Amazon to Pay $2.25 Million in Federal Trade Commission Settlement

agreed to a $2.25 million payment to resolve a federal complaint alleging the company withheld application and transaction records from victims of identity theft seeking details on fraudulent credit or debit charges.

Dive Brief

• Amazon reached a $2.25 million resolution after regulators claimed it denied victims of identity theft access to records tied to unauthorized card activity.
• The Department of Justice, on behalf of the Federal Trade Commission, filed suit alleging Amazon “knowingly” violated the federal Fair Credit Reporting Act and submitted a draft consent order for a federal court in Washington, District of Columbia; the Federal Trade Commission later announced the agreement in a Tuesday press statement.
• According to the Department of Justice’s filing, Amazon engaged in transactions involving misused identities and then failed to supply requested application and business records to affected consumers.

Dive Insight

The Federal Trade Commission said consumers who contacted Amazon to report fraud on an account or payment card were told by customer service that the company could not share the requested records for privacy or security reasons.

Under the Fair Credit Reporting Act, companies have 30 days to provide identity theft victims with application and business documents for fraudulent transactions carried out in their names, the agency said.

Spokespeople for Amazon and its attorneys at Sidley Austin did not respond to Tuesday email inquiries seeking comment.

Christopher Mufarrige, director of the Federal Trade Commission’s Bureau of Consumer Protection, said Amazon frequently required victims to identify the thief before releasing records they are entitled to under law, characterizing the process as Kafkaesque.

When a company makes victims “prove the identity of the thief” before sharing records the law says they can access, it turns a straightforward rights-based request into an obstacle course that delays investigations and prolongs harm.

In one example shared with the Federal Trade Commission, a consumer said Amazon refused to release business records for a bogus account that charged their credit card unless the consumer could guess the account name used by the imposter; after roughly 30 attempts, they still could not provide it.

The agency also reported that Amazon declined to provide application and transaction records to law enforcement.

The Federal Trade Commission said its staff had previously instructed Amazon’s lawyers in June 2023 to review compliance with this section of the Fair Credit Reporting Act after receiving a consumer complaint.

As part of the agreement, Amazon will publish a notice on its website—typically within its Help or Customer Service area—explaining how identity theft victims can request records. The process described by regulators centers on submitting a request for application and business records tied to an account or transaction carried out in the consumer’s name and providing enough identifying details for Amazon to locate the relevant account activity.

The $2.25 million penalty is a record for a Section 609(e) violation under the Fair Credit Reporting Act, according to the Federal Trade Commission, and it is described as a civil penalty paid as part of the government’s enforcement action rather than a pool of money earmarked for individual consumer payouts.

Because the agreement described by regulators focuses on record access and a civil penalty, the public filings and announcements referenced here do not describe a consumer claims process, payment options, or per-person settlement amounts. In other words, there is no indication in these materials that eligible individuals will receive checks or other direct settlement payments, so there are no listed claim deadlines, distribution dates, or disbursement methods to follow.

Likewise, nothing in the described enforcement action indicates it includes Amazon Prime refunds. Consumers trying to determine whether they are “eligible” in the context of this matter should treat eligibility as relating to whether they qualify to request identity-theft-related records—generally, whether they believe an Amazon account or transaction was opened or conducted using their identity—and should look for the notice Amazon is required to post on its site for the specific steps it provides for requesting those records.