Amazon has agreed to pay $2.25 million in civil penalties to resolve allegations that it knowingly violated the Fair Credit Reporting Act by failing to provide identity theft victims with records connected to fraudulent transactions carried out using their personal information. The complaint, filed by the Department of Justice following notification and referral from the Federal Trade Commission, alleges the company repeatedly failed to satisfy requirements under Section 609(e) of the law.

According to the complaint, Section 609(e) requires businesses to provide victims of identity theft with application and business transaction records related to fraudulent activity within 30 days of receiving a request. The filing alleges Amazon lacked a written policy for handling these requests until early 2025, after learning about the FTC's investigation, despite earlier communication from FTC staff encouraging the company to review its compliance procedures.

The complaint further alleges that consumers reporting fraudulent activity were frequently told by customer service representatives that records could not be released because of security or privacy concerns. One example described a consumer seeking records connected to unauthorized charges who was told the information could only be disclosed if the consumer identified the name used on the fraudulent account. After making multiple unsuccessful attempts, the consumer was still unable to obtain the requested information.

The allegations also state that some Amazon representatives said they could not access requested records, while authorized law enforcement agencies acting on behalf of identity theft victims were also denied application and transaction records. Even after some consumers submitted copies of the Fair Credit Reporting Act and FTC guidance, the company allegedly did not provide the requested documentation. In instances where records were eventually supplied, the complaint states they were sometimes delivered after the 30-day deadline established under the law.

Beyond the financial penalty, the proposed order requires Amazon to comply with Section 609(e) by providing records requested by eligible identity theft victims and authorized law enforcement agencies. The company must also notify consumers about the process for requesting records under the Fair Credit Reporting Act and contact individuals who sought records from April 2024 onward but did not receive them, informing them that additional records may be available upon request. The FTC stated this represents its second enforcement action under Section 609(e), following an earlier case announced in 2020 involving Kohl's Department Stores Inc.

📊 What This Means (Our Analysis)

The proposed settlement underscores the importance of established procedures for responding to identity theft victims seeking records needed to address fraudulent activity. The required policy changes place equal emphasis on operational processes and timely communication, reflecting that compliance extends beyond simply maintaining customer service channels.

The order also reinforces that record access plays a practical role in helping consumers and authorized law enforcement respond to identity theft cases. By requiring clearer notification procedures and outreach to affected consumers, the resolution focuses on improving how future requests are handled while reinforcing the legal obligations described in the Fair Credit Reporting Act.

📌 Our Take: The settlement places greater attention on timely access to records as a key part of consumer protection obligations.