You probably already know what it feels like to get stuck in a customer service loop, explaining the same problem to a new chat agent who has no record of the last conversation. Now imagine going through that same runaround while someone else is actively using your stolen identity to make purchases in your name. That's what the Federal Trade Commission says happened to identity theft victims who turned to Amazon for help, and the company is now paying $2.25 million in civil penalties to settle the resulting complaint.
The Department of Justice filed the case on the FTC's referral, alleging Amazon knowingly violated the Fair Credit Reporting Act (FCRA). The specific provision at issue, Section 609(e), requires companies to hand identity theft victims copies of the transaction records tied to fraud committed in their name within 30 days of a request. Those records are often the only proof a victim has to clear their credit, file a police report, or convince a bank that a charge wasn't theirs.
The FTC alleged that Amazon had no written policy for handling these requests for years, even after FTC staff specifically told the company to review its compliance with Section 609(e). Amazon didn't put a policy in place until early 2025, once it learned the FTC was investigating.
Christopher Mufarrige, director of the FTC's Bureau of Consumer Protection, said Amazon "often put identity theft victims through a Kafkaesque ordeal by demanding they identify the thief who stole their information before Amazon would release the records the law entitles them to."
One victim reported being told by an Amazon representative that the company couldn't release records related to a fraudulent account for "security reasons" unless they could name the person who had stolen their identity, according to the FTC. That person made 30 guesses and never got it right. In other cases, Amazon agents told victims outright that they couldn't access the records, and the company refused requests from law enforcement agencies submitted on victims' behalf, something the law explicitly permits.
The $2.25 million penalty is the largest the FTC has secured for a Section 609(e) violation, but it barely registers against Amazon's revenue. More importantly, the proposed order mandates that Amazon comply with Section 609(e) going forward, notify victims of their right to request these records, and reach back out to anyone who asked for records since April 2024 and didn't receive them. That’s good news for the people affected, and hopefully Amazon will make it easier for ID-theft victims going forward.
If you're ever the victim of identity theft and a retailer used in the fraud refuses to hand over transaction records, federal law already gives you the right to them under Section 609(e), and you don't need to identify the thief to get them. Put the request in writing, keep a record of the date, and treat a non-response after 30 days as a violation worth forwarding to the FTC. Given that this is only the second case the agency has brought under this provision in the last six years, knowing it exists is currently doing more for consumers than the FTC's enforcement record is.
Read next: Cheap Amazon TV boxes and photo frames are secretly committing crimes
[Image credit: Suzanne Kantra/Techlicious generated by ChatGPT]
