Amazon To Pay $2.25M To Settle FTC Charges It Denied Fraud Records To Identity Theft Victims
Amazon will pay $2.25 million to settle Federal Trade Commission allegations that the company knowingly violated the Fair Credit Reporting Act by failing to provide records to identity theft victims trying to investigate fraudulent transactions.
The FTC says Amazon routinely denied or delayed requests from consumers whose personal information had been used by identity thieves to make purchases or open accounts, even though Section 609(e) of the FCRA requires businesses to provide application and transaction records within 30 days when victims make a proper request.
The complaint, filed by the Department of Justice on the FTC’s behalf, alleges Amazon put some victims through a circular process that required them to authenticate or identify the fraudulent account before Amazon would provide the very records needed to determine who had used their information.
In one example cited by the government, an identity theft victim seeking records tied to unauthorized charges was allegedly told Amazon could not share details about the account for security reasons, but could confirm details if the victim guessed the name on the account. The complaint says the consumer guessed more than 30 names before giving up.
Another victim, who was trying to obtain records related to an unauthorized monthly Prime charge in June 2023, expressed frustration after an Amazon agent refused to provide the records, according to the complaint.
“Do you understand how ridiculous that is? How can I provide the information for someone who possibly has my credit card information? The whole reason I contacted you was to find out what the charges to my credit card were. You have the information I need. I do not. I don’t know the account. If I did, then I wouldn’t need to contact you.”
After the identity theft victim was transferred to another agent, the second agent prompted the victim to “let me know every known name from your friend’s [sic] or family. If it matches with the account name[,] I’ll confirm it with you. So, could you please guess some names who could potentially use your card on their account?”
The frustrated victim guessed over a dozen names, but was unable to guess the identity thief’s name, and so the agent refused to provide the requested records related to the identity theft.
Other victims were allegedly told records could not be provided for “security” or “privacy” reasons, even though the FTC says those are not valid grounds for denying records under the law. Amazon also allegedly refused some requests from law enforcement agencies acting on behalf of victims, telling officers they would need a subpoena or other legal process.
The complaint does not provide further detail on how the identity theft occurred, but the allegations raise an obvious question for Amazon’s marketplace and retail fraud controls: how often stolen payment information, personal data or compromised accounts may be used in transactions tied to organized retail crime, triangulation fraud or other marketplace abuse schemes.
Liz Morton
The FTC says Amazon had no written policy for responding to Section 609(e) requests until early 2025, after the company learned it was under investigation, despite earlier outreach from FTC staff advising Amazon to review its compliance.
If approved by the court, the proposed order will require Amazon to pay the $2.25 million civil penalty, which the FTC says is a record penalty for a Section 609(e) violation, and bars the company from failing to comply with identity theft records requests going forward.
Amazon must also tell consumers who requested records from Amazon since April 2024 but did not receive them that the company may have additional records available.
The $2.25 million penalty is small by Amazon standards, but the allegations are not. The FTC says identity theft victims were legally entitled to records that could help them understand fraudulent charges, while Amazon allegedly sent some of them into customer service loops that required them to guess the identity thief’s name.
For a company built on knowing exactly who bought what, where it shipped, and how it was paid for, that's a hard allegation to brush off as a simple support issue.
The case is United States of America v. Amazon.com Inc., in the U.S. District Court for the District of Columbia (Case No. 1:26-cv-2305).
Download full complaint:
