Somebody uses a stolen credit card at your store. The cardholder figures it out, files a police report, and sends you a written request: please send me copies of the transaction records from the fraudulent purchase. You have 30 days to hand them over, free of charge. Not 30 business days. Not 30 days after your lawyer feels like it. Thirty days from receipt, by federal law — and "privacy reasons" is not an excuse, because the statute says so explicitly.
That is the rule Amazon violated so thoroughly that the Federal Trade Commission secured a $2.25 million civil penalty against the company in June 2026, the largest penalty ever under that provision. And the provision applies to your business exactly the way it applied to Amazon. If you sell goods or services for consideration — which is to say, if you run a business — Section 609(e) of the Fair Credit Reporting Act already names you.
What Amazon actually did wrong
First, a correction worth making, because several summaries of this case got it wrong: the fine had nothing to do with employment background checks or credit screening. Amazon was penalized under FCRA Section 609(e), the part of the law that gives identity theft victims the right to obtain the application and business transaction records behind fraud committed in their names.
According to the complaint the Department of Justice filed on the FTC's behalf in federal court in Washington, D.C., Amazon "knowingly" violated the law. Consumers who contacted the company about fraud on their accounts or payment cards were told by customer service agents that the records could not be provided for "security" or "privacy" reasons. In what the FTC's Bureau of Consumer Protection director called a "Kafkaesque ordeal," Amazon demanded that victims identify the thief who stole their information before it would release records — in one instance telling a consumer it could not share records about a fraudulent account unless the consumer guessed the name on the account, the name used by the identity thief. The consumer tried 30 times and failed. Amazon also denied records to law enforcement agencies investigating the fraud.
Two details from the case should concentrate the mind of any small-business owner. First, FTC staff had warned Amazon's lawyers back in June 2023 to review compliance with this exact provision after receiving a consumer complaint. The violations continued. Second, Amazon had no written procedure for handling these requests at all until early 2025 — after it learned the FTC had opened an investigation. The absence of a process was not a defense; it was part of the story. As part of the settlement, Amazon must post a public notice on its website explaining how identity theft victims can request records.
With more than 1.1 million identity theft reports filed with the FTC in 2024, and 2025 on pace to run higher, a victim's request landing in your inbox is a matter of when, not if. Here is what the law requires of you when it does.
The 30-day rule every business should know
Section 609(e) is short and strikingly plain for a federal statute:
Who is covered. Any business entity that extended credit to, sold goods or services to, accepted payment from, or otherwise entered into a commercial transaction for consideration with someone who allegedly used another person's identity without authorization. Note "allegedly": you do not get to adjudicate whether identity theft really happened before complying. A victim's claim, backed by the documentation described below, triggers your duty.
What you must provide. A copy of the application and business transaction records in your control that evidence the allegedly fraudulent transaction — whether you maintain those records yourself or someone else maintains them on your behalf. Think order records, account applications, invoices, receipts, payment authorizations, shipping addresses tied to the transaction. The law expressly includes records held by another person on your behalf, which in modern practice means the records sitting in your payment processor, ecommerce platform, or point-of-sale system count as yours for this purpose.
Who can receive them. The victim, any federal, state, or local law enforcement agency or officer the victim names in the request, or a law enforcement agency investigating the theft that the victim authorized to receive the records. Amazon's refusal to share with law enforcement was its own separate violation.
The deadline. Not later than 30 days after you receive the request.
The price. Nothing. The statute says the records "shall be so provided without charge."
The form of the request. It must be in writing, mailed to an address you specify if you have specified one — one more reason to designate a contact point now rather than after a request arrives. If you ask, the victim must include relevant information about the transaction to help you find it: the date, an account or transaction number, or other identifying details, but only if known by the victim or readily obtainable. Read that limitation carefully: "if known" is doing real work. You may ask for help locating the records. You may not make the victim's ability to supply details a precondition, and you certainly may not demand they name the thief, as Amazon did.
