Fair Credit Reporting Act · 2020. 4. 15. · Fair Credit Reporting Act Consumer Loan Compliance: Section 2 6 • The creditor may not include the notice in the Truth in Lending disclosures

Fair Credit Reporting Act


Consumer Loan Compliance: Section 2

1

Introduction • The Fair and Accurate Credit Transactions Act (“FACTA”) greatly amended the Fair

Credit Reporting Act (FCRA).

• Partially implemented by regulation found at 12 CFR 1022 (Regulation V)

Purpose and Scope • The FCRA was enacted by Congress to serve the following principal purposes:

o To regulate the consumer-reporting industry, and to ensure the issuers of consumer

reports provide information that is fair and equitable to consumers, and fair and

accurate to report users.

o To prohibit consumer-reporting agencies (CRAs) from taking actions that are unfair

or that adversely affect a consumer’s credit and ability to obtain credit.

o To restrict the availability and use of consumer reports.

• The FCRA’s rules apply to all reports issued with respect to members, regardless of

whether a report is issued in connection with a consumer loan, a business loan, or for any

other purpose (such as an application for any account, debit card or other services).

Definitions

Consumer • A consumer is an individual.

• Information a consumer reporting agency (CRA) communicates that bears on the

creditworthiness of a consumer is subject to the rules of the FCRA.

Consumer Report A consumer report consists of the following:

• Any oral, written, or other communication of information by a CRA.

• The information communicated must bear on a consumer’s creditworthiness, credit

standing, credit capacity, character, general reputation, personal characteristics, or mode

of living.

• The information must be used (or be expected to be used or collected, in whole or in part)

to serve as a factor in establishing a consumer’s eligibility for any of the purposes

permitted under the FCRA.



2

Consumer-Reporting Agency A consumer reporting agency is any person who, for monetary fees, dues, or on a cooperative

nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating

consumer credit information or other consumer information for the purpose of furnishing

consumer reports to third parties and uses any means of interstate commerce for the purpose of

preparing or furnishing consumer reports.

Permissible Purposes for Requesting Consumer Reports Permissible uses of consumer reports permitted by FCRA include:

• Determining an applicant’s eligibility for credit or insurance, or to open a deposit

account, or in connection with a review or collection of a consumer’s account.

• In response to a court order.

• Prescreening a list of members to solicit for credit services.

• Use in accordance with written instructions of the consumer to whom the report relates.

FCRA and Marketing

Question: Is it true that the FCRA doesn't permit credit unions to use credit reports pulled for

account eligibility or review purposes for cross-selling purposes?

Answer: This is generally true, with one limited exception.

Credit reports can only be obtained if the user has a "permissible purpose" as defined in Section

604 of the Fair Credit Reporting Act (see above), and a credit report cannot be obtained for a

permissible purpose (for example, in connection with a loan application, or in connection with

the review of an account) and then used for an impermissible one (cross-selling additional

products and services).

If a credit union wants to use a credit report (pulled for account eligibility or review purposes) to

cross sell other products, the credit union must get a consumer’s written consent to do so.

An Analysis from the FTC regarding the Fair Credit Reporting Act (the FTC has oversight

authority for the law) goes in to detail about what type of written authorization from the

consumer is required:

1. CONSUMER INSTRUCTION

A consumer’s written consent qualifies as an “instruction” that provides a permissible

purpose under this section if it clearly authorizes the issuance of a consumer report on

that consumer. For example, a consumer’s clear and specific written statement that “I

authorize you to procure a consumer report on me” provides a permissible purpose

under this section. However, the consumer’s signature on a form that includes the



3

statement “I understand that where appropriate, credit bureau reports may be obtained”

is not a sufficiently specific instruction from the consumer to authorize a CRA to provide

a consumer report. This language is more in the nature of a notification that a consumer

report might be procured, as opposed to a grant of permission to obtain the consumer

report.

2. WRITTEN AUTHORIZATION

A consumer may transmit “written” authorization electronically or by facsimile, in

addition to regular mail or in person. The Electronic Signatures in Global and National

Commerce Act (“ESIGN”) (15 U.S.C. §§7001 et seq., Public Law 106-229; June 30,

2000) provides that a consumer’s consent is not invalid merely because it is

communicated in electronic form. A consumer’s “electronic signature” may be an

acceptable method of providing “written instructions” under the FCRA. To be valid

under the ESIGN Act, electronic authorization must be in a form that can be retained and

retrieved in a perceivable form. Whether an e-mail, a mouse click “yes,” or other

electronic means clearly conveys the consumer’s instructions depends on the specific

facts.

