The Federal Trade Commission has fined Amazon $2.25 million to settle claims that the company failed to help customers who fell victim to identity theft. In its complaint, the FTC accuses Amazon of refusing to give customers information about purchases made with fraudulent accounts, in violation of the Fair Credit Reporting Act.

What the FTC alleges

The heart of the case is how Amazon handled identity-theft victims who reached out for help. According to the FTC's filing, victims who contacted Amazon would often enter what the complaint describes as a Kafkaesque sequence, in which a support agent would not provide records tied to a fraudulent account unless the victim could name the person who opened it.

That is a nearly impossible demand, since victims typically have no idea who stole their identity. The FTC alleges this catch left people stuck, unable to get the very information they needed to address the fraud.

A Kafkaesque support loop

One example in the complaint illustrates the problem starkly. A victim reportedly tried to guess the fraudulent account owner's name more than 30 times, yet Amazon still allegedly would not remove the victim's credit card information from the thief's account.

The FTC also claims Amazon failed to respond to identity-theft victims' requests for records within the 30 days required by the Fair Credit Reporting Act. Under the FCRA, businesses have specific obligations to help victims access records connected to fraud committed in their name, and regulators say Amazon fell short of those duties. Cases like this underscore why consumer-protection rules matter across the business world.

Why the FCRA applies here

The Fair Credit Reporting Act is best known for governing credit reports, but it also sets rules for how companies must assist identity-theft victims. Key requirements include:

  • Providing victims with records of transactions made using their stolen information.
  • Responding to those requests within a defined 30-day window.
  • Not erecting unreasonable barriers, such as demanding a victim identify the thief first.

The FTC's action signals that these obligations apply to large online retailers just as they do to traditional creditors, and that regulators are willing to enforce them.

Amazon's response and what comes next

An Amazon spokesperson told Bloomberg that the company has resolved the matter with the FTC and has implemented process improvements for customers who believe they may be victims of identity theft. In other words, the settlement closes the case while Amazon says it has changed how it handles these situations.

For consumers, the practical lesson is that you have rights under the FCRA when your identity is stolen, including the right to request records of fraudulent transactions. If a company stonewalls, that failure can itself be a violation. The $2.25 million penalty is modest for a company Amazon's size, but the precedent, that refusing to help victims can carry legal consequences, is what gives the case its weight. Expect regulators to keep scrutinizing how major platforms treat fraud victims, a recurring thread in business news.

Frequently asked questions

Why was Amazon fined?

The FTC fined Amazon $2.25 million over claims it failed to help identity-theft victims and refused to share records of purchases made with fraudulent accounts, allegedly violating the Fair Credit Reporting Act.

What is the Kafkaesque loop the FTC describes?

The complaint alleges Amazon would not release records tied to a fraudulent account unless the victim could name the person who opened it, an impossible demand for most identity-theft victims.

Did Amazon admit wrongdoing?

Amazon said it resolved the matter with the FTC and implemented process improvements for suspected identity-theft victims, framing the settlement as a resolution rather than an admission.