The Commission added that Kohl’s failed to respond to victims on several occasions—even to issue a denial of their request—within 30 days. Victims repeatedly complained to the company about its inaction and even sent a copy of the language of the FCRA FCRA Section (609)(e) and the FTC business guidance regarding the matter. Their efforts did not encourage the retailer to change its policy.
The FTC alleged that “Kohl’s knowingly engaged in its unlawful acts and practices for more than two years (February 2017 through March 2019), Kohl’s continued its unlawful acts or practices despite knowledge of numerous complaints from victims of identity theft.”
The company “only stopped its unlawful conduct six months after it received a Civil Investigative Demand from the FTC.”
Kohl’s agrees to pay a civil penalty of $220,000
To resolve the allegations of the FTC, Kohl’s agreed to pay a penalty of $220,000 and to provide identity thief victims with access to business transactions related to the theft within 30 days.