What the victim has to show you
The law does not leave your door wide open. Before you hand over anything, the victim must supply two things, in the form you elect:
-
Proof of identity. At your choice: a government-issued ID card, personally identifying information of the same type the unauthorized person gave you, or the kind of identifying information you typically request from new applicants or for new transactions.
-
Proof of the identity theft claim. At your choice: a copy of a police report evidencing the claim plus a properly completed standardized identity theft affidavit — the kind generated through the FTC's IdentityTheft.gov process — or another affidavit of fact you find acceptable.
The one exception: if you already have a high degree of confidence you know who the victim is, you may skip verification. In practice, ask for the standard packet every time and keep a copy of what was received alongside the request itself. A consistent checklist protects both ways: it keeps you from disclosing to an impostor, and documents that every requester got the same treatment.
The excuses that don't work
Amazon's case is useful precisely because it demonstrates, at a cost of $2.25 million, which refusals fail:
"Privacy and security prevent us from sharing." The statute anticipates this objection and overrules it in advance: financial-privacy provisions that normally restrict disclosing customer information to third parties cannot be used to deny disclosure to the victim. Congress decided, back in 2003, that the victim's right to see records about fraud committed in their name outweighs the business's privacy instincts. Train anyone who answers customer email or phone calls on this point specifically, because "I can't share account details for privacy reasons" is otherwise exactly the right reflex.
"Tell us who stole your identity first." The victim is, almost by definition, the person who does not know who stole their identity. Conditioning disclosure on identifying the thief converts a 30-day duty into an impossible one, which is why regulators described it the way they did.
"We need more time." Thirty days from receipt is the deadline. Chargebacks, processor disputes, and internal fraud reviews run on their own clocks; none of them pauses this one.
"There's a records fee." The copies are free. No research fee, no copying fee, no administrative charge.
"Our processor holds those records, not us." Records maintained by another person on your behalf are explicitly covered. If your transaction data lives in Stripe, Square, Shopify, or your bank's merchant portal, retrieving it is your job.
When you are allowed to say no
The law is not absolute, and knowing the boundaries matters as much as knowing the duty. A business may decline, in good faith, where the provision does not actually require disclosure, where the requester's identity still leaves the business without a high degree of confidence after reviewing the verification materials, where the request rests on a misrepresentation of fact, or where the requested material is internet navigational data — browsing history about someone's visit to a website or online service — rather than transaction records.
There is also an affirmative defense written into the statute: if it comes to an enforcement action, you can defeat the claim by showing you made a reasonably diligent search of your available business records and the requested records do not exist or are not reasonably available. Notice what that defense rewards: a genuine search, documented. "We never looked" and "we have no process for looking" are its opposite.
Two shields protect businesses that comply in good faith. First, no business can be held civilly liable under any law for a good-faith disclosure under this provision — so the privacy worry runs in exactly the wrong direction. Complying is protected; refusing is penalized. Second, the provision creates no new recordkeeping obligation: it does not require you to obtain, retain, or maintain records you would not otherwise keep in the ordinary course of business or under other law. It only governs records you already have.
Build your process before a request arrives
Amazon's most transferable lesson is the cheapest one: write the procedure down now. A one-page process beats a $2.25 million improvisation. Yours should cover, at minimum:
- A designated address and owner. Publish where written requests go — a mailing address or a monitored inbox — and name the person responsible for handling them. The statute lets you specify the address requests must be mailed to, but only if you have actually specified one.
- A verification packet. Government-issued photo ID, a police report, and a completed identity theft affidavit, requested the same way every time.
- A 30-day clock. Log the date each request arrives and diary the deadline. Calendar days, not business days.
- A retrieval map. Write down, system by system, where your transaction records live: processor dashboard, ecommerce backend, POS export, accounting file. The retrieval map is what turns a panicked scramble into a ten-minute task.
