The OP says he is "a security conscious user who follows the best practices like: using unique passwords, 2FA, only using a secure computer and being able to spot phishing attacks from a mile away..." yet I do not think he enabled 2FA on Amazon.com. If he did customer service would not have helped the hacker pretending to be him. As their help page says, "If you need help from Customer Service after enabling Two-Step Verification, you'll need provide a security code similar to when trying to sign in to your account." https://www.amazon.com/gp/help/customer/display.html?nodeId=...