FTC Action and Penalties
The U.S. Federal Trade Commission has imposed a $2.25 million civil penalty on Amazon for preventing identity theft victims from accessing transaction records tied to fraudulent activity conducted in their names. According to a complaint filed with the Department of Justice, Amazon violated Section 609(e) of the Fair Credit Reporting Act by routinely denying consumer requests for these records. The FTC stated that Amazon customer service agents frequently cited privacy or security concerns as the reason for withholding the information, even though the law requires companies to provide such records upon request.
Widespread Noncompliance
Beyond denying direct consumer requests, Amazon also refused to provide application and business transaction records to law enforcement agencies that had been authorized to submit requests on behalf of identity theft victims. Some frustrated consumers resorted to sending copies of the FCRA and FTC guidance documents to Amazon in an attempt to obtain their records, but the company still failed to comply within the legally mandated 30-day timeframe. As part of the settlement, Amazon must now notify consumers who requested records since April 2024 but did not receive them that they may file new requests, and the company must comply with all future lawful requests within 30 days.
Source: BleepingComputer