Adverse Action Disclosure • Disclosure is required when a creditor denies or increases the cost of a consumer’s credit

or deposit account based on third-party information.

• The FCRA notice may be combined with the ECOA notice (Model Notice in Appendix C

of Reg B)

Credit Bureau Information If information related to an adverse credit decision came from a credit bureau, the creditor must

disclose certain items to the applicant.

FCRA Credit Bureau Adverse Action Content

• That information from a credit bureau was used in the credit decision.

• The name, address and telephone number (toll-free if a nationwide bureau) of the

credit bureau used.

• A statement that the credit bureau did not make the decision to take the adverse

action.

• Notice of the consumer’s right to get a free copy of his credit report from the bureau

upon written request, within 60 days.

• Notice of the consumer’s right to dispute with the bureau the accuracy or

https://www.consumerfinance.gov/policy-compliance/rulemaking/regulations/1002/C/#6017c5a585dacb534b0da5b3299e10bb1275750001d282c284413b14

https://www.consumerfinance.gov/policy-compliance/rulemaking/regulations/1002/C/#6017c5a585dacb534b0da5b3299e10bb1275750001d282c284413b14



4

completeness of any information contained in his report.

Credit Score Information Creditors must also disclose credit scores and related information to consumers in risk-based

pricing and adverse action notices under the FCRA if a credit score was used in setting the

credit terms or taking adverse action.

FCRA Credit Score Disclosure Content

• A statement that a credit score takes into account information in a consumer report

and a credit score can change over time

• The specific numerical credit score used in making the credit decision

• The range of possible scores

• Key factors that adversely affected the credit score such as late payments and high

credit utilization

• The date on which the credit score was created

• The name of the entity that provided the credit score.

Information From Outside Sources • If information related to an adverse credit decision was obtained from an outside source

other than a credit bureau, the creditor must either disclose the nature of the information

or the consumer’s right to obtain the nature of the information, if a written request is filed

within 60 days of the adverse action notice.

• The creditor may, but need not, disclose the source of the information.

Information From a Creditor’s Own Internal Records If the credit union uses information from its own experience with the consumer, there are no

disclosure obligations.

Reporting Third Party Information to Others • Under the FCRA, a creditor may report its own transactions and experiences with a

consumer to both consumer-reporting agencies and other creditors.

• If the creditor reports to others about information it gathers from sources other than

through its own experience, it can become a consumer-reporting agency.



5

Negative Information Reporting Notice Creditors are required to provide this notice if:

• They extend credit regularly and in the ordinary course of business furnish information to

a nationwide consumer reporting agency, and

• They furnish negative information to such an agency regarding credit extended to that

consumer.

Format The institution must provide a “clear and conspicuous” notice about furnishing negative

information, in writing, to the consumer.

Model Notice • The CFPB’s Regulation V, Appendix B contains a model notice that may be used by all

financial institutions.

• Creditors are not required to use the model notices.

• Creditors that use the CFPB’s model notices are deemed to be in compliance with

FCRA’s notice requirement relating to furnishing negative information to credit bureaus.

When Notice Is Provided Model Notice to Use

Before reporting negative

information to a credit

bureau.

“We may report information about your account to credit

bureaus. Late payments, missed payments, or other defaults on

your account may be reflected in your credit report.”

After reporting negative

information to a credit

bureau.

“We have told a credit bureau about a late payment, missed

payment or other default on your account. This information may

be reflected in your credit report.”

Timing • The notice must be provided prior to, or no later than, 30 days after furnishing the

negative information to the CRA.

Delivery • Negative information means a consumer’s delinquencies, late payments, insolvency or

any form of default.

• The creditor need not provide the notice each time the consumer is late with a payment

on the same loan account.

• The creditor generally may provide the notice about furnishing negative information on

or with any notice of default, any billing statement, or any other materials provided to the

consumer, as long as the notice is “clear and conspicuous.”

https://www.consumerfinance.gov/policy-compliance/rulemaking/regulations/1022/B/#4



6

• The creditor may not include the notice in the Truth in Lending disclosures provided

under the Truth in Lending Act.

Notice to Home Loan Applicants • If a creditor uses credit scores in connection with mortgage loan applications, they must

provide a Notice to Home Loan Applicants disclosure.

• Mortgage loan applications include purchase money mortgages, refinanced loans, home

equity loans, second mortgages, and home equity lines of credit secured by 1 to 4 units of

residential real property.

