Amazon Fined $2.25 Million to End DOJ Identity Theft Case: What Consumers Need to Know

Amazon.com Inc. has agreed to pay $2.25 million to resolve federal allegations involving its handling of identity theft victims’ requests for transaction records. The case was brought by the U.S. Department of Justice following a referral from the Federal Trade Commission (FTC), which alleged that Amazon failed to comply with requirements under the Fair Credit Reporting Act (FCRA).

The dispute centers on Section 609(e) of the FCRA. This provision gives identity theft victims the right to obtain certain application and business transaction records connected with fraudulent accounts or purchases made using their personal information.

According to the government’s allegations, Amazon did not consistently provide those records within the legally required timeframe. The settlement is significant because the FTC described the $2.25 million civil penalty as a record penalty for an alleged violation of Section 609(e).

Why Amazon Is Paying $2.25 Million

The FTC alleged that Amazon violated federal consumer-protection requirements by failing to provide identity theft victims with records associated with fraudulent transactions.

Under Section 609(e), qualifying identity theft victims can request certain records related to fraudulent activity. Businesses generally must provide those records without charge and within 30 days after receiving an appropriate request.

The complaint alleged that Amazon failed to meet those obligations in multiple instances. The FTC also alleged that Amazon did not have a written policy specifically addressing Section 609(e) requests until early 2025.

What the Government Alleged

According to the FTC, some consumers who contacted Amazon after discovering fraudulent activity experienced difficulties obtaining the records they requested.

In certain cases, Amazon representatives allegedly cited privacy or security concerns when declining to provide information. Other consumers were reportedly told that Amazon could not access the requested records.

The FTC also alleged that Amazon sometimes failed to provide records to law enforcement agencies that were authorized to make requests on behalf of identity theft victims.

Where Amazon eventually provided information, the FTC alleged that some records were supplied after the 30-day deadline established by federal law.

How Identity Theft Victims Were Affected

Identity theft can create serious problems for consumers. Fraudsters may use stolen personal information to open accounts, purchase merchandise, or conduct other transactions without authorization.

Transaction records can be valuable to victims because they may help establish what happened, support disputes with financial institutions, and provide information to law enforcement.

The government’s allegations indicate that some Amazon customers had difficulty obtaining records that could potentially have helped them investigate fraudulent activity.

The FTC also described situations in which consumers were allegedly asked to identify the person who had committed the fraud before Amazon would provide certain records.

Why Transaction Records Matter

When a person becomes a victim of identity theft, they may not know who used their information or how the fraudulent transaction was completed.

Records maintained by a company can potentially provide useful details about an account, transaction, order, payment method, delivery information, or other activity associated with the fraud.

That makes access to records an important part of the identity theft recovery process.

What Section 609(e) of the FCRA Requires

The Fair Credit Reporting Act includes specific protections for consumers affected by identity theft. Section 609(e) addresses access to records connected with fraudulent transactions.

When an identity theft victim submits a qualifying request and satisfies applicable verification requirements, businesses may be required to provide certain application and business transaction records related to the fraudulent activity.

The purpose of the provision is to help victims investigate fraud and take steps to recover from identity theft.

The allegations against Amazon focused on the company’s compliance with this particular requirement. They did not accuse Amazon of being responsible for the underlying identity theft.

Important Distinction About the Case

It is important to distinguish between the alleged regulatory violations and identity theft itself.

The government did not allege that Amazon stole consumers’ identities. Instead, regulators alleged that Amazon failed to properly comply with federal requirements concerning the release of records to people whose identities had allegedly been used fraudulently.

The settlement therefore focuses on Amazon’s procedures for handling legally protected identity theft requests.

Amazon’s Settlement and Required Changes

Under the proposed settlement, Amazon will pay a $2.25 million civil penalty to the U.S. Treasury.

The agreement also includes requirements intended to improve the company’s handling of future identity theft record requests.

Amazon will be required to comply with applicable requirements when qualifying identity theft victims request records associated with fraudulent accounts or transactions.

The order also requires Amazon to provide information through its website explaining how identity theft victims can request relevant application and business transaction records.

Amazon Must Review Earlier Requests

Another important element of the settlement involves consumers who previously requested records.

Amazon is required to identify certain eligible consumers who requested records beginning in April 2024 but did not receive them. Those consumers must be informed that additional records may be available and that they can request them.

This requirement could provide another opportunity for eligible consumers who previously attempted to obtain information but were unsuccessful.

Why the Department of Justice Was Involved

The FTC investigated the alleged conduct before referring the matter to the Department of Justice.

The DOJ subsequently filed the federal complaint on behalf of the FTC. The case was brought in the U.S. District Court for the District of Columbia.

The government sought remedies designed to address the alleged violations, including financial penalties and requirements intended to prevent similar conduct in the future.

The FTC’s Role

The FTC is responsible for enforcing numerous federal consumer-protection laws and regulations. Identity theft and consumer privacy are among the areas in which the agency has taken enforcement action.

