FTC fines Amazon $2.25 million over identity theft records failure

Amazon.com Inc. will pay $2.25 million in civil penalties after it failed to give identity-theft victims the records they were legally entitled to receive. Section 609(e) of the Fair Credit Reporting Act requires businesses to provide application and business-transaction records tied to fraudulent transactions within 30 days of a written request.

The U.S. Department of Justice filed the complaint after referral from the FTC. Amazon had no written policy for handling Section 609(e) requests until early 2025, after it learned of the FTC investigation, despite earlier outreach from FTC staff urging the company to review its compliance. Some customers were told by Amazon customer service that records could not be shared for “security” or “privacy” reasons.

In one example, a consumer seeking records tied to a fraudulent account was told Amazon could not release the information unless the victim guessed the thief’s name. The consumer tried 30 times without success. Amazon also refused to provide records to law enforcement agencies authorized to request them on victims’ behalf.

Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, called Amazon’s handling of the requests a “Kafkaesque ordeal” and said the agency would not allow companies to ignore legal obligations designed to protect victims. The $2.25 million penalty is a record for a Section 609(e) violation, and the proposed order would bar Amazon from failing to comply with the law again.

Victims are entitled to ask businesses for the transaction records connected to fraudulent activity. Amazon’s customer-service help page now says victims of identity theft, or law enforcement agencies acting on their behalf, may be entitled to certain records under the Fair Credit Reporting Act.