Amazon has agreed to pay $2.25 million in civil penalties to settle a case with the US Federal Trade Commission regarding victims of identity theft. The regulator said the tech giant violated the Fair Credit Reporting Act when it refused to provide those victims, and, in some cases, law enforcement agencies, with transaction records from its online retail business. We reached out to Amazon for comment on the settlement, and will update this article if we hear back.

The FCRA requires companies to provide people whose identities have been stolen with records about fraudulent transactions made in their names within 30 days of a consumer’s request. The FTC complaint claimed that Amazon customer service reps denied some of those customer requests on the basis of security or privacy concerns, while in other cases agents from the company allegedly told victims that they were not able to access the necessary records. In some instances where Amazon provided the information, it occurred outside that 30-day window.