Amazon has agreed to pay $2.25 million in civil penalties to settle a case with the Federal Trade Commission over its handling of identity theft victims, as reported by Engadget. The agency accused the company of failing to meet key requirements under the Fair Credit Reporting Act, specifically around disclosing transaction records to identity theft victims. The settlement follows years of complaints from consumers who said they could not get clear answers from the retailer while trying to document fraud.
The case centers on Section 609(e) of the Fair Credit Reporting Act, a law meant to help identity theft victims piece together what happened to them. Victims are entitled to request copies of transaction records, such as credit applications, invoices, or account statements tied to fraudulent activity. Businesses must provide these documents free of charge within 30 days of a written request, and victims can authorize law enforcement to obtain the records directly or have the company send them straight to investigators.
The FTC’s complaint alleges Amazon fell short of these obligations on multiple fronts. Customer service representatives reportedly denied requests from identity theft victims, often citing security or privacy concerns, while other agents allegedly told victims they simply did not have access to the records. Even when the company eventually provided the requested information, it often arrived well outside the 30-day window required by federal law, according to findings outlined by the FTC.
Privacy concerns are not a valid excuse, the FTC says
Businesses can refuse a records request only if they cannot verify the identity of the person asking, or if the request appears to be based on a misrepresentation. The FTC has said companies are expected to facilitate the process for victims, not create roadblocks, and that vague privacy policies do not override their legal duties under the Fair Credit Reporting Act. The law does not require companies to overhaul their recordkeeping systems, but it does require that existing records be made available when a legitimate written request comes in.
The Consumer Financial Protection Bureau shares enforcement responsibility for these requirements, stepping in for businesses that fall outside the FTC’s direct jurisdiction. The layered oversight is meant to protect consumers regardless of which type of company they are dealing with. Fraud-related fallout has drawn attention elsewhere recently too, including a case where a Florida woman froze her bank accounts after a scammer targeted her over a social media post.
Amazon has not publicly commented on the settlement. The company will now need to bring its customer service practices in line with federal disclosure requirements, even as separate consumer disputes continue to surface online, including American Airlines’ overbooked flight payouts that drew attention this week.
The FTC has said it will continue enforcing identity theft disclosure requirements against businesses that fail to comply.
Published: Jun 30, 2026 08:45 pm