'A TikTok Shop fraudster hacked my Amazon account and spent £1,400'

Do you have an issue you need putting right? Which? is here to help get your consumer problems sorted.

Dear Which?,

I discovered that my Amazon account had been hacked after finding 26 unauthorised orders had been placed without my knowledge. 

All orders were for the same product and were delivered to 26 different addresses across the UK.

The customer details were on my Amazon account, so I contacted one of the recipients who confirmed that she had purchased the same product from a TikTok Shop seller the night before. She believed that she was buying the product legitimately through TikTok Shop, but what she actually received were items that were ordered fraudulently through my Amazon account.

The fraudster stole £1,418 in total. I reported it to Amazon, TikTok and my bank, Santander, who told me I would be reimbursed. However, this has not yet happened. Are you able to help?

Sarah Hartwell

Put to rights

Tali Ramsey, Which? consumer rights expert, says:

This must have been a nasty shock for you. This scam works by fraudsters setting up TikTok accounts and advertising items for sale on the TikTok Shop marketplace. The items are actually stocked on other online marketplaces, such as Amazon, and the fraudulent seller uses compromised accounts to purchase the products to fulfil these orders. All at no cost to the scammer.

It's likely that the fraudster managed to access your Amazon account using details that have been previously compromised in a data breach. It's wise to make sure your online accounts have strong and unique passwords, and that these are changed after a data breach. 

I contacted Santander to find out why your reimbursement was delayed. It apologised for the delay in reimbursing you. I understand you've now been reimbursed plus an additional £150 compensation for the delay.

I also contacted TikTok and it told me that it doesn’t allow any fraudulent behaviour from sellers on TikTok Shop and banned the seller who targeted you.

Amazon told me that it took immediate action to secure your account, remove all unauthorised access, cancel suspicious orders, and remove fraudulent addresses and payment methods.

Fraudulent sellers using social media platforms to advertise dodgy goods is something Which? warns about regularly. New laws introduced by the Online Safety Act (OSA) require tech platforms to keep scams off their platforms. Recently, Ofcom announced proposals to fight scam advertising on online platforms, expecting tech companies to prevent fraudulent advertisers, ban them and stop them from creating new accounts.

We want Big Tech to be held accountable for any content like this appearing on their platforms, and we want the regulator, Ofcom, to take stronger action against them.

Need to know

• To secure your online accounts, make sure you use strong, unique passwords for each account and use the platform’s security features. You could also use a password manager to store these securely, and you should always use multi-factor authentication where you’re able to.
• It's especially important to change your passwords when there has been a data breach, you can check if your account details have been compromised in a data breach by looking them up on the haveibeenpwned website.
• Avoid saving your card details to your online accounts, so if someone does manage to access one, they won’t be able to buy anything.
• If you've had money stolen or spotted an unauthorised transaction on your account, contact your bank immediately using the phone number on the back of your card. If you think you have had money stolen through a scam, contact your bank immediately and report it to Report Fraud or Police Scotland by calling 101.

Get in touch. If you've got a consumer rights problem you need resolved, email us at yourstory@which.co.uk.

Please be aware that we can't help with or respond to every email we receive. The inbox is monitored periodically during office hours, Monday-Friday 9am-5pm.