It gets worse: attackers don't even need the paper invoices - at least in 2012, they were social engineering them directly out of Amazon CSRs [0].

[0] http://www.htmlist.com/rants/two-for-one-amazon-coms-sociall...