The FTC has settled with Amazon for $2.25 million over allegations the company blocked identity theft victims from accessing fraud transaction records they were legally owed under the Fair Credit Reporting Act.
The U.S. Federal Trade Commission has reached a $2.25 million civil penalty settlement with Amazon over allegations that the company systematically denied identity theft victims access to transaction records they were legally entitled to receive, the agency said Tuesday.
The FTC filed its complaint with the Justice Department, alleging Amazon violated Section 609(e) of the Fair Credit Reporting Act, which requires companies to furnish fraud victims with records of transactions made in their names.
The agency said Amazon customer service agents repeatedly turned away consumers who requested documentation of fraudulent activity, citing "privacy" or "security" concerns. Even in cases where Amazon did produce records, the company often missed the 30-day deadline mandated under the FCRA.
"Amazon even refused to provide application and business transaction records to law enforcement agencies who had been authorized to, and who did, submit requests to Amazon on behalf of consumers who were victims of identity theft," the FTC said in a statement. "Some frustrated consumers resorted to sending copies of the FCRA and FTC guidance to Amazon in hopes of receiving the requested records, but Amazon still failed to comply with the law."
Under the proposed order, Amazon must provide lawfully requested records to identity theft victims and law enforcement agents within 30 days going forward. The company is also required to notify consumers who submitted records requests since April 2024 but never received them that they may file new requests.
The settlement adds to a growing list of regulatory actions against the company. In July 2023, Amazon agreed to pay $25 million to settle allegations it violated children's privacy laws in connection with its Alexa voice assistant. In September 2025, the company paid $2.5 billion to resolve a lawsuit alleging it used deceptive design practices to enroll users in its Prime subscription program and obstruct cancellations.
Amazon is not the first retailer to face this type of enforcement. Kohl's Department Stores paid a $220,000 fine six years ago to settle comparable charges after withholding fraud transaction records from identity theft victims.
The FTC's action against Amazon reflects a sustained regulatory focus on consumer data rights, particularly the obligations companies carry when their platforms become vectors for identity fraud. With the FCRA's 30-day disclosure requirement now embedded in a federal consent order, Amazon's compliance with that timeline will be subject to ongoing oversight — and any further lapses could carry steeper consequences.
Jay Goldberg is a staff writer at TechEchelon covering technology, markets, and policy. He files the breaking news and deal coverage that move the publication's core desks.
More from Jay →CrowdStrike and Palo Alto Networks each recorded their best quarter ever between April and June 2026, with stock gains of 95% and 113% respectively, as the rise of Mythos-class AI models accelerated enterprise cybersecurity spending.
A ransomware group called World Leaks has posted stolen Tata Electronics files on the dark web, exposing supplier maps, component details, and drop-test photos tied to Apple's unreleased iPhone 18 Pro models.
Mozilla's Zero Day Investigative Network demonstrated a proof-of-concept attack in which a GitHub repository containing no malicious code can manipulate AI coding agents like Claude Code into executing a remote shell by exploiting automated error-recovery behavior.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.