Amazon has agreed to pay a $2.25 million civil penalty after the U.S. Federal Trade Commission (FTC) found the company failed to properly assist identity theft victims seeking information about fraudulent accounts created in their names.
According to the FTC, Amazon violated the Fair Credit Reporting Act (FCRA) by refusing or delaying requests from victims who needed records to dispute fraudulent purchases and identity theft. The law requires companies to provide victims with relevant transaction records within 30 days after receiving a valid request.
The complaint alleges that Amazon’s customer support process created unnecessary obstacles for victims attempting to recover from identity theft. In some cases, support representatives refused to disclose information about fraudulent accounts unless victims could correctly identify the person who had opened the account, something the FTC described as an unreasonable requirement.
One example cited by regulators involved a victim who unsuccessfully guessed the fraudster’s name more than 30 times. Despite confirming that the victim’s payment card had been used without authorization, Amazon allegedly failed to remove the stolen card information from the fraudulent account.
The FTC also said Amazon failed to consistently respond to victims’ requests within the timeframe required by federal law, preventing some individuals from obtaining documents needed to dispute fraudulent debts or repair their credit histories.
Without admitting wrongdoing, Amazon reached a settlement with the FTC and agreed to pay the financial penalty. The company said it has since improved its procedures for handling identity theft complaints and assisting affected customers.
The case highlights the legal obligations companies face when criminals misuse consumers’ personal information to create fraudulent online accounts. Under the FCRA, businesses must provide identity theft victims with records relating to fraudulent transactions so they can work with banks, creditors, and law enforcement to resolve the incident.
The FTC said timely access to these records is essential because delays can prolong financial harm, complicate fraud investigations, and make it more difficult for victims to restore their identities. The enforcement action serves as a reminder that companies handling consumer data are expected to provide meaningful assistance when identity theft occurs.