FTC orders Amazon to pay $2.25 million over FCRA identity-theft records failures
Companies holding transaction records must give identity-theft victims their application and business-transaction records within FCRA's 30-day limit — the FTC fined Amazon $2.25m for refusing
Change
On 26 June 2026 the Federal Trade Commission (FTC) required Amazon to pay $2.25 million — a record civil penalty for a Fair Credit Reporting Act (FCRA) Section 609(e) violation — under a DOJ-filed stipulated final order compelling Amazon to provide identity-theft victims their application and business transaction records and to notify consumers who had requested records since April 2024.
Why it matters
The stipulated final order, filed in U.S. District Court, prohibits Amazon from failing to comply with FCRA Section 609(e) and requires it to give identity-theft victims — and law enforcement acting for them — the application and business transaction records tied to fraudulent transactions, to publish consumer-facing notice on how to request those records, and to re-contact consumers who requested records since April 2024 but did not receive them. The order has the force of law once signed; non-compliance exposes Amazon to court-enforced penalties. Section 609(e) obligates any company holding such records to respond within 30 days.
Implications
- — Amazon customer-service and compliance teams must produce the application and business transaction records that identity-theft victims request within the FCRA's 30-day deadline and must not condition release on the victim identifying the thief or on "security"/"privacy" objections — the stipulated order makes such refusal a court-enforceable violation.
- — Amazon must contact every consumer who requested records since April 2024 without receiving them to tell them additional records may be available — failing to give that notice breaches the order and exposes Amazon to court enforcement.
- — Compliance teams at other companies holding application and transaction records under FCRA Section 609(e) — including e-commerce marketplaces — must respond to identity-theft victims' records requests within 30 days, because the FTC treated the absence of a written response process and missed deadlines as the basis for a record penalty.
Who is affected
- — Amazon customer-service and compliance teams handling identity-theft records requests
- — Compliance teams at e-commerce marketplaces and other companies subject to FCRA Section 609(e)