Thanks for the insider info. One question I have though is if they did have access to my account and are able to change addresses after an order is made online, why not go for the gusto and make really expensive orders using my on-file credit card numbers instead of just doing replacement items?
In any case, I've changed both my password and my email address on Amazon, so if they did have access to the account that should solve that issue for now. The whole situation has made me paranoid enough that I'm considering creating a locked-down custom VM used solely for Amazon shopping.
It's because they didn't want to alert you of the charge. Coming from a previous blackhat, the last thing a blackhat would want to do is alert you that something is happening. How often do you check your bank account? Probably once a day, maybe more. How often do you check your Amazon? Maybe only when you're going to buy things. I have my accounts set to text/notify me with every transaction detail.
Another reason why it'd be a replacement is because you don't get charged anything directly. They're betting you see the $0.00 charge, no bank activity, and you'll just brush it off like it was just a glitch. Not only this, but half the people who do this aren't even 18 and they're just reading tutorials on forums for how to get free stuff by social engineering or "hacking."
In any case, I've changed both my password and my email address on Amazon, so if they did have access to the account that should solve that issue for now. The whole situation has made me paranoid enough that I'm considering creating a locked-down custom VM used solely for Amazon shopping.