Amazon to Pay $2.25 Million Over Identity Theft Record Failures

Key Takeaways

• $2.25 Million Penalty: Amazon agreed to pay a $2.25 million civil penalty to resolve federal allegations that it violated the Fair Credit Reporting Act.
• Identity Theft Records: The government alleged Amazon failed to provide some identity theft victims with requested transaction records tied to the suspected fraudulent use of their identification.
• 30-Day Requirement: Federal authorities also alleged Amazon failed in some cases to provide requested records within the FCRA’s 30-day timeframe.
• New Requirements: Amazon must provide qualifying records free of charge within 30 days, subject to verification of the victim’s identity and identity theft claim.
• Consumer Notice: Amazon must post information on its website explaining how identity theft victims can request the relevant transaction records.

Deep Dive

Amazon.com has agreed to pay a $2.25 million civil penalty to resolve allegations that it violated the Fair Credit Reporting Act by failing to give identity theft victims requested records of transactions involving people believed to have fraudulently used their identification. In other cases, according to the government, Amazon provided the records too late.

A federal court entered the stipulated order in a case investigated by the Federal Trade Commission and referred to the Justice Department, the DOJ announced Friday. The government filed its complaint in the U.S. District Court for the District of Columbia.

The allegations concern a corner of the Fair Credit Reporting Act that matters most after something has already gone wrong. When an identity theft victim believes someone has used their identification to conduct a fraudulent transaction, the law can give that person access to records held by the business involved. Those records can help answer the questions that follow a stolen identity: what was bought, what information was used and where the fraud traveled next.

According to the government, Amazon failed to provide records requested by some victims and failed to provide other records within 30 days of a request. The stipulated order now makes those obligations explicit. Amazon must provide identity theft victims with records of transactions alleged to have resulted from the theft of their identities when they request them. The records must be provided free of charge and within 30 days, subject to verification of the victim’s identity and identity theft claim. Amazon must also place a notice on its website explaining how victims can make such requests.

The case is narrow in what it alleges. The government did not accuse Amazon of causing the identity theft or failing to prevent the fraudulent transactions themselves. Its case concerns what happened afterward, when victims turned to the company for information and, according to federal authorities, encountered delays or did not receive the records they were entitled to obtain.

That distinction is important. Identity theft has a peculiar way of shifting work onto the person who was harmed. A victim may have to identify fraudulent activity, persuade businesses that it was fraudulent, obtain records showing how their information was used and then carry those records elsewhere to begin clearing up the damage. A company’s obligation to produce information within 30 days can look like a procedural requirement on paper. To someone trying to reconstruct a fraud committed in their name, the procedure is the point.

“Consumers whose identities have been stolen should not face unnecessary red tape when they investigate how their identities were misused and seek to clear their names,” Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division said.

The $2.25 million penalty resolves the government’s allegations against one of the country’s largest companies, but the injunction reaches beyond the payment itself. Amazon will have to maintain a process that gives verified identity theft victims the transaction records they request within the required period and tells them where to go to ask for them.

For companies holding the records left behind by identity thieves, that is the obligation the case brings into focus. The fraud may belong to someone else. The records do not.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.