Amazon Ordered to Pay $2.25 Million and Give Identity-Theft Victims Fraud Records

Order status, August 16, 2026: A federal court has entered a stipulated order requiring Amazon.com Inc. to pay a $2.25 million civil penalty and follow new rules for providing identity-theft victims with application and transaction records. The entered order is confirmed. The government’s description of Amazon’s past conduct came from a civil complaint and remains an allegation resolved by settlement.

The public-interest value is larger than the penalty. Section 609(e) of the Fair Credit Reporting Act gives an identity-theft victim a route to obtain business records connected to fraudulent use of identifying or financial information. Those records can help a victim understand what happened and give evidence to law enforcement. This article explains the entered terms and verification limits. It is not legal advice and does not promise that every request will produce a record.

What the court entered

On August 14, the Justice Department announced that the U.S. District Court for the District of Columbia entered the stipulated order in a case investigated and referred by the Federal Trade Commission.

The order requires a $2.25 million payment to the U.S. Treasury. It bars Amazon from failing to provide covered records and creates notice, outreach, recordkeeping, and compliance duties. The order remains in effect for ten years unless the court changes it.

The government’s June 29 complaint alleged that Amazon repeatedly failed to provide records, gave privacy or security explanations that did not satisfy Section 609(e), required some victims to identify the unknown thief, and sometimes missed the 30-day deadline. A complaint states the government’s allegations. It is not a factual finding after trial.

What records the order covers

The order attached to the government’s consent motion covers application and business-transaction records in Amazon’s control that evidence a transaction allegedly resulting from identity theft. The records may include information identifying the alleged thief and can be sent to the victim or authorized law enforcement. Browsing data is excluded, and other laws can still prohibit particular disclosures.

What Amazon may ask a victim to provide

The order allows Amazon to verify identity and the identity-theft claim. Depending on the request, Amazon may require:

• A government-issued identification card or comparable identifying information.
• A police report supporting the identity-theft claim.
• A completed standardized identity-theft affidavit or another acceptable affidavit.
• Known transaction details and a delivery contact.

A good-faith denial is allowed when the duty does not apply, identity cannot be verified with high confidence, the request contains a relevant misrepresentation, it seeks excluded data, or records are not reasonably available after a diligent search. Amazon must track requests, response dates, and denial reasons.

The 30-day clock and the new website notice

Amazon must post a notice in a place where a consumer seeking fraud or identity-theft help would reasonably expect to find it. The notice must explain how to request covered records and must offer both an electronic method and a postal address.

The notice must promise records within 30 days after Amazon receives a request, contact method, and any permitted verification documents it requires. Consumers should preserve the request, attachments, confirmation, and dates. Do not send identity documents to an address from an unsolicited message; use Amazon’s official fraud-help page or the postal address shown there.

Outreach to people whose earlier requests went unanswered

For written requests received from April 1, 2024 through the order date, Amazon must search for people who did not receive records and send a new notice when valid contact information is available. Within 120 and 180 days, an Amazon legal vice president must certify the outreach and report aggregate request, delivery, and denial counts to the FTC. Those numbers can show whether the settlement reached the people it was designed to help.

Ten years of compliance duties

Amazon must distribute the order to relevant personnel, file a sworn compliance report, create compliance records for ten years, and retain each covered record for five years. The records include complaints, request and response dates, denial reasons, training, and procedures. The FTC should disclose aggregate timeliness and denial figures when lawful.

What consumers can do now

The FTC’s identity-theft records guide explains why a business’s application and transaction records can help a victim identify misuse and provide evidence to law enforcement. Its business guidance explains the Section 609(e) duty from the company’s side.

A victim can keep a dated file with the unauthorized account or charge, an IdentityTheft.gov or police report when appropriate, identification, known transaction details, the records request, and each response. Never publish those materials or send them to BadPD. Preserve any denial or delay and confirm eligibility with an official source or qualified lawyer.

What is confirmed and what remains alleged

It is confirmed that the court entered the stipulated order, the $2.25 million judgment is due, the 30-day records and website-notice requirements apply, and the compliance term lasts ten years. It is also confirmed that the FTC referred the case and the Justice Department filed it.

The complaint’s descriptions of customer-service interactions and past noncompliance are allegations. Future compliance is also unproved. It should be measured through notices, certifications, request logs, response times, denial reasons, and any enforcement action.

BadPD will update this ledger if the FTC publishes Amazon’s certifications, if the court modifies or enforces the order, or if Amazon publishes a stable official request page.

Sources and dates

• Justice Department announcement that the federal court entered the Amazon order, August 14, 2026.
• FTC announcement of the proposed settlement and complaint, June 29, 2026.
• Complaint for Permanent Injunction, Civil Penalty Judgment, and Other Relief, filed June 29, 2026.
• Consent motion and attached stipulated order, filed June 29, 2026; entry confirmed by DOJ August 14, 2026.
• FTC consumer guide to identity-theft business records, April 12, 2022.
• FTC business guidance on FCRA Section 609(e), January 2013; accessed August 16, 2026.