I created an AWS account around 2018 to explore the free tier while working for a former employer. I don't remember creating any resources or doing much with it, and the account used my old work phone number for MFA. In 2019 I received a notice that the account or free-tier period was ending, but I never intentionally closed the account.
This morning I received two emails asking me to verify my payment information. The timing seemed strange, especially since the account has been inactive for years. I tried signing in, but I can't get past MFA because I no longer have access to the phone number. I was able to reset the password, and I still have account-related emails from 2023, so the account may still be open. Could these messages be routine validation of older accounts, or should I be concerned about unauthorized activity? I don't want to keep the account and would like to make sure I won't be charged.
3 Answers
If you can reset the password but MFA still points to an old phone, the account is probably still present rather than permanently deleted. Use AWS's official MFA recovery or account-support form; it is designed for cases where you cannot log in. Support can verify ownership, remove or reset the old MFA method, and help close the account or resolve any billing issue.
You generally don't need to provide payment details just because an email asks you to. First inspect the full headers or notification details and check your account by navigating to AWS manually. If the notice is legitimate, support can help you regain access and close the account. If there are unexpected charges or resources, report them immediately and ask support to secure the account.
I received similar notifications for an old, mostly unused account. It may be part of an account or payment-information validation process, but don't assume the messages are genuine just because they mention AWS. Check the sender domain and avoid using links in the emails. Sign in through the official AWS website directly, if possible, and review billing activity once you regain access.
That makes sense. I wasn't sure whether the old account would have been deleted automatically. Since I can still reset the password and have received account-specific messages recently, I'll treat it as active and contact support through the official site.