Amazon Order through my account, using my credit card, to my address

A user's Amazon account was used to place an unauthorized $400 LED face mask order with their credit card and delivery address. The user canceled the order, reset their password, and enhanced security measures, including 2-step verification. They also deregistered a missing Kindle device but found no unusual credit card charges or account recovery attempts.