The FTC hit Amazon with a $2.25 million civil penalty. The charge? Amazon blocked identity theft victims from getting records of fraudulent transactions made in their names.
That’s required under Section 609(e) of the Fair Credit Reporting Act. Amazon didn’t do it.
It gets worse. FTC says Amazon’s customer service agents told victims they couldn’t provide the records due to privacy or security reasons. Even when they did share them, it was past the 30-day legal deadline. Some frustrated consumers sent copies of the FCRA and FTC guidance to Amazon just to get what they were owed. Still nothing.
The company even refused law enforcement agencies who submitted authorized requests on behalf of victims.
Under the proposed order, Amazon has to comply within 30 days going forward. They also need to notify consumers who requested records since April 2024 but never got them.
This isn’t Amazon’s first FTC settlement. They paid $25 million in 2023 over Alexa violating children’s privacy. And $2.5 billion in 2025 to settle the Prime dark patterns lawsuit.
Kohl’s paid $220,000 for the same violation six years ago. Amazon’s fine is ten times that.
