The Federal Trade Commission has hit Amazon with a $2.25 million penalty for allegedly stonewalling customers whose identities were stolen and used to make fraudulent purchases on the platform. The settlement, first reported by Bloomberg, stems from an FTC complaint that Amazon violated the Fair Credit Reporting Act by refusing to hand over records of transactions tied to fake accounts.

The FTC’s filing paints a frustrating picture for victims. One person had to guess the thief’s name over 30 times before Amazon would even discuss removing their credit card from the fraudulent account. Support agents reportedly told victims they couldn’t share purchase records unless the victim knew the identity of the person who opened the account—a catch-22 that the FTC described as a “Kafkaesque sequence.” Under the FCRA, companies must respond to identity theft victims’ requests for records within 30 days; the FTC says Amazon repeatedly failed to meet that deadline.

An Amazon spokesperson told Bloomberg that the company has “resolved this matter with the FTC” and already “implemented process improvements for customers who believe they may be victims of identity theft.” The $2.25 million fine is a relatively small sum for the e-commerce giant, but the case highlights ongoing friction between consumer protection laws and how large platforms handle fraud disputes.

Source: The Verge