Amazon Fined $2.25M for Refusing Identity Theft Victims' Records Requests

Amazon has agreed to pay a $2.25 million civil penalty for allegedly stonewalling identity theft victims who requested records showing how their stolen information was used.

The Justice Department alleged that Amazon customer service agents refused victims' requests, citing privacy or security concerns, and in some cases told law enforcement officers they needed a subpoena before releasing records.

The Federal Trade Commission (FTC) says the penalty is the largest it has ever obtained under Section 609(e) of the Fair Credit Reporting Act, which requires companies to turn over application and transaction records within 30 days of a request.

Amazon did not have a written policy for handling these requests until early 2025, despite FTC staff advising Amazon's lawyers in June 2023 to review its compliance.