Amazon has agreed to pay a $2.25 million civil penalty and overhaul how it handles requests from identity theft victims, following a federal complaint accusing the Seattle-based retail giant of stonewalling customers trying to clear fraudulent charges from their names. The penalty is the largest in federal history for violations of Section 609(e) of the Fair Credit Reporting Act, a 2003 law meant to help identity theft victims obtain records tied to fraudulent transactions.
The Justice Department announced the settlement after the government filed a complaint in the U.S. District Court for the District of Columbia, alleging Amazon failed to provide identity theft victims with requested transaction records and did not supply them within the legally required 30-day window, according to KOMO News. The case originated with the Federal Trade Commission, which investigated the matter before referring it to the Justice Department for prosecution.
Victims Forced to Guess a Thief's Name
Federal regulators alleged Amazon routinely subjected identity theft victims to what they described as a Kafkaesque process, demanding that victims identify the specific thief before releasing records, according to Payments Dive. In one instance, regulators say a consumer was forced to make 30 unsuccessful guesses regarding a fraudulent account name before getting anywhere. Amazon customer service agents frequently cited security or privacy reasons for withholding the records, per the same account.
Court filings from the Justice Department also revealed that Amazon had no written policy for responding to these record requests until early 2025, adopting internal procedures only after learning of the FTC's formal investigation, per PPC Land's review of the filings. FTC staff had informally advised Amazon's legal counsel to review its compliance as early as June 2023, well before the company put a formal process in place.
What the Settlement Requires
Under the stipulated order entered by the federal court, Amazon must now provide identity theft victims with records of transactions alleged to have resulted from identity theft, free of charge and within 30 days of a request. The company is also required to post a website notice explaining how victims can request those records, though it may still verify a victim's identity and identity theft claim before turning anything over.
Critically, the order does not just apply going forward. Amazon is legally required to re-contact and supply transaction records to victims whose requests were denied or ignored dating back to April 2024, a retroactive lookback that regulators say is meant to catch consumers who were stonewalled before the company tightened its practices.
Assistant Attorney General Brett A. Shumate said the Justice Department would continue working with the FTC to protect identity theft victims. “Consumers whose identities have been stolen should not face unnecessary red tape when investigating identity misuse and clearing their names,” Shumate said.
Only the Second Case of Its Kind
The Amazon action marks just the second time the FTC has brought an enforcement case under Section 609(e) since the provision was added to the Fair Credit Reporting Act in 2003, according to the Southwest Ledger. The first came in 2020, when Kohl's Department Stores paid a $220,000 civil penalty after regulators said it required victims to route information requests through law enforcement or attorneys rather than supplying records directly, per the Willkie Compliance Concourse. Amazon's $2.25 million penalty dwarfs that figure more than tenfold.
An Amazon spokesperson told Dow Jones that the company resolved the matter with regulators and has implemented process improvements, saying Amazon is “committed to providing customers with their detailed account information when they need it most.” Amazon resolved the case through a stipulated consent order without admitting liability.
A Fine Against a Backdrop of Surging Fraud
The settlement lands amid a broader national spike in identity theft complaints. The FTC logged over 1.35 million identity theft complaints in 2025, a 31% increase from 2024, contributing to total consumer fraud and identity theft losses exceeding $15.8 billion nationwide, according to Experian. Credit card abuse and fraudulent online shopping accounts remain among the top categories of identity theft driving those numbers.
This is far from Amazon's first brush with federal regulators. The company previously paid a $25 million FTC civil penalty in May 2023 over children's privacy violations tied to Alexa voice recordings, and it reached a multi-billion-dollar FTC settlement over Prime cancellation practices that Hoodline covered earlier this year. Federal agencies have increasingly scrutinized how Big Tech companies handle consumer protection, and this latest penalty adds Amazon's identity theft record-keeping to that growing list.
