The Question at Hand
Section 609(e) of the Fair Credit Reporting Act requires you to provide transaction records to identity theft victims within 30 days of their request. While this seems straightforward, these requests are rare and unpredictable, involving multiple systems, teams, and security protocols.
The Federal Trade Commission recently fined Amazon $2.25 million for failing to provide these records, prompting the question: Should you build a Section 609(e) compliance program now, or wait until the volume justifies it?
This isn't theoretical. Amazon had no written policy for Section 609(e) requests until early 2025, after the FTC's investigation began. The company had been advised to review its compliance but didn't act, resulting in the largest penalty for a Section 609(e) violation. Was Amazon's approach unreasonable before enforcement?
The Case for Building It Now
The proactive argument is based on legal obligation, enforcement trends, and reputational risk.
First, Section 609(e) is mandatory. If you provide information to consumer reporting agencies or maintain records that could aid identity theft victims, you're subject to this requirement, regardless of request volume. The FTC's cases against Kohl's and Amazon show enforcement isn't limited to high-volume violators.
Second, operational complexity supports early implementation. You can't improvise a 30-day response when a request arrives. You need documented procedures for verifying identities, locating records, redacting information, and delivering records securely. Amazon's failure to do this led to customer service representatives telling victims they couldn't access records or citing "security reasons" for refusal.
Building this capability lets you test, refine, and integrate it with existing Data Subject Access Request workflows if you're handling General Data Protection Regulation obligations. Both require locating personal data, verifying requesters, and responding within set timeframes.
Third, reputational damage compounds financial penalties. Amazon representatives reportedly told a victim they couldn't share account details unless the victim guessed the identity thief's name. After 30 attempts, the victim gave up. Some consumers even sent copies of the FCRA statute and FTC guidance to Amazon, trying to explain their legal rights. This isn't just a compliance failure; it's a trust failure that affects how victims, law enforcement, and the public view your commitment to consumer protection.
The Case for Waiting
The wait-and-see approach has its logic, especially for resource-constrained teams.
Section 609(e) requests are a small part of the compliance workload. If you're allocating limited resources, you prioritize based on risk likelihood and impact. For many, the chance of receiving a Section 609(e) request is low. Building a program for a hypothetical event competes with urgent needs like SOC 2 Type II preparation, HIPAA Security Rule gaps, or NIST Cybersecurity Framework (CSF) 2.0 alignment.
The operational investment is significant. You need coordination between customer service, legal, IT, and security teams. You must document where transaction data is stored, how to retrieve it, what redaction standards apply, and how to verify identity theft claims. You need training materials, escalation procedures, and quality controls. For an event that may never occur, this is a tough sell to executives focused on quarterly priorities.
There's also a practical question about enforcement patterns. Before 2020, Section 609(e) enforcement was nearly nonexistent. The FTC brought its first case that year, with a second five years later. If you're making risk-based decisions, two enforcement actions across the market might not trigger immediate action, especially if your company has lower identity theft exposure than retail.
Some compliance officers argue that reactive compliance, while imperfect, is pragmatic. If you receive a Section 609(e) request, you respond to that case, document what you learned, and build the process incrementally. You avoid over-engineering for scenarios that don't materialize.
Where Practitioners Actually Land
Most organizations fall into one of three categories.
Large consumer-facing companies with significant fraud exposure are building Section 609(e) capabilities now, often as part of broader consumer rights programs. They're integrating it with existing request management systems and treating it as an extension of their privacy operations.
Mid-market companies are taking a hybrid approach: documenting a basic response procedure and identifying data sources, but not investing in automation or extensive training until they see request volume. They're essentially building the minimum viable process.
Smaller organizations and B2B companies with minimal consumer reporting activity are waiting. They've noted the requirement but are betting that their risk profile doesn't justify immediate action.
Our Take
Build the basic framework now, even if you don't automate it.
Here's why: the 30-day response window starts when the victim makes the request, not when you're ready. If you're scrambling to figure out where transaction records are, how to verify the requester, and what legal review is needed, you'll miss the deadline. Amazon's complaint noted that even when records were eventually provided, they often missed the 30-day requirement.
You don't need a sophisticated system. You need a documented procedure that answers these questions:
- Who receives Section 609(e) requests, and how are they routed internally?
- What verification steps are required before releasing records?
- Which systems contain the transaction data needed?
- What redaction or privacy review applies before release?
- How do you track the 30-day deadline?
This isn't a six-month project. It's a cross-functional working session, a written procedure, and a training brief for your customer service team. The cost is measured in days, not months.
The alternative is what Amazon experienced: customer service representatives unaware of the law, victims told to guess the thief's identity, and law enforcement requests refused. That's not a compliance gap; it's an organizational failure that no penalty can fully repair.
If you're subject to Section 609(e), you're legally obligated to comply, whether it's convenient or not. The question isn't whether to build the capability. It's whether you build it before or after the FTC asks why you didn't.
