Cybersecurity Policy Report, D.D.C.: Amazon.com to pay $2.25 million to settle FCRA allegations, (Jul 6, 2026)

By Sherri M. Schroeder, J.D.

The FTC alleged that the online retailer knowingly violated the Act by refusing to provide transaction records to consumers whose personal information was stolen by identity thieves and used to commit fraud.

Amazon.com, Inc. has agreed to pay the U.S. a total of $2.25 million in civil penalties, among other things, to settle Federal Trade Commission (FTC) allegations that the online retailer knowingly violated Section 609(e) of the Fair Credit Reporting Act (FCRA) by refusing to provide victims of identity theft with application and business transaction records about fraudulent transactions made in their names. Acting on the FTC’s behalf, the U.S. Department of Justice (DOJ) filed a complaint in the U.S. District Court for the District of Columbia alleging that despite intervention in 2023 by FTC staff advising Amazon.com to review the company’s compliance with Section 609(e), which requires that companies provide victims of identity theft with transaction records within 30 days of a consumer’s request, the company failed to create a written policy to respond to Section 609(e) requests until early 2025, after it learned of the FTC’s investigation. According to the Stipulated Order, Amazon.com neither admitted nor denied the allegations in the complaint, except as specifically stated in the Order. Per the DOJ’s press release on the matter, the penalty to be paid by Amazon.com is a record for a Section 609(e) violation. (U.S.A. v. Amazon.com, Inc., No. 1:26:cv-2305 (D.D.C. June 29, 2026)).

The complaint filed by the DOJ alleged that the FTC received a credible consumer complaint that Amazon failed to provide records required under FCRA Section 609(e) to an identity theft victim. The FTC then contacted the company in June of 2023 to advise Amazon.com’s counsel to review the company’s compliance with Section 609(e). However, when the same identity theft victim attempted to obtain the records several months later, Amazon.com again refused to provide the records. According to the complaint, Amazon.com did not provide the records until January 2025 when it was notified by the FTC that it was investigating the company’s compliance with Section 609(e) requirements.

The complaint further alleges that prior to February 2025, Amazon.com “routinely” failed to provide application and business transaction records to identity theft victims within 30 days of receiving their requests. Many times, Amazon.com refused to provide the requested records at all due to “security” or “privacy” reasons. In other instances, the company denied the requests on the grounds that the consumer had not been a victim of identity theft despite being informed by the consumer they were and despite being provided substantiating materials. Other instances of denial were described in the complaint as “Kafkaesque” because the victims requesting the records would enter a sequence in which Amazon.com’s agents would refuse to provide the cords related to the fraudulent account unless the identity theft victim was able to authenticate the identity of the person who had opened the fraudulent Amazon account, but this was often information that could only be found in the business records the victim had requested from Amazon.com in the first place. Per the complaint, Amazon.com even refused to provide the records to law enforcement agencies that had been authorized to request them on behalf of identity theft victims.

In addition to denying these requests for records, the complaint alleges that Amazon.com failed on numerous occasions to respond, even to only partially provide the records or to issue a denial, within the statutorily required 30-day period.

The complaint set out two separate counts against the online retailer—failure to provide requested records and failure to respond to records requests within 30 days—both violations of Section 609(e) of the FCRA and Section 5(a) of the Federal Trade Commission Act. The complaint sought a permanent injunction, civil penalty judgment, and other relief.

To settle these allegations against it, Amazon.com agreed to the stipulated order in May 2026. In addition to a civil penalty of $2.25 million, the order permanently enjoins Amazon.com from failing to provide a copy of certain application and business transaction records without charge to identity theft victims, subject to verification of the victim’s identity and claims. The order also requires Amazon.com to provide a notice on its website directing identity theft victims to ask the company to provide copies of application and business transaction records related to a fraudulent transaction or account. Amazon is also required to send notice by email or other means that Amazon.com may have additional records for eligible victims and to certify that it conducted reasonable searches for eligible victims.

Amazon.com also agreed to compliance reporting, including submission of a compliance report in one year, certain recordkeeping obligations for a period of 10 years, and compliance monitoring. The order will remain in effect for 10 years.

Companies: Amazon.com, Inc.

MainStory: TopStory CyberPrivacyFeed DataBreach DataPrivacy EnforcementActions FairCreditReporting IdentityTheft GCNNews Privacy DataSecurity