Amazon Settlement Highlights Identity-Theft Records Rights
A June 30, 2026, settlement involving Amazon is drawing attention to a federal right many identity-theft victims do not know they have: the ability to request records connected to fraudulent accounts and transactions.
The Federal Trade Commission said Amazon agreed to pay a $2.25 million civil penalty to resolve allegations that it violated the Fair Credit Reporting Act by failing to provide certain records to identity-theft victims within the law’s 30-day timeframe. The United States filed the complaint in federal court on June 29, 2026.
The case remains listed as pending on the FTC’s case page. The parties filed a proposed stipulated order, and Amazon neither admits nor denies the complaint’s allegations under that proposed order. The $2.25 million is a civil penalty payable to the United States, not a consumer refund program.
What Section 609(e) allows victims to request
Section 609(e) of the Fair Credit Reporting Act generally requires a business that provided goods, services or credit, accepted payment or otherwise entered into a commercial transaction involving someone who allegedly used another person’s identity without authorization to provide relevant application and business transaction records.
The records may help a victim or an investigating officer understand how a fraudulent account was opened or used. They may include information that identifies the alleged identity thief, but the law does not guarantee that the documents will identify the person responsible or lead to recovery of lost money.
The right is also limited. It does not require a company to provide every kind of data, and the statute excludes Internet navigational data and similar information about a person’s visit to a website or online service.
A request generally must be made in writing and sent to the address the business designates. The records may be sent to the victim or, if the victim specifies or authorizes it, directly to a federal, state or local law-enforcement agency.
What to include in a request
Federal guidance and the proposed Amazon order say a business may require documentation showing both the requester’s identity and the identity-theft claim. That can include:
- A government-issued identification document;
- A police report; and
- A completed identity-theft affidavit.
Consumers should identify the suspected fraudulent account or transaction as specifically as possible, keep copies of everything submitted and use a delivery method that documents when the business received the request. They should send the request to the company’s designated address or channel, rather than relying only on a general customer-service conversation.
How the 30-day deadline works
Section 609(e) says the business must provide covered records no later than 30 days after receiving a qualifying request. The proposed Amazon order states that the 30-day period applies after Amazon receives the request, any preferred contact information it requires in good faith and any verification documents it requires in good faith.
That makes the paper trail important. Consumers should record the date they sent the request, the date of delivery, the designated business address, the documents included and the names or reference numbers from follow-up contacts. If a company says the request is incomplete, ask in writing what specific information is missing.
What the complaint alleges about Amazon
The complaint alleges that Amazon sometimes gave victims or authorized law-enforcement representatives explanations that obstructed access to records. The allegations include references to security or privacy concerns, requests that victims guess the name of the person who opened the fraudulent account, claims that representatives could not access the records and demands for subpoenas from law enforcement.
The filing also alleges delays and refusals in circumstances where the statute generally does not make a subpoena a prerequisite for an authorized law-enforcement request. It alleges that Amazon failed in some cases to provide records or even issue a denial within 30 days.
Those descriptions remain allegations. The proposed stipulated order would permanently bar the challenged practices, require Amazon to maintain a process for receiving Section 609(e) requests and require a website notice explaining how victims can request records. It would also require Amazon to identify certain eligible victims who previously submitted written requests but did not receive responsive records, then notify them about the process for requesting records again. The order would take effect only if entered by the court.
When a company may refuse
Section 609(e) does not create an unlimited right to every record. A business may decline a request in specified circumstances, including when it determines in good faith that the law does not require disclosure, lacks a high degree of confidence in the requester’s identity, finds that the request contains a relevant misrepresentation or determines that the information is excluded Internet navigational data.
The statute also recognizes a defense when the requested records do not exist or are not reasonably available after a reasonably diligent search. A company’s general security or privacy concern, a demand that the victim guess the alleged thief’s name or a representative’s lack of personal access is not automatically one of the listed grounds for denial.
What to do if a company refuses or does not respond
Ask for the denial and the reason in writing. Preserve the request, delivery confirmation, attachments and all responses. If law enforcement is investigating, provide the agency with the records and correspondence and ask whether it should submit its own authorized request.
Victims should handle related credit-reporting steps separately. The Consumer Financial Protection Bureau advises consumers to report identity theft, consider a fraud alert or credit freeze and dispute fraudulent accounts with the nationwide consumer-reporting companies. A transaction-record request does not replace those actions.
If the business does not respond within the applicable 30-day period or appears to impose requirements the law does not support, consumers can consider filing a complaint with the FTC or CFPB and contacting the relevant law-enforcement agency. The federal right is limited, but a careful written request can give victims and investigators access to records that may otherwise be difficult to obtain.
Sources
Discover more from Interactive News
Subscribe to get the latest posts sent to your email.
