Quick Answer: If someone stole your identity and opened a fraudulent account in your name, federal law gives you the right to demand the actual records of that account — the application, the transaction history, everything — directly from the business that opened it. It’s called Section 609(e) of the Fair Credit Reporting Act, and the company has 30 days to hand the records over once you ask properly. On June 30, 2026, the FTC required Amazon to pay $2.25 million — a record penalty for this exact violation — for stonewalling identity-theft victims who asked for those records. Most people have no idea this right even exists. You should.
This isn’t the only Amazon case in the news right now — you may also be able to claim your share of Amazon’s $2.5 billion FTC settlement if you were enrolled in Prime and barely used it. That claim deadline is July 27, 2026.
Expert Context: I’ve been helping people untangle debt and identity theft since 1994, and the single most common thing I hear from fraud victims is “the company won’t tell me anything.” They’re told it’s “private” or a “security” issue. That’s almost always wrong — and now the FTC has put a $2.25 million price tag on a company that said it. The records you need to clear your name aren’t a favor a company can refuse. They’re your legal right.
This week the FTC handed down its largest-ever penalty for a violation almost no consumer has heard of — and the lesson buried inside it is a right you can use today, against any business, not just Amazon.
On June 30, 2026, the Federal Trade Commission announced that Amazon agreed to pay a $2.25 million civil penalty to resolve allegations that it knowingly violated the Fair Credit Reporting Act. According to the FTC’s complaint, when identity-theft victims asked Amazon for the records of fraudulent accounts opened in their names, Amazon’s customer service agents repeatedly told them it couldn’t share those records for “security” or “privacy” reasons. The FTC alleges Amazon had no written policy for handling these requests until early 2025 — after it learned of the FTC’s investigation — and that it even refused records to law enforcement agencies submitting requests on victims’ behalf.
The penalty is the real headline for me, but the right behind it matters more to you. Let me explain what you can actually do with it.
Key Terms Defined
FCRA Section 609(e): A provision of the Fair Credit Reporting Act (15 U.S.C. § 1681g(e)) that requires a business to give an identity-theft victim copies of the application and business transaction records tied to accounts a thief opened or used in the victim’s name.
Business transaction records: The paper trail of the fraud — the account application, statements, charges, shipping addresses, and similar records the company holds. This is the evidence you need to prove the account wasn’t yours.
What Section 609(e) Actually Gives You
Here’s the part the headlines skip. Section 609(e) of the FCRA isn’t about Amazon — it applies to any business that has records of a transaction a thief made in your name. A store, a lender, a phone carrier, a utility, an online retailer. If a criminal opened an account or ran up charges using your identity, you have the right to go to that business and demand the underlying records.
The law requires the business to give you, free of charge and within 30 days of a proper request, copies of the application and business transaction records related to the fraud. That’s spelled out in 15 U.S.C. § 1681g(e). The FTC has its own plain-language guidance for businesses confirming exactly this: they must provide these records to victims and to law enforcement acting on their behalf.
Why does this matter so much? Because the hardest part of recovering from identity theft isn’t knowing you were robbed — it’s proving it. When a collector comes after you for a debt that isn’t yours, “that wasn’t me” means nothing without documentation. Those 609(e) records are the documentation. They show the fraudulent application, the shipping address that isn’t yours, the signature that isn’t yours. That’s what turns “I swear it wasn’t me” into a provable dispute.
The Claim: “We can’t give you those records — it’s a privacy and security issue.”
The Reality: When the account was opened by a thief in your name, federal law says the business must give the records to you, the victim. The FTC alleges Amazon hid behind exactly this “privacy” excuse — and it just cost them $2.25 million. A company telling you no is not the end of the conversation. It may be a violation.
How to Use This Right Yourself
If your identity has been stolen and there’s a fraudulent account out there, here’s how I’d walk a family member through it.
The Daily Money Brief — Free, at 10 AM
Money you may be owed, scams to dodge, and the fine print decoded — the consumer money news that affects your wallet, every weekday.
- Report the theft first at IdentityTheft.gov. The FTC’s IdentityTheft.gov site builds you a free, official FTC Identity Theft Report and a personal recovery plan. You’ll need that report to back up your records request — the law lets businesses ask for proof of identity and proof that you’re a genuine victim before they hand records over.
- Send a written 609(e) request to the business. Write to the company that holds the fraudulent account. State that you are an identity-theft victim, that you are requesting records under Section 609(e) of the Fair Credit Reporting Act, and that you’ve attached your FTC Identity Theft Report and proof of identity. Keep it in writing so the 30-day clock is documented.
