|
§ 605A. Identity theft prevention; fraud alerts and active duty alerts [15 U.S.C. §1681c-1]
(a) One-call Fraud Alerts
(1) Initial alerts. Upon the direct request of a consumer, or an individual acting on
behalf of or as a personal representative of a consumer, who asserts in good faith
a suspicion that the consumer has been or is about to become a victim of fraud or
related crime, including identity theft, a consumer reporting agency described in
section 603(p) that maintains a file on the consumer and has received appropriate
proof of the identity of the requester shall–
(A) include a fraud alert in the file of that consumer, and also provide that alert
along with any credit score generated in using that file, for a period of not
less than 90 days, beginning on the date of such request, unless the
consumer or such representative requests that such fraud alert be removed
before the end of such period, and the agency has received appropriate
proof of the identity of the requester for such purpose; and
July 30, 2004 26
(B) refer the information regarding the fraud alert under this paragraph to each
of the other consumer reporting agencies described in section 603(p), in
accordance with procedures developed under section 621(f).
(2) Access to free reports. In any case in which a consumer reporting agency includes
a fraud alert in the file of a consumer pursuant to this subsection, the consumer
reporting agency shall–
(A) disclose to the consumer that the consumer may request a free copy of the
file of the consumer pursuant to section 612(d); and
(B) provide to the consumer all disclosures required to be made under section
609, without charge to the consumer, not later than 3 business days after
any request described in subparagraph (A).
(b) Extended Alerts
(1) In general. Upon the direct request of a consumer, or an individual acting on
behalf of or as a personal representative of a consumer, who submits an identity
theft report to a consumer reporting agency described in section 603(p) that
maintains a file on the consumer, if the agency has received appropriate proof of
the identity of the requester, the agency shall–
(A) include a fraud alert in the file of that consumer, and also provide that alert
along with any credit score generated in using that file, during the 7-year
period beginning on the date of such request, unless the consumer or such
representative requests that such fraud alert be removed before the end of
such period and the agency has received appropriate proof of the identity
of the requester for such purpose;
(B) during the 5-year period beginning on the date of such request, exclude the
consumer from any list of consumers prepared by the consumer reporting
agency and provided to any third party to offer credit or insurance to the
consumer as part of a transaction that was not initiated by the consumer,
unless the consumer or such representative requests that such exclusion be
rescinded before the end of such period; and
(C) refer the information regarding the extended fraud alert under this paragraph
to each of the other consumer reporting agencies described in section
603(p), in accordance with procedures developed under section 621(f).
(2) Access to free reports. In any case in which a consumer reporting agency includes
a fraud alert in the file of a consumer pursuant to this subsection, the consumer
reporting agency shall–
(A) disclose to the consumer that the consumer may request 2 free copies of
the file of the consumer pursuant to section 612(d) during the 12-month
July 30, 2004 27
period beginning on the date on which the fraud alert was included in the
file; and
(B) provide to the consumer all disclosures required to be made under section
609, without charge to the consumer, not later than 3 business days after
any request described in subparagraph (A).
(c) Active duty alerts. Upon the direct request of an active duty military consumer, or an
individual acting on behalf of or as a personal representative of an active duty
military consumer, a consumer reporting agency described in section 603(p) that
maintains a file on the active duty military consumer and has received appropriate
proof of the identity of the requester shall–
(1) include an active duty alert in the file of that active duty military consumer, and
also provide that alert along with any credit score generated in using that file,
during a period of not less than 12 months, or such longer period as the
Commission shall determine, by regulation, beginning on the date of the request,
unless the active duty military consumer or such representative requests that such
fraud alert be removed before the end of such period, and the agency has received
appropriate proof of the identity of the requester for such purpose;
(2) during the 2-year period beginning on the date of such request, exclude the active
duty military consumer from any list of consumers prepared by the consumer
reporting agency and provided to any third party to offer credit or insurance to the
consumer as part of a transaction that was not initiated by the consumer, unless
the consumer requests that such exclusion be rescinded before the end of such
period; and
(3) refer the information regarding the active duty alert to each of the other consumer
reporting agencies described in section 603(p), in accordance with procedures
developed under section 621(f).
