Amazon agreed to pay a record $2.25 million civil penalty and submit to a court injunction to resolve allegations it repeatedly denied identity theft victims access to transaction records they were legally entitled to receive under federal law.
The Justice Department filed the complaint in U.S. District Court for the District of Columbia on behalf of the Federal Trade Commission, alleging Amazon knowingly violated Section 609(e) of the Fair Credit Reporting Act, which requires businesses to provide identity theft victims with application and transaction records related to fraudulent activity made in their names within 30 days of a request.
According to the FTC, Amazon customer service agents routinely told victims requesting those records that the company could not share them for “privacy” or “security” reasons. The FTC said Amazon had no written policy for handling such requests until early 2025 — after it learned of the investigation — and that it even refused records to law enforcement agencies submitting requests on victims’ behalf. When Amazon did provide records, it sometimes did so after the 30-day window required by law.
The $2.25 million penalty is the largest ever imposed for a Section 609(e) FCRA violation, according to the FTC. It is the agency’s second case brought under that provision, following a 2020 action against Kohl’s Department Stores.
“Consumers whose identities have been stolen should not face unnecessary red tape when they investigate how their identities were misused and seek to clear their names,” said Brett Shumate, assistant attorney general for the Justice Department’s Civil Division.
Under the court order, Amazon must provide qualifying transaction records to identity theft victims free of charge within 30 days of a verified request, post a notice on its website explaining how victims can request those records, and contact consumers who requested records since April 2024 but did not receive them to notify them that Amazon may have additional records available. Amazon is also permanently prohibited from further violations of the FCRA’s identity theft records provisions.