Amazon Agrees to $2.25M Settlement Over Alleged FCRA Violations

Case Snapshot

• Defendant: Amazon.com Inc.
• Court: U.S. District Court for the District of Columbia
• Agencies: U.S. Department of Justice and Federal Trade Commission
• Law: Fair Credit Reporting Act
• Key Issue: Access to transaction records involving alleged identity theft
• Resolution: $2.25 million civil penalty and injunctive requirements governing future requests from identity theft victims

Amazon.com Inc. has agreed to pay a $2.25 million civil penalty and comply with injunctive requirements to resolve federal allegations that it violated the Fair Credit Reporting Act (FCRA) in responding to identity theft victims.

The U.S. Department of Justice (DOJ) announced the resolution on August 14 after a federal court entered a stipulated order against Amazon. The case was investigated and referred to the Justice Department by the Federal Trade Commission (FTC).

The settlement focuses on FCRA requirements governing access to business transaction records that can help identity theft victims determine how their personal information was fraudulently used.

Government Alleges Failures in Handling Record Requests

The federal government alleged that Amazon failed to provide identity theft victims with requested records of transactions made by individuals suspected of fraudulently using their personal information. The government also alleged that Amazon failed to provide those records within 30 days of receiving a request, as required under the FCRA.

Such records can provide victims with information about transactions made using their identities and help them investigate fraudulent activity.

Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division said consumers should not encounter unnecessary obstacles when trying to determine how stolen identities were used.”Consumers whose identities have been stolen should not face unnecessary red tape when they investigate how their identities were misused and seek to clear their names,” Shumate said.

Amazon Must Provide Records Within 30 Days

In addition to the $2.25 million penalty, the stipulated order establishes requirements for how Amazon must respond to qualifying requests going forward.

Amazon must provide identity theft victims with records of transactions alleged to have resulted from the misuse of their identities when those records are requested.

The records must be provided free of charge and within 30 days, subject to verification of the requesting consumer’s identity and identity theft claim. These requirements are intended to ensure that victims can obtain relevant transaction information without additional cost after satisfying the applicable verification requirements.

Website Notice Required

The stipulated order also requires Amazon to make information about the request process more accessible.

Amazon must post a notice on its website explaining how identity theft victims can request transaction records associated with the alleged fraudulent use of their identities.

The requirement addresses both access to records and consumers’ ability to understand the process for exercising their rights.

FCRA Protections for Identity Theft Victims

The FCRA includes protections designed to help consumers respond to identity theft and address the consequences of fraudulent use of their personal information.

The Amazon case specifically concerns requirements for businesses to provide certain transaction records to identity theft victims upon a qualifying request.

The government’s allegations focused on both Amazon’s failure to provide requested records and its failure to provide them within the required timeframe.

The stipulated order resolves those allegations and establishes practices Amazon must follow when handling future requests.

DOJ and FTC Coordinate Enforcement

The case reflects coordination between the FTC and Justice Department on FCRA enforcement.

The FTC investigated the matter before referring it to the DOJ. The United States is represented by Assistant Directors Lory D. Alexander and Zachary A. Dietert from the Enforcement Section of the Civil Division’s Enforcement and Affirmative Litigation Branch, working with staff from the FTC’s Bureau of Consumer Protection.

Shumate said the Justice Department would continue working with the FTC to protect identity theft victims.

Compliance Takeaways

The settlement highlights the importance of having procedures in place to recognize and respond to requests from identity theft victims within applicable FCRA deadlines.

Businesses subject to these requirements should ensure that consumers have a clear way to request relevant transaction records, that identity and identity theft claims can be appropriately verified, and that qualifying records are provided within the required timeframe.

For Amazon, the stipulated order combines a significant monetary penalty with ongoing requirements intended to make the records-request process more accessible to consumers affected by identity theft.