If someone used your identity to buy things on Amazon, a federal court order now requires Amazon to hand over the records of those purchases free of charge within 30 days of your request. That is what consumers get from the case. The $2.25 million civil penalty Amazon agreed to pay goes to the U.S. Treasury, not to victims, so there is no claim to file.
Status: Stipulated order entered, announced August 14, 2026 | No consumer fund — the benefit is access to records, not money
The Right at the Center of the Case
Section 609(e) of the Fair Credit Reporting Act lets an identity theft victim obtain records from the business where the fraud took place. Those are the application and business transaction records tied to the fraudulent activity: what was bought, when, and where it was shipped. Once the victim verifies their identity and their identity theft claim, the business has 30 days to provide the records, at no charge.
The government alleged that Amazon failed to provide those records and failed to meet the 30-day deadline. The Federal Trade Commission investigated and referred the case to the Justice Department, which filed it on June 29, 2026 in the U.S. District Court for the District of Columbia as United States v. Amazon.com, Inc., No. 1:26-cv-02305. The court then entered a stipulated order with Amazon’s consent.
| Case | United States v. Amazon.com, Inc., No. 1:26-cv-02305 |
| Court | U.S. District Court for the District of Columbia |
| Filed | June 29, 2026 |
| Order announced | August 14, 2026 |
| Civil penalty | $2.25 million, paid to the United States |
| FTC matter number | 252-3024 |
What Amazon Must Do Now
The order looks forward. Three requirements matter to identity theft victims:
- Free records within 30 days. Amazon must give victims who ask its records of transactions alleged to result from identity theft, at no cost and within 30 days, after verifying the requester’s identity and identity theft claim.
- A public explanation. Amazon must post a notice on its website telling identity theft victims how to request the records.
- Outreach to people already refused. Amazon must contact consumers who asked it for identity theft records since April 2024 and did not get them, and tell them it may have more records they can request.
The outreach is the closest thing to a direct consumer remedy, but it is a notice, not a payment, and it covers only people who asked during that window and were turned down. If you were one of them, watch for that contact from Amazon. Anyone else can make a request directly.
What the Government Said Happened
According to the FTC, Amazon representatives told victims the records could not be shared for security or privacy reasons. In one example the FTC described, a consumer asking about unauthorized charges from a fraudulent account was told Amazon could not share details for “security reasons” unless the consumer guessed the name on the account. That was the name the identity thief had used, and the consumer could not guess it after 30 tries.
The FTC also alleged that Amazon:
- turned away requests from law enforcement agencies authorized to act on victims’ behalf;
- left some consumers sending copies of the statute and the FTC’s own guidance, without success; and
- had no written policy for Section 609(e) requests until early 2025, after it learned of the FTC investigation and despite earlier outreach from FTC staff urging it to review its compliance.
Amazon agreed to the order. The allegations were not tested at trial.
Officials were blunt. Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division said identity theft victims “should not face unnecessary red tape” when they try to clear their names. Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, said Amazon “often put identity theft victims through a Kafkaesque ordeal by demanding they identify the thief who stole their information before Amazon would release the records the law entitles them to.”
Why the Penalty Does Not Reach Victims
A civil penalty is what a company pays the government for breaking a law. It is not compensation and no administrator divides it among consumers. A class action settlement is built differently: it creates a fund and a claims process. This case did neither. Private FCRA lawsuits are where consumers sometimes recover money, but no such case is tied to this order.
How to Request Your Records
Section 609(e) covers businesses generally, not just Amazon. If someone opened an account or made purchases in your name:
- Write to the business. Ask for the application and business transaction records related to the fraudulent activity. Keep a copy and note the date, because the 30 days run from your request.
- Be ready to verify. The business may require proof of identity and documentation of the identity theft, such as an identity theft report. Preparing it in advance saves a round trip.
- Use what you get. Shipping addresses, order dates and payment details help you document the fraud for police, your bank and the credit bureaus.
- Protect your credit file separately. Getting records does not stop new fraud. A credit freeze or fraud alert is a separate step.
OpenClassActions.com covers the order and its background in its Amazon identity theft records report, and the FTC case page holds the official filings.
Frequently Asked Questions
Is there money for consumers in the Amazon FCRA settlement?
No. The $2.25 million is a civil penalty paid to the United States. There is no claim form, settlement website or individual payment. The consumer benefit is that Amazon must provide identity theft records free within 30 days of a request.
What is Section 609(e) of the Fair Credit Reporting Act?
It lets an identity theft victim obtain the application and transaction records connected to the fraud from the business where it happened, free of charge and within 30 days, once the victim verifies their identity and identity theft claim.
Will Amazon contact me if it refused my request before?
The order requires Amazon to contact consumers who asked for identity theft records since April 2024 and did not receive them, telling them additional records may be available on request.
Did Amazon admit the allegations?
Amazon consented to the stipulated order. The allegations in the complaint were not proven at trial.
Where is the case filed?
United States v. Amazon.com, Inc., No. 1:26-cv-02305, in the U.S. District Court for the District of Columbia, filed June 29, 2026.
Sources
- U.S. Department of Justice — Amazon agrees to $2.25 million settlement and injunction to resolve alleged FCRA violations
- Federal Trade Commission — press release on the $2.25 million FCRA resolution
- Federal Trade Commission — case page, United States v. Amazon.com, Inc. (FTC Matter No. 252-3024)
- Complaint, No. 1:26-cv-02305 (filed June 29, 2026)
- Consent motion for entry of proposed stipulated order
- OpenClassActions.com — Amazon to Pay $2.25M for Denying Identity Theft Victims Their Own Fraud Records
Source and credit: this report builds on our sister site’s coverage — OpenClassActions.com: Amazon to Pay $2.25M for Denying Identity Theft Victims Their Own Fraud Records — which follows the case and is updated as new filings, orders and payment news come in.
Legal Disclaimer
This article is for informational purposes only and is not legal advice. OpenClassActions.org is a consumer news site, not a law firm, and is not affiliated with any party to the matters described. Allegations are allegations until a court rules on them, and court schedules and outcomes can change.