Amazon Settles FTC Identity Theft Case for $2.25 Million Over Records Violations

Amazon has agreed to pay $2.25 million in civil penalties to settle a Federal Trade Commission complaint alleging the company violated the Fair Credit Reporting Act, according to the FTC.

The law is not complicated. Under the FCRA, any company that holds consumer transaction records must provide them to verified identity theft victims within 30 days of a written request. No wiggle room. That is the statute.

Amazon's Compliance Failures

The FTC complaint laid out three specific failure modes. First, Amazon customer service representatives denied some victim requests outright, citing security or privacy concerns. Second, in other cases, agents told victims they simply could not access the records—an answer the FTC found to be inaccurate. Third, in cases where Amazon did eventually hand over the records, it sometimes did so outside the 30-day window the law requires.

The victims trying to get those records were not curiosity-seekers. They were people whose identities had been stolen and who needed documentation of fraudulent transactions made in their names—often to dispute charges, work with law enforcement, or clear their credit. In some instances, the FTC said, Amazon also refused to provide records to law enforcement agencies making requests on behalf of those victims.

The Security Argument

Amazon has not publicly responded to the settlement details. Engadget reported it reached out for comment and had not received a reply. The company's position during the underlying dispute, at least as reflected in the FTC complaint, was that some denials were made on security or privacy grounds.

A bad actor impersonating an identity theft victim could theoretically use an FCRA request to extract transaction data. Companies do have legitimate reasons to verify requestors carefully. The FCRA, however, accounts for this. The law sets a specific verification process and a hard timeline. Concerns about bad actors do not grant a company the right to simply refuse or delay beyond what the statute allows. The FTC's position is that Amazon used security rationale as cover for noncompliance, not as part of a lawful verification process.

$2.25 Million in Context

For one of the largest retailers on the planet, a $2.25 million penalty is not a deterrent. Critics across the political spectrum have legitimate grounds to object. Conservatives who believe in rule of law and equal accountability should be just as bothered by a corporation buying its way out of a federal statute violation with a check that does not sting. Small businesses do not get that option.

The FTC has pursued settlements across a range of tech companies, but the penalty structure for FCRA violations remains limited by statute. Whether Congress should revisit those caps is a separate question the settlement does not answer.

No Criminal Referral, No Admission

No criminal charges have been filed and no investigation beyond this civil matter has been announced publicly. The settlement, standard in FTC civil cases, does not require Amazon to admit wrongdoing.

What it does require—beyond the cash penalty—has not been detailed in the public record. FTC settlements typically include injunctive provisions requiring the company to fix the offending practices, but the specific compliance terms of this agreement have not been published.

One question worth watching: whether the FTC's consent order includes measurable compliance benchmarks and an audit mechanism, or whether it amounts to Amazon paying $2.25 million and promising to do better. The answer will determine whether identity theft victims actually get faster access to their records going forward.