Winter 2004-09 New federal law to combat identity theft

newsletter header


Number 54
Winter 2004
Fair and Accurate Credit Transactions Act of 2003

New federal law to combat identity theft

On December 4, 2003, President Bush signed into law the Fair and Accurate Credit Transactions Act of 2003. Identity theft is one of the areas dealt with in this new law.

The law defines "identity theft" as "a fraud committed using the identifying information of another person." A person who has been, or believes having been, the victim of identity theft will have the right to give to consumer reporting agencies what the law calls a "fraud alert." Fraud alerts in turn may take the form of an "initial alert" or an "extended alert."

Initial alerts

Through an initial alert a consumer notifies the agency of the good faith suspicion that he or she has been, or is about to become, a victim of fraud or related crimes, including identity theft. The agency must then include the fraud alert in the file of that consumer, and provide the information to lenders, credit card issuers and other users of credit reports, along with any credit score generated using that file. The duration of an initial alert is 90 days. The reporting agency who receives it must also refer the alert to each other consumer reporting agencies, and disclose to the consumer that he or she may request a free copy of the file.

Extended alerts

A consumer may also submit to the agency an "identity theft report," which is a copy of an official report filed by the consumer with a federal or local law enforcement agency. In that case, the duration of notice on file extends to seven years.

Active duty alerts

An "active duty alert" may be used by military personnel in active service away from his or her usual station to notify such condition to consumer reporting agencies. Active duty alerts are to be treated like initial alerts, but their duration is one year, unless the condition ceases ahead of time.

New credit

Lenders and credit card issuers who receive a consumer credit report containing either an initial alert an extended alert, or an active duty alert must refrain from authorizing new credit, extending existing credit, increasing the credit limit, issuing a credit card, or issuing an additional credit card, to that consumer, except as follows:

The lender or credit card issuer may continue to extend credit under an existing open-end credit plan and within the credit limit of the existing plan.

The lender or card issuer may otherwise extend new credit if it utilizes reasonable policies and procedures to verify the identity of the person applying therefor.

In the case of an extended alert, the lender or card issuer must contact the customer in person or by way of a telephone number previously specified by the customer to be used for identity verification purposes, in order to confirm his or her identity.

No collection or transfer of credit

A consumer reporting agency must block the reporting of any information on file that the consumer identifies as resulting from an alleged identity theft. The consumer must support the claim with proof of his or her identity, a copy of the identity theft report and a statement that the information does not relate to any valid transaction by him or her. The agency must promptly notify the furnisher of the information. A creditor who receives such notice may not attempt to collect the credit, nor sell or otherwise transfer it.

Obligation to produce documents

A victim of identity theft may require copies of the credit application, other loan documents and other records from a lender who extended credit to an alleged identity thief. The copies must be produced within 30 days from the request. Government law enforcement agencies may also require the copies. Before the lender may comply with the request for copies, it must verify the identity of the alleged victim, who must also present proof of his or her identity theft claim. Identity may be verified by requiring a government-issued identification card or some other information of the same type as provided by the identity thief. Proof of the identity theft claim may take the form of a copy of the police report or an affidavit.

The copies must be produced without charge.

No business entity may be held civilly liable for good faith disclosures to comply with these requirements.

Protection of medical information

A consumer reporting agency may not furnish a report containing medical information about a consumer, unless:

if furnished in connection with an insurance transaction, the consumer affirmatively consents to the furnishing of the information; or

if furnished in connection with a credit transaction or for employment purposes-

the information is relevant to process or effect the credit or employment transaction, and

the consumer provides specific written consent to the furnishing of the information; or

the information pertains solely to transactions relating to debts arising from the receipt of medical services or products.

A creditor may not obtain or use medical information in connection with a determination of eligibility for credit, except as may be permitted by the regulations to be promulgated by the federal supervisory agencies.

Sharing information with affiliates

Customer Information received from an affiliate may not be used for business solicitation or other marketing purposes, unless:

it is clearly and conspicuously disclosed to the consumer that the information may be communicated to affiliates for such purposes; and

the consumer is provided with the opportunity and a simple method to prohibit such use.

Truncation of card numbers

A person that accepts credit or debit cards may print neither more than the last five digits of the card number nor its expiration date, if receipts are electronically printed. The prohibition does not apply if the sole means available to record the account number is by handwriting, or by an imprint or copy of the card.

Consumer rights

The federal supervisory agencies are to prepare a model summary of the rights of consumers with respect to the procedures for remedying the effects of fraud or identity theft. Said notice must be provided by consumer reporting agencies to persons who express a belief that he or she is a victim of fraud or identity theft.

Negative information

Any financial institution that in the ordinary course of business furnishes information to a consumer reporting agency must provide written notice to its customer whenever it furnishes negative information. This notice must be given not later than 30 days thereafter, and may be included on or with any notice of default, billing statement or any other written material provided to the customer. The notice need be provided only once, and need not be repeated in the event that the financial institution submits additional negative information to the agency.

Less favorable terms

If consumer credit is extended in terms that are materially less favorable than those available to a substantial proportion of other customers, because of information in a consumer credit report, then the customer must be given oral, written or electronic notice of the following:

that the terms offered are based on information from a consumer report;

the identity of the consumer reporting agency;

that the customer may obtain a copy of the report from the agency, without charge; and

the contact information specified by the consumer reporting agency for obtaining the report.

The notice must be given at the time of communication of the approval of the application. This notice is not necessary if the lender provided, or will provide, a Notice of Adverse Action pursuant to section 615(a) of the Fair Credit Reporting Act.

Mortgage loans

(A) An entity that makes mortgage loans and uses a consumer credit score in connection with an application, must provide the following notice to the customer as soon as reasonably practicable:

"Notice to the Home Loan Applicant

"In connection with your application for a home loan, the lender must disclose to you the score that a consumer reporting agency distributed to users and the lender used in connection with your home loan, and the key factors affecting your credit scores.

"The credit score is a computer generated summary calculated at the time of the request and based on information that a consumer reporting agency or lender has on file. The scores are based on data about your credit history and payment patterns. Credit scores are important because they re used to assist the lender in determining whether you will obtain a loan. They may also be used to determine what interest rate you may be offered on the mortgage. Credit scores can change over time, depending on your conduct, how your credit history and payment patterns change, and how credit scoring technologies change.

"Because the score is based on information in your credit history, it is very important that you review the credit-related information that is being furnished to make sure it is accurate. Credit records may vary from one company to another.

"If you have any questions about your credit score or the credit information that is furnished to you, contact the consumer reporting agency at the address and telephone number provided with this notice, or contact the lender, if the lender developed or generated the credit score. The consumer reporting agency plays not part in the decision to take any action on the loan application and is unable to provide you with specific reasons for the decision on a loan application.

"If you have questions concerning the terms of the loan, contact the lender."

(B) In addition, the customer must receive a copy of the credit score information obtained from the consumer reporting agency or developed by the lender, to wit:

the current credit score of the consumer, or the most recent one previously calculated;

the range of possible credit scores under the model used;

all key factors (up to four) that adversely affected the credit score of the consumer in the model used;

the date on which the credit score was created; and

the name of the entity that provided the credit score.

Effective dates

The different provisions in this law will become effective on the dates to be prescribed in regulations to be promulgated jointly by the federal supervisory agencies. These regulations must be promulgated not later than February 2, 2004, and the effective dates therein may not be later than ten months after the date of their promulgation in final form.


© 2004 Goldman Antonetti