Amazon seller account security: a practical access-control checklist

An access review starts with names and responsibilities. Write down who controls the primary account, who handles listings, who manages advertising and who can reach the recovery email address. Include external providers and the person responsible for approving their work. Keep this inventory in a restricted business record, separate from passwords and authentication codes.

Amazon's published User Permissions Guide distinguishes primary users, secondary users and authorized partners. The primary account has broad access, while other users receive permissions for their work. Use that distinction to identify dependencies: if one person is absent tomorrow, which tasks stop, and which permissions would a replacement actually need? Resolve those questions before inviting anyone else.

Amazon's guide advises sellers to grant the minimum access needed and to avoid sharing passwords. It describes User Permissions as a Professional Selling Plan feature and directs external service providers to the Authorized Partners route. Check the current options available for your marketplace inside Seller Central before making changes.

For each invitation, list the task and the permission that enables it. A person checking inventory should not receive unrelated access simply because selecting everything is quicker. Ask them to confirm that the intended work is possible after setup. If something fails, investigate the missing permission with the account owner rather than sending the primary login.

Review the account's Two-Step Verification settings while the owner can still sign in. Confirm that the registered methods belong to the right person and that a working backup method is available. Treat the associated email account and devices as part of the same access review, since losing control of them can complicate recovery.

Amazon's recovery guidance says to try a registered backup method or trusted device before starting account recovery. If that does not work, use the official recovery process and follow its identity-verification instructions. Open the process from Amazon's own help pages. Do not send identity documents, passwords or verification codes to someone who contacts you offering a shortcut.

Make the access inventory part of joining, role-change and departure handovers. When a contract ends, ask the account owner to review the provider's access and remove permissions that no longer have a business purpose. Confirm the change in the account and record when it happened. A completed handover document alone does not demonstrate that permissions changed.

Also review temporary access after a specific piece of work, such as a catalogue update. Give each exception a named owner and a review date. This is an operating recommendation, not a separate Amazon policy: a small recurring check makes old permissions easier to notice than a review attempted only during an incident.

If unexpected access or account changes appear, record what you observed, when you observed it and which legitimate users were active. Preserve relevant notices and case identifiers in a restricted record. Describe observations accurately; an unfamiliar change is a reason to investigate, not proof of who made it.

Use official Amazon support and recovery channels for the account problem, and keep a single timeline of actions and responses. After access is restored, revisit permissions and recovery methods before closing the record. Finish by assigning the unresolved checks to specific people. This routine can improve preparedness, but it cannot promise account reinstatement or a recovery deadline.