Yup.
> By the way, if you can't authenticate with Amazon as the rightful owner of that account, it sounds unreasonable for them to comply to a stranger asking them to simply remove a credit card number of some account.
I disagree. If I can provide a full credit card number, they should be able to remove it from all accounts. Either the card is compromised, or I'm telling the truth.
Every AWS and bank account has clear terms including how to unilaterally close the account. I'm not sure why you're slow walking this rather than pulling the fire alarm on both accounts.
This would mitigate incidents like this - as far as I’m aware the attacker doesn’t actually have the card number, so giving them 24 hours to confirm it (or the card gets removed after that) would be a good solution while remaining only a minor inconvenience for legitimate usage (realistically speaking, how many online stores who might have your card number are malicious enough to call companies and try to get your accounts shut down, with no benefit to themselves?)