Amazon.com will pay $2.25 million to resolve Federal Trade Commission allegations that it knowingly violated the Fair Credit Reporting Act by refusing to hand over transaction records to identity theft victims, a settlement that sets a record penalty under a provision of the FCRA.
The Justice Department filed the complaint and a proposed stipulated order this week 29 in the District Court for the District of Columbia on referral from the FTC.
At issue is Section 609(e) of the FCRA, which requires any business entity that transacted with someone who fraudulently used a consumer’s identity to provide application and business transaction records to the victim within 30 days of a written request. The provision reaches well beyond retailers. It applies to creditors, furnishers, debt buyers, and collection agencies that may hold records tied to a fraudulent account.
The FTC alleged Amazon routinely failed to produce those records. In many instances, agents cited “security” or “privacy” grounds the statute does not recognize. According to the complaint, victims were often told they had to name the thief before Amazon would release records, information the victims could only have obtained from the records they were seeking. One consumer reportedly guessed more than 30 names before giving up. Amazon also refused requests from law enforcement acting on victims’ behalf, sometimes demanding a subpoena the statute does not require.
The complaint states Amazon had no written policy to respond to 609(e) requests until early 2025, after learning of the FTC investigation, and did so despite earlier staff outreach urging it to review compliance. Bureau of Consumer Protection Director Christopher Mufarrige said the company put victims through a “Kafkaesque ordeal.”
The $2.25 million penalty is a record for a Section 609(e) violation, which carries civil penalties of up to $4,983 per violation. Beyond the payment, due within seven days of entry, the order bars further violations, requires a website notice explaining how victims can request records, and requires Amazon to contact eligible victims who sought records from April 2024 forward. Amazon neither admits nor denies the allegations. The order runs for 10 years.
This is only the second 609(e) case the FTC has brought. The first, against Kohl’s, came in 2020.
Read the complaint. Read the proposed order
