Amazon's Kafkaesque Fraud Support Costs It $2.25M in FTC Settlement

Amazon's customer support for identity theft victims was so broken that the FTC just hit the company with a $2.25 million fine for violating the Fair Credit Reporting Act.

The Kafkaesque Loop

The FTC's complaint describes a process they call a "Kafkaesque sequence." Victims who contacted Amazon about fraudulent accounts were told they couldn't get records — including purchase details, IP addresses, and shipping addresses — unless they could name the person who opened the account. If you're the victim, you don't know who stole your identity; that's the whole problem.

In one instance, a victim attempted to provide a police report and other documentation. Amazon still refused to release the records. The result: victims had no way to trace fraudulent purchases or report them to law enforcement.

What the FTC Actually Found

The fine settles claims that Amazon violated the Fair Credit Reporting Act (FCRA) by failing to provide victims with information about purchases made with fraudulently opened accounts. Under FCRA, companies must provide records to identity theft victims upon request. Amazon's policy of requiring the victim to know the fraudster's name before releasing data directly contradicts that requirement.

The $2.25 million penalty is small for a company Amazon's size. But the settlement signals the FTC is watching how Big Tech handles identity theft. The complaint was filed after what Bloomberg reports as a lengthy investigation.

What This Means for Consumer Protection

If you're building customer support pipelines or handling PII, take note: the FCRA doesn't care about your internal verification logic. Amazon's attempt to reduce fraud-prevention overhead by outsourcing the burden to victims is exactly the kind of cost-externalization that regulators punish.

Whether Amazon fixes its internal processes or faces more fines depends on how seriously it takes the FCRA's requirements.

Source: Amazon fined $2.25 million for failing to help identity theft victims
Domain: theverge.com