URGENT: Account compromised – root hardware MFA enabled – cannot log in – billing fraud

Hello,

Sorry to hear of the ongoing issue regarding your account. I was able to locate your cases on my end, and shared your feedback internally with Support. Since the cases were created outside of the console, Support is limited in how they can assist, which I understand is frustrating.

To work around this, I recommend reaching out directly to our MFA team instead using this form: go.aws/contact-mfa. When filling out the form, explain the situation in detail, and refer to any open cases you have. This will be helpful to Support.

Continue to monitor your inbox for a response from our MFA team with the next steps to take.

- Marc O.

Thank you Marc — I appreciate you locating the cases and escalating internally.

I have submited the AWS MFA Support form as suggested, referencing the existing cases and clarifying that this is an unauthorised root hardware MFA resulting from account takeover, with login being technically impossible.

For visibility: this issue also involves active billing fraud, and I would appreciate continued internal tracking until the MFA team has taken ownership and the account is frozen.

Thanks again for your help.