By Doc Louallen
Amazon will pay $2.25 million in civil penalties to settle Federal Trade Commission allegations that it knowingly violated the Fair Credit Reporting Act.
The FTC said Amazon failed to give identity‑theft victims the application and transaction records they're entitled to within 30 days of request.
According to the complaint, Amazon didn't have a written process for handling these requests until early 2025, after it learned of the FTC investigation. Many consumers were told the company couldn't share records for security or privacy reasons.
In one case, a person was asked to guess the name used on the account by the identity thief and still couldn't get the records after 30 attempts. The agency also said Amazon sometimes refused to share records with law enforcement trying to help victims, or sent the records late.
"Amazon often put identity theft victims through a Kafkaesque ordeal by demanding they identify the thief who stole their information before Amazon would release the records the law entitles them to-records that could help victims protect themselves and recover from the fraudulent conduct," said Christopher Mufarrige, director of the FTC's Bureau of Consumer Protection.
Under the proposed order, Amazon must provide requested records to victims and to law enforcement acting for them, tell consumers how to ask for records, and contact people who asked Amazon for records since April 2024 but didn't receive them.
Amazon didn't respond immediately to a request for comment.
Write to Doc Louallen at Doc.Louallen@wsj.com