Amazon Fined $2.25 Million for Identity Theft Handling Failures

The Federal Trade Commission has imposed a $2.25 million fine on Amazon to resolve allegations that the company failed to assist consumers who became victims of identity theft, according to a report by Bloomberg. The FTC’s complaint, filed earlier this week, asserts that Amazon violated the Fair Credit Reporting Act (FCRA) by denying customers access to information about purchases made through fraudulent accounts. The agency claims that support agents often required identity theft victims to identify the person who opened the fraudulent account—a nearly impossible task—as a precondition for providing records, trapping users in a bureaucratic loop.

The FTC’s filing details a case in which a victim contacted Amazon after discovering unauthorized activity on their account. Despite demonstrating ownership of the compromised account, the customer was repeatedly denied access to transaction details unless they could name the individual who created it. The agency characterized this process as “Kafkaesque,” highlighting systemic failures in Amazon’s response to identity theft. The settlement, which does not admit guilt, mandates that Amazon revise its policies to comply with FCRA requirements, including providing victims with necessary records upon request. Amazon has declined to comment on the matter, but the case underscores growing scrutiny of how major tech companies handle consumer data disputes. The full details of the FTC’s complaint and Amazon’s obligations under the settlement are outlined in a report by The Verge.