The Federal Trade Commission has secured a $2.25 million civil penalty from Amazon.com Inc, resolving allegations that the retailer knowingly violated Section 609(e) of the Fair Credit Reporting Act by refusing to hand identity theft victims the transaction records the statute entitles them to.
The Department of Justice filed the complaint in the U.S. District Court for the District of Columbia on the FTC’s referral, and a proposed consent order is now before the court.
According to the complaint, Amazon operated without any written procedure for responding to Section 609(e) requests until early 2025, adopting one only after learning the FTC had opened an investigation, despite earlier direct outreach from FTC staff urging the company to review its compliance.
Customer service representatives are alleged to have repeatedly cited privacy and security grounds to withhold records, grounds the statute does not recognise as valid exceptions. In one instance detailed by the agency, a victim was asked to guess the name of the person who had opened a fraudulent account more than thirty times before giving up.
Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, said Amazon had subjected victims to what he called a “Kafkaesque ordeal” by demanding they identify their own attacker before releasing records the law already guarantees them.
Section 609(e) has existed since 2003, added by the Fair and Accurate Credit Transactions Act, yet this is only the second occasion the FTC has used it to bring enforcement action.
Kohl’s Department Stores paid $220,000 in the FTC’s only prior use of Section 609(e), back in 2020. Amazon’s penalty is more than ten times that, and the agency has been explicit about why: this was knowing conduct, not an oversight.
The proposed order requires Amazon to adopt a written compliance policy, train staff on their statutory obligations, notify consumers of their rights under the FCRA and contact any customer who submitted a records request since April 2024 without receiving a response. Amazon, represented by Sidley Austin, has not disputed the terms of the settlement.
FCRA obligations to identity theft victims sit outside ordinary data-protection frameworks. A generic customer service script won’t meet them. Counsel at consumer-facing businesses should confirm a written Section 609(e) policy exists before the FTC checks for them.