Amazon has been fined $2.25 million by the U.S. Federal Trade Commission (FTC) for withholding evidence from identity theft victims, a move that’s sparking concerns about corporate accountability in cases of online fraud. The FTC alleges that Amazon failed to provide transaction records to those who had fallen victim to identity theft, as required by law.
At the heart of this issue is Section 609(e) of the Fair Credit Reporting Act (FCRA), which mandates that companies like Amazon provide access to records of fraudulent transactions within 30 days. However, in some cases, Amazon customer service agents claimed that sharing these records would compromise “privacy” or “security”, effectively denying victims the information they needed to recover from identity theft. The FTC also reported instances where law enforcement agencies were refused access to requested records.
The scale of this problem is staggering. Not only did Amazon deny legitimate requests for records, but it also failed to notify consumers who had been waiting for months – or even years – for documentation that could help them resolve their cases. It’s a worrying trend that suggests some companies are more interested in protecting their own interests than in supporting victims of identity theft.
The proposed order mandates that Amazon provide access to lawfully requested records within 30 days, as required by the FCRA. The company will also be required to notify consumers who have been waiting for records since April 2024 that they may request additional information. This is a crucial step towards holding companies accountable for their actions and ensuring that victims of identity theft receive the support they need.
This case is not an isolated incident. In recent years, Amazon has faced several high-profile fines related to its business practices. The company paid $25 million in 2023 to settle allegations that it violated children’s privacy laws related to its Alexa voice assistant service. It also shelled out a staggering $2.5 billion in 2025 to settle a lawsuit alleging that it used dark patterns to trick users into enrolling in its Prime program and make it difficult to cancel recurring subscriptions.
The takeaway from this story is clear: companies must prioritize transparency and accountability when it comes to handling sensitive information. By doing so, they can help prevent identity theft and support victims who have fallen victim to online scams. As consumers, we need to demand more from the companies we trust with our personal data – and hold them accountable for their actions.
Source: Bleeping Computer — 2026-07-01