Published
September 9, 2026
Identity theft victims who asked Amazon for the records of fraudulent purchases made in their names were routinely turned away, according to a federal complaint that a court resolved by stipulated order in August 2026. Amazon will pay a $2.25 million civil penalty and must now provide those records free within 30 days — but the money goes to the U.S. Treasury, so there is no fund and nothing to claim.
What the Court Order Says
The Justice Department announced on August 14, 2026 that a federal court entered a stipulated order against Amazon.com Inc. resolving allegations that the company violated the Fair Credit Reporting Act. The case was investigated by the Federal Trade Commission and referred to the Justice Department, which filed it in the U.S. District Court for the District of Columbia on June 29, 2026 as United States v. Amazon.com, Inc., No. 1:26-cv-02305. The order imposes a $2.25 million civil penalty and requires Amazon to change how it answers a specific kind of request from identity theft victims.The provision at issue is Section 609(e) of the Fair Credit Reporting Act. It gives a victim of identity theft the right to obtain, from the business where the fraud occurred, the application and business transaction records tied to the fraudulent activity — the paper trail showing what was bought, when, and where it was shipped. The business has 30 days to produce those records once the victim verifies their identity and their claim of identity theft. The government alleged Amazon failed to provide those records at all and failed to provide them within the 30-day window.
Status
Stipulated Order Entered (August 2026)
Justice Department case referred by the FTC · civil penalty plus injunctive relief
Penalty
$2.25 Million
Paid to the United States as a civil penalty — not a consumer redress fund
Can I Claim?
No — There Is No Consumer Fund
No claim form and no individual payout · the consumer benefit is the records access Amazon must now provide
How the Requests Were Allegedly Handled
According to the FTC, Amazon representatives told victims the records could not be shared, citing security or privacy concerns. In one instance the FTC described, a consumer contacting Amazon about unauthorized charges from a fraudulent account was told the company could not share details about the other account for "security reasons" unless the consumer guessed the name on it — the name used by the identity thief — which the consumer could not do after 30 attempts.The FTC also alleged Amazon turned away requests submitted by law enforcement agencies that had been authorized to make them on victims' behalf, that some consumers resorted to sending Amazon copies of the statute and the FTC's own guidance without success, and that the company had no written policy for responding to Section 609(e) requests until early 2025 — after it learned of the FTC's investigation, and despite earlier outreach from FTC staff advising it to review its compliance.
"Consumers whose identities have been stolen should not face unnecessary red tape when they investigate how their identities were misused and seek to clear their names," said Assistant Attorney General Brett A. Shumate of the Justice Department's Civil Division. Christopher Mufarrige, director of the FTC's Bureau of Consumer Protection, said Amazon "often put identity theft victims through a Kafkaesque ordeal by demanding they identify the thief who stole their information before Amazon would release the records the law entitles them to."
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Amazon Has to Do Now
The order is forward-looking, and three of its requirements matter to anyone who has been through this:• Records on request, free, within 30 days. Amazon must provide its records of transactions alleged to be the result of identity theft to victims who request them, at no charge, within 30 days — subject to verification of the requester's identity and their claim of identity theft.
• A published notice explaining how. Amazon must post a notice on its website telling identity theft victims how to request those records, so finding the process is no longer the obstacle.
• Outreach to people already turned away. Amazon must contact consumers who requested records from it since April 2024 and did not receive them, and tell them it may hold additional records they can now request.
That last item is the closest thing here to a consumer remedy. It is not a payment and it is not a claim — it is a notice that a door previously closed is open, and it reaches only the people who already asked and were refused during that window.
Why a $2.25 Million Headline Is Not a Payout
A civil penalty is money a company pays the government for breaking a statute. It is not compensation, it is not divided among affected consumers, and no administrator distributes it. That is the structural difference between a government enforcement action like this one and a class action settlement, where a fund is created for the class and a claims process decides who gets paid from it. The same distinction applied in the RentGrow tenant-screening case, which also carried a $2.25 million penalty and also produced no consumer fund, and it holds at any size: the $600 million Alibaba resolution over illegal drug sales pays consumers nothing either.Private FCRA litigation is where consumers do sometimes recover money — the Equifax duplicate credit-reporting settlement is one example of a credit-reporting case that paid class members directly. Nothing like that exists here, and the FTC's case does not create one.
What Identity Theft Victims Can Do
Section 609(e) applies to businesses generally, not only to Amazon, and it is among the least-used rights the statute gives victims. If someone used your information to open an account or make purchases:• Ask the business directly. Request the application and business transaction records relating to the fraudulent activity from the company where it happened. Put the request in writing and keep the date — the 30-day clock runs from it.
• Expect to verify. Companies may require proof of your identity and documentation of the identity theft claim before releasing records. Having an identity theft report prepared in advance avoids a round trip.
• Use the records. Shipping addresses, order dates and payment details are what turn "someone used my card" into a documented account you can take to police, your bank and the credit bureaus.
• Lock down the credit file separately. Getting records is a different step from stopping further fraud — see the difference between a credit freeze and a fraud alert.
OCA's identity theft recovery checklist walks through the sequence, and the Fair Credit Reporting Act explainer covers the other rights the statute carries, including disputes and accuracy obligations.
Frequently Asked Questions
Is there money for consumers?
No. The $2.25 million is a civil penalty paid to the United States, not a redress fund. There is no claim form, no settlement website and no individual payment.What is Section 609(e)?
The provision that lets an identity theft victim obtain, from the business where the fraud happened, the application and transaction records connected to it — free of charge and within 30 days of the request, once identity and the identity theft claim are verified.Will Amazon reach out to people it previously refused?
Under the order, Amazon must contact consumers who requested identity theft records since April 2024 and did not receive them, to tell them additional records may be available on request.Did Amazon admit to the allegations?
The case was resolved by a stipulated order entered with Amazon's consent. The allegations in the complaint were not proven at trial.Sources
• Justice Department — Amazon Agrees to $2.25 Million Settlement and Injunction to Resolve Alleged FCRA Violations• FTC — Amazon to Pay $2.25 Million to Resolve Charges It Knowingly Violated the Fair Credit Reporting Act
• FTC — Case Page, United States v. Amazon.com, Inc.
• Complaint for Permanent Injunction, Civil Penalty Judgment and Other Relief (No. 1:26-cv-02305, filed June 29, 2026)
• Consent Motion for Entry of Proposed Stipulated Order
For more class actions keep scrolling below.
Status
Stipulated order entered (civil penalty; no consumer fund)
Penalty
$2,250,000 (paid to the United States)
Case Title
United States v. Amazon.com, Inc.
Case Number
1:26-cv-02305
Court
U.S. District Court for the District of Columbia
Date Filed
June 29, 2026
Order Entered
Announced August 14, 2026
Statute
Fair Credit Reporting Act, Section 609(e)
FTC Matter No.
252-3024
Official Website
FTC Case Page — United States v. Amazon.com, Inc.
