Key takeaways
- Use a password manager and two-step verification.
- Individual users beat shared logins.
- Verify messages by logging in directly.
- Have a written incident plan.
Secure the primary login
Use a long, unique password stored in a reputable password manager and enable two-step verification. Use an email address you control and protect it equally well, because many resets flow through email.
Keep recovery information current and avoid sharing the primary login with anyone.
Use individual users
Give each person an individual user with limited permissions, as described in our permissions guide. This preserves accountability and lets you remove access cleanly.
Recognize phishing
Fraudulent messages imitating Amazon are common. Warning signs include urgent threats, links to unfamiliar domains, requests for credentials or payment details and unexpected attachments. When unsure, do not click; instead, log in directly and check Seller Central notifications.
Train everyone with access to follow the same rule.
Protect payment and bank details
Limit who can view or change payment and bank settings. Review any change to these settings immediately and ask users to report unexpected verification prompts.
Manage devices and vendors
Keep devices updated, use screen locks and avoid public networks for sensitive tasks. Review third-party apps and tools connected to your account and remove any you no longer use. Make sure any provider with access follows the same standards.
Prepare an incident plan
Write down what to do if you suspect compromise: change passwords, review users and recent changes, contact Amazon through the official channels, and notify your bank if needed. Practice makes the real response faster.
A simple monthly security routine
Make security a habit rather than a project. Each month, review the user list and permissions, confirm that two-step verification devices are current, check recent account changes for anything unexpected, and review connected third-party tools. Ten minutes a month is far cheaper than recovering from a breach.
Record the review in your operations log so there is evidence it was done, which also helps when onboarding auditors or partners.
- Review users and permissions
- Confirm verification devices and recovery details
- Check recent account changes
- Remove unused connected tools
Common mistakes
Typical weak points are shared mailboxes used for several roles, personal email addresses tied to the business account, former contractors who still have access and passwords reused across services. Another is installing tools that request broad access without checking what they actually need.
Remove what you do not use, narrow what remains and keep the owner account locked down.
Security when you outsource
Treat any provider with access as part of your security perimeter. Ask them to confirm that their staff use individual logins, strong authentication and secure devices. Agree in writing how and when access is removed, and what happens to any data they hold after the engagement.
Do not accept requests to bypass verification, share one login across a team or paste credentials into chat. A provider that insists on shortcuts is a risk to your account.
Frequently asked questions
Is it safe to give an agency my API keys?
Share only what is required, through secure channels and with limited scope. Never post them in forms or email.
How often should I change passwords?
Change them if you suspect exposure and when people with knowledge leave. Strong unique passwords matter more than frequent arbitrary changes.
This guide is general information. Amazon's fees, policies and program rules change and vary by marketplace, so confirm current details in Seller Central and, for tax or legal questions, with a qualified adviser.