- A response log. What was requested, what was verified, what was sent, when, and to whom. If a regulator ever asks, this log is your evidence of reasonable diligence.
- A no-conditions rule. No fees, no demand that the victim identify the thief, no "privacy" refusal to the verified victim or their designated law enforcement.
Review the page once a year, the way you review your backup routine. Identity theft volumes keep climbing, and the FTC has now shown it will take a 609(e) case all the way to a record penalty.
Your books are your compliance file
Here is the part that touches your bookkeeping directly: the retrieval map above is only as good as your underlying records. A 609(e) request asks you to produce every record evidencing a specific transaction — which means your transaction data must be searchable by order, account, customer, and date, months after the fact. Businesses whose books are a shoebox of processor payouts with no link back to individual orders cannot answer in 30 days no matter how willing they are.
This is one of the quiet arguments for keeping your own ledger rather than treating the processor dashboard as your books. When each sale is recorded with its order identifier and channel as metadata, pulling the full record of a disputed transaction is a single query instead of an excavation. In Beancount, transaction metadata does exactly this job:
2026-01-02 open Assets:Checking:Operating USD
2026-01-02 open Income:Sales:Online USD
2026-01-02 open Expenses:Chargebacks:Fraud USD
2026-03-14 * "Online order #48210" "Card payment - J. Rivera"
order-id: "48210"
channel: "online-store"
Assets:Checking:Operating 189.99 USD
Income:Sales:Online -189.99 USD
2026-03-20 * "Chargeback - order #48210" "Issuer fraud dispute"
order-id: "48210"
Assets:Checking:Operating -189.99 USD
Expenses:Chargebacks:Fraud 189.99 USDWith the order identifier on both the sale and the later chargeback, one query surfaces the complete paper trail — the sale, the reversal, the dates, the amounts — in seconds. That is the shape a 609(e)-ready record takes: every transaction traceable to its source document, every reversal linked to its original. If your current books cannot do that, the fix is a bookkeeping project with a compliance payoff, not the other way around. Readers who want the mechanics can find query documentation under /docs/.
A different FCRA duty: employment background checks
Because this case is so often misdescribed, a brief clarification for employers who run background or credit checks on job applicants: that is a real FCRA duty, but it lives in a different part of the law and works nothing like Section 609(e). Under the FTC and EEOC's joint employer guidance, before you obtain a report from a company in the business of compiling background information, you must give the applicant a clear written disclosure — in a standalone document — that a report may be obtained, and get written authorization. If you then take an adverse action based on the report, such as not hiring the applicant, you must first provide a pre-adverse-action notice with a copy of the report and a summary of FCRA rights, wait a reasonable period, and then send a final adverse-action notice with the reporting company's contact details and a statement of the applicant's dispute rights.
Two duties, one statute, opposite directions: Section 609(e) is about records you give out to fraud victims; the employment provisions are about reports you take in about applicants. Do not satisfy one by citing the other.
Mistakes to avoid
- Treating a victim's request as a customer complaint. It is a federal-law request with a 30-day clock, not a support ticket. Route it to the designated owner the day it arrives.
- Letting frontline staff freelance the answer. "We can't share that for privacy reasons" is the natural response and the unlawful one. Give staff a script: acknowledge, request the verification packet, log the date.
- Searching only your own systems. Processor, platform, and POS records held on your behalf are covered. Your retrieval map must include them.
- Sitting on law enforcement requests. A victim-designated or victim-authorized agency stands in the victim's shoes. Refusing them is refusing the victim.
- Assuming small businesses are exempt. Nothing in Section 609(e) turns on company size. The corner shop that takes cards owes the same duty as the trillion-dollar retailer — which, this time, is the party that paid to demonstrate it.
Your last useful step is a small one: open a blank page, write the six bullet points from the process section with your business's actual names and addresses filled in, and save it where you will find it when the envelope arrives. Thirty days starts on receipt, and the businesses that struggle are never the ones that prepared.
