The Federal Trade Commission is fining Amazon $2.25 million over allegations that the retail giant regularly denied records requests from identity theft victims. The U.S. agency accused Amazon of violating the Fair Credit Reporting Act.
Per an FTC press release, a complaint was filed by the Department of Justice as a referral from the FTC. It alleged that Amazon failed to comply with Section 609(e) of the FCRA, which requires companies to provide victims of identity theft with records about transactions made in their name within 30 days of a consumer's request.
FTC accusations against Amazon
Amazon apparently did not have a written policy for responding to 609(e) requests until last year.
Amazon often put identity theft victims through a Kafkaesque ordeal by demanding they identify the thief who stole their information before Amazon would release the records.
Christopher Mufarrige, FTC
“Amazon often put identity theft victims through a Kafkaesque ordeal by demanding they identify the thief who stole their information before Amazon would release the records the law entitles them to—records that could help victims protect themselves and recover from the fraudulent conduct,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection said in the release.
The complaint claims that customers who reached out to Amazon were often told that the requested records could not be provided for "security" or "privacy" reasons. In one provided example, a consumer tried to get business records related to unauthorized charges from a fraudulent account. However, Amazon reportedly refused for security reasons unless the consumer "guessed the name on the [fraudulent] account," which they were unable to do.
Penalties and resolution
Alongside the $2.25 million civial penalty, the DOJ's proposed order requires Amazon to provide records lawfully requested by identity theft victims and law enforcement agencies. It also requires the company to provide notice to customers about how they can request FCRA records.
Additionally, Amazon is required to contact any customers who requested records since April 2024.
An Amazon spokesperson told Tom's Guide that it has implemented process improvements and resolved the matter with the FTC.
“We are committed to providing customers with their detailed account information when they need it most. We've resolved this matter with the FTC and have implemented process improvements for customers who believe they may be victims of identity theft. Customers who need assistance requesting their records can visit our Help Page to learn more."
How to contact Amazon for Identity Theft records
Amazon has a portal for Identity theft called "Report Suspicious Activity." There you can report unrecognized orders, chargers to your payment methods that aren't from your Amazon account and other unauthorized activity.
You can request records relating to fraudulent transactions via the Request Your Data portal. If that's not enough you can also send an email or physical mail:
By Email: fcra-requests@amazon.com
By Mail: Amazon Legal Department
Attn: FCRA Records Requests
P.O. Box 80161Seattle, WA 98108-9990
You will need to provide a copy of a government ID, a copy of a police report concerning identity theft, or a government-issued Identity Theft Report, found at IdentityTheft.gov. You'll also need relevant details about the fraudulent transaction and contact information so Amazon can reach out.
Amazon says that it will fulfill your requests within 30 days unless more information is needed.
