The Fair Credit Reporting Act (FCRA) spells out rights for victims of identity theft, as well as responsibilities for businesses. Identity theft victims are entitled to ask businesses for a copy of transaction records — such as applications for credit — relating to the theft of their identity.
Indeed, victims can authorize law enforcement officers to get the records or ask that the business send a copy of the records directly to a law enforcement officer. The businesses covered by the law must provide copies of these records, free of charge, within 30 days of receiving the request for them in writing. This means that the law enforcement officials who ask for these records in writing may get them from your business without a subpoena, as long as they have the victim’s authorization.
The Federal Trade Commission (FTC), the nation’s consumer protection agency, enforces the FCRA including this requirement, which is known as Section 609(e). Here is some additional information to help your business comply with this provision of the law:
Q. Who must comply with Section 609(e) of the FCRA?
A. The law applies to a business that has provided credit, goods, or services to, accepted payment from, or otherwise entered into a transaction with someone who is believed to have fraudulently used another person’s identification. For example, if your business opened a cell phone account in the victim’s name or extended credit to someone misusing the victim’s identity, you may be required to provide the records relating to the transaction to the identity theft victim or the law enforcement officer acting on that victim’s behalf.
Q. What documents must my business provide?
A. Your business must provide applications and business transactions records, maintained either by your business or by another entity on your behalf, that support any transaction alleged to be a result of identity theft. Records like invoices, credit applications, or account statements may help victims document the fraudulent transaction and provide useful evidence about the identity thief.
Q. What are the procedures for requesting these materials?
A. Requests for documents must be submitted in writing. Your business may specify an address to receive these requests. You may ask the victim to provide relevant information, like the transaction date or account number, if they know it. You also can require that victims provide:
1. proof of identity, like a government-issued ID card, the same type of information the identity thief used to open the account, or the type of information you are currently requesting from applicants;
2. a police report; and
3. a completed affidavit. Victims can use the FTC’s Identity Theft Report, available at IdentityTheft.gov, or another affidavit you accept.
Q. Is it ever appropriate not to provide documents?
A. You can refuse to provide the records if you determine in good faith that:
- you cannot verify the true identity of the person asking for the information;
- the request for the information is based on a misrepresentation; or
- the information requested is Internet navigational data or similar information about a person’s visit to a website or online service.
Your business may not deny disclosure of these records based on the financial privacy provisions of the Gramm-Leach-Bliley Act (see Subtitle A of Title V of Public Law 106-102). Nevertheless, you may refuse to disclose them if state or another federal law prohibits you from doing so.
Q. Are there recordkeeping requirements of Section 609(e)?
A. Section 609(e) does not require any new recordkeeping procedures for your business.
For More Information
The FTC works for the consumer to prevent fraudulent, deceptive, and unfair business practices in the marketplace and to provide information to help consumers spot, stop, and avoid them. To file a complaint or to get free information on consumer issues, visit ftc.gov or call toll-free, 1-877-FTC-HELP (1-877-382-4357); TTY: 1-866-653-4261. The FTC enters consumer complaints into the Consumer Sentinel Network, a secure online database and investigative tool used by hundreds of civil and criminal law enforcement agencies in the U.S. and abroad.
The Consumer Financial Protection Bureau (CFPB) also enforces this requirement. If you are not subject to the FTC’s jurisdiction, contact the CFPB about your obligations.
Your Opportunity to Comment
The National Small Business Ombudsman and 10 Regional Fairness Boards collect comments from small businesses about federal compliance and enforcement activities. Each year, the Ombudsman evaluates the conduct of these activities and rates each agency's responsiveness to small businesses. Small businesses can comment to the Ombudsman without fear of reprisal. To comment, call toll-free 1-888-REGFAIR (1-888-734-3247) or go to www.sba.gov/ombudsman.