Amazon Faces $2.25 Million Penalty Over Identity Theft Record Delays

The FTC complaint reveals that Amazon lacked any formal written procedure for managing such requests until early 2025, only implementing a policy after the agency launched its investigation. Before this shift, the company frequently rebuffed victims by citing vague security or privacy concerns. In one instance, a customer unsuccessfully attempted to retrieve account information 30 times, even after being pressured to identify the specific thief responsible for the fraud. The company also reportedly obstructed law enforcement efforts by withholding or delaying records essential to active investigations.

Christopher Mufarrige of the FTC’s Bureau of Consumer Protection described the experience as a Kafkaesque ordeal, noting that victims were forced to perform their own investigations before Amazon would release documents protected under federal law. Under the terms of the proposed settlement, Amazon must now establish clear protocols for record requests, provide documentation to both victims and law enforcement, and proactively reach out to any individuals who were denied access since April 2024.