Amazon to Pay $2.25 Million Over Identity Theft Record-Keeping Failures

Amazon has agreed to a $2.25 million civil penalty to resolve a Federal Trade Commission case alleging the company repeatedly failed to help identity theft victims. The FTC claims the e-commerce giant violated the Fair Credit Reporting Act by refusing to hand over transaction records to victims and, in some instances, to law enforcement agencies investigating the fraud.

Under the FCRA, companies must provide people whose identities have been stolen with records of fraudulent transactions made in their names within 30 days of a request. The FTC complaint says Amazon customer service representatives turned down many of those requests, citing security or privacy concerns. In other cases, victims were told the company simply couldn't access the necessary records. Even when Amazon did provide the information, it often arrived after the 30-day deadline had passed.

The settlement marks one of the more notable enforcement actions tied to the FCRA's identity theft provisions. Amazon did not immediately respond to a request for comment on the settlement. The case highlights the tension between protecting customer data and the legal obligation to assist victims of fraud - a balance that regulators say Amazon failed to strike.

Source: Engadget