Amazon has agreed to pay $2.25 million to resolve allegations by the U.S. Federal Trade Commission that it broke a federal law meant to help victims of identity theft recover their records.
What the FTC alleged
The case centers on Section 609(e) of the Fair Credit Reporting Act, which requires businesses to give identity-theft victims the application and transaction records tied to fraud committed in their names, within 30 days of a request. In its announcement, the FTC said Amazon knowingly failed to comply, with customer-service representatives turning away victims' requests — sometimes citing security or privacy concerns, and sometimes saying they could not access the records.
The agency also alleged that Amazon at times refused to hand over records to law enforcement acting on behalf of victims, and that the company did not have a formal written process for responding to such requests until 2025, after the FTC's investigation was under way. The settlement requires Amazon to provide the records free of charge within the legal window, to put proper procedures in place and to train staff, as Engadget reported.
A rarely used law
The action is only the second the FTC has brought under this provision since it became law. The first, against the retailer Kohl's in 2020, resulted in a $220,000 penalty — making Amazon's payment more than ten times larger. Regulators framed the case as a reminder that the requirement, on the books for years, still applies to even the largest companies.
For identity-theft victims, the records at issue can be essential: they help people document fraudulent purchases, dispute charges, and support police reports and investigations. Being unable to obtain them can leave victims struggling to clear their names.
Amazon's response
Amazon described the matter as resolved and said it had made changes. "We've resolved this matter with the FTC and have implemented process improvements for customers who believe they may be victims of identity theft," a company spokesperson said, adding that customers who need help requesting their records can find guidance on Amazon's help pages.
The company did not detail why it had lacked a formal process in earlier years. As part of the settlement, Amazon is also required to contact consumers who sought records over the past two years but did not receive them, and to let them know they can ask again.
The wider picture
The settlement lands amid broader scrutiny of how large technology and retail companies handle consumer data and comply with older consumer-protection statutes. Identity theft remains a persistent problem, and the case highlights the gap that can open between what the law requires and how a company's day-to-day customer service operates. Whether the penalty prompts wider changes across the industry — or further FTC action under the same provision — remains to be seen.