(d) Procedures. Each consumer reporting agency described in section 603(p) shall
establish policies and procedures to comply with this section, including procedures
that inform consumers of the availability of initial, extended, and active duty alerts
and procedures that allow consumers and active duty military consumers to request
initial, extended, or active duty alerts (as applicable) in a simple and easy manner,
including by telephone.
(e) Referrals of alerts. Each consumer reporting agency described in section 603(p) that
receives a referral of a fraud alert or active duty alert from another consumer
reporting agency pursuant to this section shall, as though the agency received the
request from the consumer directly, follow the procedures required under–
(1) paragraphs (1)(A) and (2) of subsection (a), in the case of a referral under
subsection (a)(1)(B);
(2) paragraphs (1)(A), (1)(B), and (2) of subsection (b), in the case of a referral under
subsection (b)(1)(C); and
July 30, 2004 28
(3) paragraphs (1) and (2) of subsection (c), in the case of a referral under subsection
(c)(3).
(f) Duty of reseller to reconvey alert. A reseller shall include in its report any fraud alert
or active duty alert placed in the file of a consumer pursuant to this section by
another consumer reporting agency.
(g) Duty of other consumer reporting agencies to provide contact information. If a
consumer contacts any consumer reporting agency that is not described in section
603(p) to communicate a suspicion that the consumer has been or is about to become
a victim of fraud or related crime, including identity theft, the agency shall provide
information to the consumer on how to contact the Commission and the consumer
reporting agencies described in section 603(p) to obtain more detailed information
and request alerts under this section.
(h) Limitations on Use of Information for Credit Extensions
(1) Requirements for initial and active duty alerts-
(A) Notification. Each initial fraud alert and active duty alert under this section
shall include information that notifies all prospective users of a consumer
report on the consumer to which the alert relates that the consumer does
not authorize the establishment of any new credit plan or extension of
credit, other than under an open-end credit plan (as defined in section
103(i)), in the name of the consumer, or issuance of an additional card on
an existing credit account requested by a consumer, or any increase in
credit limit on an existing credit account requested by a consumer, except
in accordance with subparagraph (B).
(B) Limitation on Users
(i) In general. No prospective user of a consumer report that includes an
initial fraud alert or an active duty alert in accordance with this section
may establish a new credit plan or extension of credit, other than under
an open-end credit plan (as defined in section 103(i)), in the name of
the consumer, or issue an additional card on an existing credit account
requested by a consumer, or grant any increase in credit limit on an
existing credit account requested by a consumer, unless the user
utilizes reasonable policies and procedures to form a reasonable belief
that the user knows the identity of the person making the request.
(ii) Verification. If a consumer requesting the alert has specified a
telephone number to be used for identity verification purposes, before
authorizing any new credit plan or extension described in clause (i) in
the name of such consumer, a user of such consumer report shall
contact the consumer using that telephone number or take reasonable
steps to verify the consumer’s identity and confirm that the application
for a new credit plan is not the result of identity theft.
July 30, 2004 29
(2) Requirements for Extended Alerts
(A) Notification. Each extended alert under this section shall include
information that provides all prospective users of a consumer report
relating to a consumer with–
(i) notification that the consumer does not authorize the establishment of
any new credit plan or extension of credit described in clause (i), other
than under an open-end credit plan (as defined in section 103(i)), in the
name of the consumer, or issuance of an additional card on an existing
credit account requested by a consumer, or any increase in credit limit
on an existing credit account requested by a consumer, except in
accordance with subparagraph (B); and
(ii) a telephone number or other reasonable contact method designated by
the consumer.
(B) Limitation on users. No prospective user of a consumer report or of a
credit score generated using the information in the file of a consumer that
includes an extended fraud alert in accordance with this section may
establish a new credit plan or extension of credit, other than under an
open-end credit plan (as defined in section 103(i)), in the name of the
consumer, or issue an additional card on an existing credit account
requested by a consumer, or any increase in credit limit on an existing
credit account requested by a consumer, unless the user contacts the
consumer in person or using the contact method described in subparagraph
(A)(ii) to confirm that the application for a new credit plan or increase in
credit limit, or request for an additional card is not the result of identity
theft.
|
