This is just wrong. They found that out using Google search and social engineering. A lot of his details like his phone number were available online and were available with a Google search. Amazon, being stupid, uses a copy of Aadhar as an authentication mechanism. The Aadhar number is not supposed to be secret. That's the reason you need to use biometrics along with your number to authenticate you.