In this case, the agency’s investigation focused on Amazon’s handling of requests made under Section 609(e) of the FCRA.

What the $2.25 Million Penalty Means

The $2.25 million payment is relatively modest compared with Amazon’s overall financial scale. However, the regulatory importance of the case extends beyond the amount of the penalty.

The FTC described the penalty as a record civil penalty for an alleged Section 609(e) violation.

The action sends a compliance message to businesses that maintain large amounts of consumer and transaction information. Companies may have legal responsibilities to make certain records available to identity theft victims even when ordinary privacy or customer-service policies might otherwise restrict access.

A Compliance Warning for Large Companies

The case highlights the importance of dedicated procedures for legally protected consumer requests.

Large companies can receive enormous volumes of customer-service inquiries. Without specialized processes, a request involving federal consumer rights could potentially be treated like an ordinary support issue.

The allegations against Amazon demonstrate why companies need clear policies, employee training, escalation procedures, and systems for tracking legally required response deadlines.

What Consumers Should Take Away

Consumers who believe they have been affected by identity theft should be aware that federal law can provide specific rights concerning records associated with fraudulent transactions.

People dealing with identity theft should maintain copies of requests, correspondence, account information, and other relevant documents. Keeping records of when requests were submitted can also be useful.

Consumers should also understand that a standard customer-service response does not necessarily determine all of their legal rights.

When identity theft is involved, federal consumer-protection laws may provide additional rights regarding access to information and records.

Broader Implications for Consumer Protection

The Amazon case comes as identity theft and online fraud remain significant concerns for consumers.

Modern e-commerce platforms process huge volumes of personal and transaction information. That information can become important evidence when fraudulent activity occurs.

Companies therefore have an important role in helping victims understand and investigate suspicious transactions.

Accurate records can potentially help connect fraudulent activity with accounts, orders, payment methods, delivery information, and other details. Delays in obtaining those records can make the recovery process more difficult for victims.

The settlement reinforces the government’s position that businesses must take qualifying identity theft requests seriously and comply with applicable legal deadlines.

What Happens Next for Amazon?

Amazon will be required to follow the terms of the settlement, including the requirements concerning identity theft record requests and consumer notification.

The company will also need to ensure that employees and internal systems are capable of recognizing and properly handling qualifying requests.

For consumers, the most important development is the additional access that eligible individuals may have to records they previously requested but did not receive.

Conclusion

Amazon’s agreement to pay $2.25 million resolves federal allegations concerning the company’s handling of identity theft victims’ requests for transaction records.

The case originated with an FTC investigation and was taken to federal court by the Department of Justice. While the allegations did not accuse Amazon of committing identity theft, regulators alleged that the company failed to properly meet certain obligations under Section 609(e) of the Fair Credit Reporting Act.

Beyond the financial penalty, the settlement requires Amazon to improve its procedures, explain the record-request process to consumers, and notify certain people who may have previously been unable to obtain requested records.

The case serves as a reminder that identity theft victims can have important legal rights to information that may help them investigate fraudulent activity. It also demonstrates why companies handling consumer data need clear compliance systems for legally protected requests.

Frequently Asked Questions

Why is Amazon paying $2.25 million?

Amazon agreed to pay a $2.25 million civil penalty to resolve federal allegations that it violated Section 609(e) of the Fair Credit Reporting Act by failing to properly provide certain records to identity theft victims.

Did Amazon commit identity theft?

No. The case concerns allegations about Amazon’s handling of requests from identity theft victims. The government did not allege that Amazon itself stole consumers’ identities.

What law is involved in the Amazon case?

The case involves Section 609(e) of the Fair Credit Reporting Act. The provision gives qualifying identity theft victims rights concerning certain records related to fraudulent transactions.

Was the case brought by the DOJ or FTC?

The FTC investigated the matter and referred it to the Department of Justice. The DOJ filed the federal complaint on behalf of the FTC.

Will Amazon have to change its procedures?

Yes. The settlement includes requirements concerning Amazon’s handling of qualifying identity theft record requests and the information it provides to consumers.

Can previous identity theft victims request Amazon records?

The settlement requires Amazon to notify certain eligible consumers who requested records beginning in April 2024 but did not receive them that additional records may be available.

Where was the case filed?

The federal case was filed in the U.S. District Court for the District of Columbia.

Does the $2.25 million go directly to identity theft victims?

The $2.25 million is a civil penalty payable to the U.S. Treasury. The settlement separately contains provisions concerning eligible identity theft victims and their access to records.

What should identity theft victims do?

Consumers affected by identity theft should document fraudulent activity, preserve relevant correspondence and learn about their rights under federal consumer-protection laws.

Is this Amazon’s largest regulatory penalty?

No. Amazon has faced substantially larger penalties and settlements in other matters. The significance of this case is that the FTC characterized the $2.25 million penalty as a record penalty for an alleged Section 609(e) violation.