On August 14, 2026, the US Department of Justice announced a stipulated order under which Amazon.com, Inc. will pay a $2.25 million civil penalty and accept injunctive relief to resolve allegations that it violated the Fair Credit Reporting Act by failing to provide identity-theft victims, upon verified request, with records of business transactions allegedly resulting from the identity theft.
Section 609(e) of the FCRA requires business entities that provided credit to, or entered into transactions with, an identity thief to give the victim, at no charge and within 30 days of a verified request, application and business-transaction records related to the theft.
The DOJ alleged that Amazon systematically failed to provide such records, hindering victims’ ability to dispute fraudulent activity with credit bureaus and other creditors.
The order requires Amazon to establish and maintain compliant procedures, train personnel, and deliver records within 30 days of verifying identity-theft requests going forward.
The settlement is a clear enforcement signal for online marketplaces, financial-services platforms, and other consumer-facing businesses handling identity-theft complaints, including those serving Brazilian and Portuguese customers.
Source: US Department of Justice