Amazon has agreed to pay a $2.25 million civil penalty to resolve federal allegations that it failed to give identity-theft victims records showing how their stolen information had been used.
The Justice Department announced on August 14, 2026, that a federal court had entered a stipulated order resolving the case, which was investigated by the Federal Trade Commission and referred to DOJ.
The government alleged Amazon violated Section 609(e) of the Fair Credit Reporting Act, which gives qualifying identity-theft victims access to certain application and transaction records tied to fraudulent activity in their names.
Amazon did not admit wrongdoing as part of the settlement.
What Was Amazon Accused of Doing?
The FTC alleged that Amazon repeatedly failed to provide records requested by consumers whose personal information had been used by identity thieves.
Under Section 609(e), a covered business generally must provide qualifying records within 30 days of receiving a valid written request.
According to the FTC, some Amazon customer service representatives told consumers the company could not provide the information for security or privacy reasons.
In one example, a consumer seeking records connected to unauthorized charges was allegedly told Amazon could not disclose information about the fraudulent account unless the victim guessed the name the identity thief had used.
The FTC said that consumer tried roughly 30 names without obtaining the records.
Some Consumers Allegedly Sent Amazon the Law Itself
The government says some victims sent Amazon copies of the Fair Credit Reporting Act and FTC guidance in an effort to get their requests processed.
Amazon still allegedly failed to provide records in some of those cases.
The complaint also accused Amazon of rejecting certain requests submitted by law enforcement agencies acting on behalf of victims.
In other cases, the government says Amazon eventually provided records but only after the statutory deadline had passed.
Amazon Allegedly Had No Written 609(e) Policy Until 2025
The FTC alleged that Amazon did not have a written policy for handling Section 609(e) requests until early 2025.
According to the agency, that policy was created after Amazon learned of the FTC investigation.
The FTC also said its staff had previously contacted Amazon about compliance with the identity-theft records provision.
Why These Records Matter to Identity-Theft Victims
Transaction records can help a victim understand how stolen personal or financial information was used.
Depending on the fraud, those records may include invoices, account statements, credit applications, transaction details, contact information, or other documents connected to the fraudulent activity.
They can help victims dispute unauthorized transactions, document the theft, or give investigators information that may identify the person responsible.
What Rights Do Identity-Theft Victims Have?
A victim can make a written request for records connected to a fraudulent transaction made using their identity.
The business may require proof of identity and documentation supporting the identity-theft claim, such as an FTC Identity Theft Report, police report, or other permitted records.
Qualifying records must be provided free of charge, and victims can authorize a law enforcement agency to receive them on their behalf.
What Amazon Must Do Under the Settlement
The court order requires Amazon to comply with Section 609(e) going forward and provide qualifying identity-theft transaction records within the required timeframe.
Amazon must also post information on its website explaining how victims can request those records.
Some Past Amazon Customers Must Be Contacted Again
Amazon must contact certain consumers who requested identity-theft records since April 2024 but did not receive them.
Those consumers must be told that Amazon may have additional records available and that they can request the information again.
Is the $2.25 Million Going to Amazon Customers?
No consumer compensation fund was created by this case.
The $2.25 million is a civil penalty paid to the federal government.
The direct consumer benefit is the court-ordered change in Amazon’s handling of qualifying record requests and the requirement to revisit certain earlier requests.
Why the Penalty Is Notable
The FTC says the $2.25 million penalty is the largest civil penalty obtained for a violation of Section 609(e) of the Fair Credit Reporting Act.
It is also only the second FTC enforcement case involving that specific identity-theft records provision, after a 2020 case against Kohl’s.
The amount is small compared with some of Amazon’s other federal settlements, but the case is significant for enforcement of identity-theft victims’ access rights.
What Should You Do If Someone Used Your Identity on Amazon?
If you believe someone used your identity or financial information in a fraudulent Amazon transaction, you can request relevant business records in writing.
The FTC recommends using IdentityTheft.gov to create an Identity Theft Report and recovery plan.
If you previously requested records from Amazon and did not receive them, watch for communication about whether additional records are now available under the court order.
About This Page
RecallRefunds.com is a consumer information site. We are not the Settlement Administrator, a law firm, or a government agency. This page summarizes and is general information, not legal advice.