Amazon to Resolve FCRA Violation Claims for $2.25m

The FTC announced that Amazon.com, Inc., has agreed to pay $2.25 million in civil penalties to resolve allegations that the company violated the Fair Credit Reporting Act (FCRA) by routinely denying requests from identity theft victims seeking records of fraudulent transactions made with their personal data.

In a complaint filed by the Justice Department (on a referral from the FTC), the government alleged that Amazon engaged in unfair or deceptive acts or practices when it routinely failed to provide identity theft victims with transaction records, as required under Section 609(e) of FCRA.  Specifically, Amazon’s representatives allegedly refused to provide the records for vague “security” or “privacy” reasons, demanded that victims guess the names of the identity thieves to receive the records, claimed that they could not access the records, failed to respond by the statutory deadline, and failed to cooperate with law enforcement. 

The complaint also alleges that despite numerous consumer complaints and outreach from the FTC over the last several years, Amazon waited until early 2025 to implement a written policy for responding to identity theft victim requests, and only after Amazon became aware of the agency’s investigation into the matter.

Under the proposed stipulated order and upon the court’s approval, Amazon will also be permanently enjoined from future violations, and the company must provide transaction records within 30 days of a proper request.  Amazon must also post a notice on its website explaining the right of identity theft victims to request transaction records and it must proactively contact “eligible” victims who previously made requests.  Additionally, Amazon will be subject to certain other compliance monitoring and recordkeeping requirements.