"The complaint alleged that in other instances, Amazon agents told consumers they were not able to access the requested records," the FTC said on Tuesday.
FTC complaint and Justice Department filing
The U.S. Federal Trade Commission announced that Amazon will pay a $2.25 million civil penalty to resolve allegations that the company blocked identity-theft victims from obtaining records of fraudulent transactions. The agency said those allegations appear in a complaint filed with the Justice Department that charges Amazon with failing to provide transaction records as required by Section 609(e) of the Fair Credit Reporting Act (FCRA).
What the FTC says Amazon did
According to the FTC, many consumers who contacted Amazon requesting records of fraudulent transactions were denied those records — sometimes on grounds labeled as "privacy" or "security." The agency says Amazon customer-service agents also told some consumers the company could not access the requested records. Even when records were produced, the FTC says they were often provided after the 30-day timeframe mandated by the FCRA.
The complaint further alleges that Amazon refused to provide application and business transaction records to law enforcement agencies that had been authorized to request them on behalf of identity-theft victims. Some consumers, the FTC said, were driven to send copies of the FCRA and FTC guidance to Amazon in hopes of receiving records, but the company still failed to comply.
Terms of the proposed order
The proposed order tied to the settlement requires Amazon to provide access to lawfully requested records to identity-theft victims and to law enforcement agents within 30 days, consistent with the FCRA's timeline. In addition to the $2.25 million civil penalty, the company was ordered to notify consumers who had requested records since April 2024 but had not received them that they may request additional records.
Recent related enforcement actions involving Amazon
The FTC's action follows a pattern of prior settlements involving Amazon. The source notes that in July 2023 Amazon agreed to pay a $25 million fine to settle allegations it violated children's privacy laws related to its Alexa voice assistant service. More recently, in September 2025 Amazon paid $2.5 billion to settle a Prime membership lawsuit alleging the use of dark patterns to enroll users and make cancellations difficult.
The FTC also pointed to a precedent outside Amazon: Kohl's Department Stores paid a $220,000 fine six years ago to resolve similar charges after refusing to provide records of fraudulent transactions to identity-theft victims.
What this means for consumers and law enforcement
- Consumers who requested records from Amazon since April 2024 and did not receive them will be notified they may request additional records under the proposed order.
- Law enforcement agencies that are authorized to request records on behalf of identity-theft victims are covered by the order’s 30-day production requirement, addressing the FTC’s allegation that Amazon refused some such requests.
The FTC's announcement ties a monetary penalty to procedural requirements meant to restore access to documentation for victims of identity theft. The proposed order sets clear deadlines and directs Amazon to reach back to consumers with outstanding requests dating to April 2024. Whether those remedies will fully resolve the cases cited in the complaint depends in part on compliance with the 30-day production mandate and the company’s follow-through on consumer notifications.
Original reporting: https://www.bleepingcomputer.com/news/security/amazon-fined-225m-for-withholding-evidence-from-fraud-victims/
