When an identity theft victim asks for the deal jacket: what the Amazon case teaches dealers about FCRA 609(e)

In short: When an identity theft victim asks for the deal jacket, what does your store do? Here's what FCRA 609(e) requires.

On June 30, 2026, the FTC announced a $2.25 million civil penalty against Amazon for failing to give identity theft victims records of fraudulent transactions made in their names. The law at issue, Section 609(e) of the Fair Credit Reporting Act (FCRA), is not limited to online retailers. When a car is bought or financed with a stolen identity, the dealership may hold exactly the records a victim needs.

1. What Section 609(e) requires

According to FTC business guidance, identity theft victims can ask a business for copies of application and business transaction records relating to the theft of their identity. Victims can also authorize a law enforcement officer to get the records, or ask the business to send them to an officer. Covered businesses must provide the records free of charge within 30 days of receiving a written request. The FTC says officers with the victim's authorization can get the records without a subpoena.

2. Who it covers

The FTC says the law applies to a business that has provided credit, goods, or services to, accepted payment from, or otherwise entered into a transaction with someone believed to have fraudulently used another person's identification. One of the FTC's examples is a business that extended credit to someone misusing the victim's identity. Ask counsel how this applies to your store's deals.

3. What records are involved

The FTC describes the records as applications and business transaction records, kept by the business or by another entity on its behalf, that support a transaction alleged to be identity theft. Its examples include invoices, credit applications, and account statements.

4. What a business may ask for, and when it may refuse

Per the FTC, a business may set an address for requests, ask for details such as the transaction date or account number, and require proof of identity, a police report, and a completed affidavit (such as the FTC's Identity Theft Report from IdentityTheft.gov). A business may refuse if it determines in good faith that it cannot verify the requester's identity, that the request is based on a misrepresentation, or that the information is internet navigational data. The FTC says a business may not refuse based on the Gramm-Leach-Bliley Act's financial privacy provisions.

5. What went wrong at Amazon, according to the complaint

The FTC alleged Amazon had no written 609(e) policy until early 2025, cited "security" or "privacy" to turn victims away, asked one victim to guess the thief's name, refused authorized law enforcement requests, and sometimes missed the 30-day deadline.

Practical takeaways

1. Put a short written procedure in place for Section 609(e) requests, and name who owns it.
2. Train sales, F&I, and front-desk staff to route these requests to that owner instead of refusing them.
3. Know where the deal jacket, credit application, and related records live, including records held by your DMS or other vendors.
4. Track the 30-day clock from the day a written request arrives.
5. Connect this to your Red Flags identity theft program, so a confirmed fraud deal triggers both your internal response and the records process.

This explainer is general information, not legal advice. Talk to your counsel about your store's practices.

Sources: FTC press release on the Amazon settlement (June 30, 2026); FTC business guidance on Section 609(e).