You’ve probably never once thought to ask Amazon for a copy of your own purchase history. Most people haven’t — not until their identity gets stolen and a stranger’s charges start showing up where their own should be.
That’s the exact situation regulators say Amazon handled too slowly for years. The company has now agreed to pay for it, and the fix built into the settlement is worth knowing about even if nothing like this has ever happened to you.
What the government actually accused Amazon of doing
The Federal Trade Commission’s complaint, announced June 30, 2026, alleges Amazon “routinely denied requests from identity theft victims seeking records of fraudulent transactions made with their personal data.” The FTC went further and called the violation knowing. Its complaint states Amazon had no written policy for handling these requests until early 2025. The company only adopted one after learning the agency was investigating.
These aren’t abstract paperwork requests. A transaction record is often the one piece of evidence a victim needs to prove to a bank, a credit bureau, or a debt collector that a charge wasn’t theirs.
The law behind this settlement
The requirement Amazon is accused of violating sits in Section 609(e) of the Fair Credit Reporting Act — the same federal law that governs your credit reports and background checks. It requires a business to hand over transaction records to a confirmed identity theft victim, free of charge, within 30 days of a request.
That 30-day clock exists because identity theft cases move fast. Disputes with a bank or a collections agency often come with their own short deadlines. A business sitting on your records for months can cost you the case entirely.
How the case moved from the FTC to the Justice Department
The FTC investigated and referred the case; it doesn’t litigate its own penalty actions in court. The Justice Department filed the complaint and the final order on the FTC’s behalf, announced August 14, 2026, in federal court in Washington, D.C. Two agencies, one case — the FTC built it, the DOJ filed it.
What Amazon has agreed to pay
Amazon will pay a $2.25 million civil penalty. The deal is structured as a stipulated order — a settlement both sides sign onto rather than a verdict a judge hands down after trial. There’s no formal admission of wrongdoing attached to the payment.
Getting your own records, now guaranteed
The right itself: if you’re a confirmed identity theft victim, Amazon must give you the transaction records tied to the fraud, at no charge.
The timeline: the injunction requires those records within 30 days of a verified request going forward — the same deadline the original law set, now backed by a court order specific to this company.
The catch: Amazon still gets to verify your identity and confirm the theft claim before handing anything over. That’s a reasonable guardrail, not a loophole — it’s what keeps a stranger from requesting your purchase history under your name.
The notice Amazon now has to post
Under the injunction, Amazon must post a notice on its own site explaining how identity theft victims can request their transaction records. You shouldn’t need a lawyer or a lucky search result to find out this right exists — that notice is meant to put the process in plain view for anyone who needs it.
What this doesn’t mean for you
This settlement doesn’t mean Amazon caused any particular identity theft, and it isn’t a signal that your account is less safe than it was last week. It’s a records-access case. It’s about how fast a company has to hand over paperwork once fraud is already confirmed — not about whether the fraud happened on Amazon’s watch.
If you’ve ever been a victim of identity theft
Maybe you’ve dealt with fraud on some account — Amazon or otherwise — and a company slow-walked your records request. This case is worth keeping in your back pocket. It’s proof the 30-day rule isn’t optional, and that regulators are actively enforcing it.
This is reporting on what changed, not a checklist for tonight — nothing here is advice about your specific accounts, only a plain account of what two federal agencies found and what a company agreed to fix.
The bottom line
A $2.25 million penalty won’t change how you shop on Amazon tomorrow. What it changes is quieter than that: the next time you — or someone you’re helping — needs proof that a charge wasn’t yours, the 30-day clock the law always promised is one a federal court is now actually watching.
This article was produced with the assistance of AI and reviewed by Womens Overview editors prior to publication.