- Hold them to the 30 days. The business has 30 days from a proper request to provide the records at no charge. Mark your calendar. If they refuse or stall, that’s not just frustrating — it may be the same conduct the FTC just penalized.
- Use the records to kill the debt. Once you have the application and transaction records, send them with a dispute letter to any collector or credit bureau reporting the fraudulent account. Fraudulent accounts can be blocked from your credit report when you provide an identity-theft report and identify the fraud.
- If a business won’t comply, report it. File a complaint with the CFPB and the FTC. The agencies build cases like the Amazon action from patterns of consumer complaints — your report is how the next $2.25 million penalty gets built.
Why I Want You to Know This
Steve’s Take
In thirty years of this work, I’ve watched identity-theft victims get treated like they’re the suspect. They call the company, they’re bounced between departments, they’re told it’s “private,” and they hang up feeling powerless and ashamed of a crime someone else committed against them. That powerlessness is the part that breaks my heart, because it’s false. You are not the suspect. You are the victim, and the law is on your side. Section 609(e) was written for exactly this moment. The FTC just spent $2.25 million of Amazon’s money reminding everyone that “no” isn’t an answer a company gets to give you. Walk in knowing your rights, and the whole conversation changes.
If a business is refusing to give you records you’re entitled to, file a complaint with the CFPB and your state attorney general. If a debt that isn’t yours has turned into a lawsuit or a collector won’t back off, a consumer attorney can help — NACA maintains a directory of attorneys who handle Fair Credit Reporting Act and debt-collection cases, often at no upfront cost to you.
Key Takeaways
- Section 609(e) of the FCRA gives identity-theft victims the right to the records of fraudulent accounts opened in their name — from any business, within 30 days, free.
- The FTC fined Amazon $2.25 million on June 30, 2026 for refusing those records — a record penalty for this violation.
- “It’s private” or “it’s a security issue” is not a lawful reason to deny you your own fraud records.
- Start at IdentityTheft.gov, then send a written 609(e) request, then use the records to dispute the debt.
The Bottom Line
If you’re reading this because someone stole your name and you feel like you’re fighting a wall that won’t tell you anything — stop feeling like the guilty one. You didn’t do this, and you are not powerless. Federal law hands you a key most people never knew they had: the right to demand the proof of the fraud and use it to clear your name. The FTC just proved that key is real by making a trillion-dollar company pay for ignoring it. You can use the exact same law from your kitchen table, for free. Send this to anyone you know who’s ever said “the company won’t help me” — because now you know they have to.
Frequently Asked Questions
Someone opened an account in my name — can I really force the company to give me the records?
Yes. Section 609(e) of the Fair Credit Reporting Act (15 U.S.C. § 1681g(e)) requires a business to give an identity-theft victim copies of the application and transaction records tied to the fraudulent account, free of charge, within 30 days of a proper request. You’ll need to provide proof of identity and proof that you’re a victim, such as an FTC Identity Theft Report from IdentityTheft.gov.
What records am I actually entitled to under Section 609(e)?
The application used to open the account and the business transaction records related to the fraud — statements, charges, the shipping or billing addresses used, and similar documents the company holds. These are the records that prove the account wasn’t opened or used by you.
The company told me it can’t share the records for privacy or security reasons. Is that legal?
When the account was opened by a thief in your name, that’s generally not a lawful reason to refuse you. The FTC alleged Amazon used exactly that “security/privacy” excuse and required it to pay $2.25 million. If a business denies your proper request, you can file a complaint with the CFPB and the FTC.
How fast does the business have to respond?
Within 30 days of receiving a proper request that includes your proof of identity and proof of victim status. Keep your request in writing so the start of that 30-day window is documented.
How do these records help me get rid of a debt that isn’t mine?
They’re your evidence. Send them with a dispute letter and your identity-theft report to the collector and the credit bureaus. Fraudulent accounts can be blocked from your credit report when you provide an identity-theft report, and the 609(e) records document that the account was never yours.
Dealing With Debt? Understanding your options is the first step. See how all your debt relief options compare — including ones most sites won’t tell you about. The Find Your Path quiz gives a recommendation based on your actual numbers, and the Scam-O-Meter checks any company’s complaint history before you sign. Federal Reserve research shows bankruptcy filers recover faster than those who don’t file.
