance a shopping account will ever buy.

Frequently asked questions

How do I turn on Amazon two-step verification?

Sign in, open your account's Login & security page, sign in again, and scroll to Advanced Security Settings, where Two-Step Verification has its Get Started button — labels drift, but the feature has lived on that page for years. Choose the authenticator-app option rather than the SMS default, scan the QR code with any TOTP app, and save the backup codes before closing the tab.

Does Amazon support authenticator apps?

Yes. Amazon's Two-Step Verification includes a standard TOTP option — the same six-digit, 30-second system used by banks and git hosts — enrolled by scanning a QR code with any authenticator app. It is not the default, which leans on SMS, so you have to pick it deliberately during setup.

How do I enable two-factor authentication on eBay?

From eBay's Account settings, open Sign-in and security and look for the two-step verification option, which as of this writing supports an authenticator app alongside SMS. Take the app option, confirm one code, and save the recovery path offered. The whole procedure takes a few minutes if you already have an authenticator installed.

Why did Amazon text me an OTP code I did not request?

Because something — usually someone — just tried to sign in as you, and Amazon's risk engine demanded a one-time password before letting them in. The code arriving means the door held, but it also means your password is probably out in the world: change it, check where else it was reused, and enroll a proper second factor.

What happens if I lose my phone with Amazon 2FA on it?

Amazon's recovery process works but is deliberately slow — expect identity verification and a support conversation rather than an instant reset, which is the correct trade for an account holding payment methods. Backup codes saved during enrollment are the fast path back in, which is why saving them is the step that actually matters.