Stillcode › Two-factor authentication › Amazon
What Amazon supports, the caveat it records against its own setup, and what happens to those codes when the phone they live on stops existing.
These are the second factors Amazon offers on amazon.com. Which ones you
see can depend on your plan and your country;
what each of the seven actually costs you is set out once.
| Method | What it is | |
|---|---|---|
| Authenticator app (TOTP) | Supported | Computed on your own device; nothing is sent to produce it. |
| SMS text message | Supported | Texted to your number, so your carrier is part of the lock. |
| Voice call | Supported | Read out over a call; the same carrier dependency as SMS. |
| Hardware security key | Not offered | A physical key you tap; the one option phishing does not beat. |
Amazon's own caveat, as recorded in the directory: SMS or phone call required to enable 2FA. Enabling on Amazon.com activates 2FA on other regional Amazon sites, such as UK and DE.
Data sourced from 2FA Directory by 2factorauth. Snapshot 2026-09-24.
Amazon offers both SMS and an authenticator app. They are not equivalent — a texted code depends on your mobile carrier and survives no longer than control of your phone number, while a generated code never travels. If both are enabled, the account is only as strong as the weaker one, because an attacker picks.
Of the fifty services on this site, eighteen carry a caveat of the service’s own in the directory,
and Amazon is one of them. Three of the fifty accept exactly this combination, so the same
decision comes up on two other
services here. Among the two services filed under retail, not one
accepts a hardware security key.
The directory files Amazon under retail, records three of the seven second
factors it tracks, and points at instructions published at
www.amazon.com/gp/help/customer/display.html?nodeId=G3PWZPU52FKN7PW4.
Amazon is amazon.com, and the same account also signs you in at
amazon.ae, amazon.ca, amazon.cn, amazon.co.jp, amazon.co.uk, amazon.com.au, amazon.com.br, amazon.com.mx, amazon.com.tr, amazon.de, amazon.es, amazon.fr, amazon.in, amazon.it, amazon.nl, amazon.sa, amazon.se, amazon.sg. Two-factor authentication
is a property of the account, not of the address you happened to type — switch it on once
and every one of those is covered. That also means losing the second factor loses all of them at
once.
Amazon's own instructions: Amazon — two-factor authentication — linked, never copied, because a stale menu path here locks people out.
Amazon publishes no dedicated page for losing your second factor, which in practice means the route back is ordinary account recovery: proving who you are to support, on their timetable.
Background: how the codes work · what still works when the phone is gone.
An iPhone, iPad and Mac authenticator for these codes that makes no network calls at all. What is free and what Pro adds. Get it on the App Store