Timing • The notice and score disclosure must be provided as soon as “reasonably practical.”

• The notice is required whether or not the loan is approved.

• For privacy purposes, each applicant should receive a separate notice.

Required Contents Notice to Home Loan Applicants Disclosure Contents

• The “Notice to Home Loan Applicants”

• The credit score(s) used in connection with the application

• Key factors that make up the credit score(s)

Model Language Notice to home loan Applicants

In connection with your application for a home loan, the lender must disclose to you the score

that a consumer-reporting agency distributed to users and the lender used in connection with

your home loan, and the key factors affecting your credit scores.

The credit score is a computer-generated summary calculated at the time of the request and based

on information that a consumer reporting agency or lender has on file. The scores are based on

data about your credit history and payment patterns. Credit scores are important because they are

used to assist the lender in determining whether you will obtain a loan. They may also be used to

determine what interest rate you may be offered on the mortgage. Credit scores can change over

time, depending on your conduct, how your credit history and payment patterns change, and how

credit-scoring technologies change.

Because the score is based on information in your credit history, it is very important that you



7

review the credit-related information that is being furnished to make sure it is accurate. Credit

records may vary from one company to another.

If you have questions about your credit score or the credit information that is furnished to you,

contact the consumer reporting agency at the address and telephone number provided with this

notice, or contact the lender, if the lender developed or generated the credit score.

The consumer-reporting agency plays no part in the decision to take any action on the loan

application and is unable to provide you with specific reasons for the decision on a loan

application.

If you have questions concerning the terms of the loan, contact the lender.

Risk-based Pricing Notice Creditors are required to provide a risk-based pricing notice when:

• The creditor uses a consumer report in connection with a consumer’s credit application or

extension; and

• Based at least in part on that report, the creditor grants or extends credit to the consumer

on “material terms” (e.g., annual percentage rate or APR) that are “materially less

favorable” (higher cost for credit) than the most favorable terms available to a substantial

portion of the creditor’s borrowers.

Coverage • The regulation applies to consumer credit (primarily for personal, family, or household

purposes), and only the original creditor is responsible for providing the notice (i.e., the

creditor to whom the obligation is initially payable).

• The rule does not apply to lease transactions.

Model Forms • Regulation V, Appendix H includes model forms that creditors may use to comply with

these notice requirements.

• Creditors may make changes to these forms as long as the substance, clarity, and

sequence of the notice are not changed.

Methods For Determining Who Receives a Notice • There are several methods for determining which consumers must receive risk-based

pricing notices.

https://www.consumerfinance.gov/policy-compliance/rulemaking/regulations/1022/H/#43fb1a3e43168606406a2510abc5821736081ab30939d64c9b23397c



8

• A creditor must use the same method to evaluate all consumers receiving a specific type

of credit (e.g., auto loans, mortgages, etc.), but may vary the methods among different

products.

• Risk- based pricing notices may only be given to consumers who receive materially less

favorable terms, and not to all consumers who apply for credit.

Method 1 — Consumer-to-Consumer Comparison

• A direct consumer-to-consumer comparison involves comparing each consumer to an

adequate sample of consumers who are offered a specific type of credit.

• The group of consumers given less favorable terms based on credit report information

receive the notice.

Method 2 — Credit Score Proxy Method Creditors that use credit scores to set material terms may comply with the risk-based notice

requirements by:

• Determining the credit score that represents the point at which approximately 40 percent

its borrowers have higher scores and approximately 60 percent of its borrowers have

lower scores

• Providing a risk-based pricing notice to borrowers with a score below this cutoff.

Method 3 — Tiered Pricing Method

• A creditor may place a borrower within one of a discrete number of pricing tiers based on

a consumer report.

• The only factor a creditor using this method must consider is tiers with different APRs or,

for credit with no annual percentage rate, other financial terms that the creditor varies

based on consumer report information.

• A notice must be sent to those consumers who do not qualify for the top tier (lowest-

priced) for a four or fewer tier system; or the top two tiers for a five or more tier system,

as well as additional tiers that comprise between 30-40% of the total number of tiers.

Alternative Approach for Credit Cards

• Credit card issuers may use one of the methods described above or a special method for

credit cards that allows the card issuer to determine which consumers must receive a

notice on an offer-by-offer basis.

• A card issuer must send a risk-based pricing notice if:

o The borrower applies for a credit card in connection with an application in which

more than one possible purchase APR may apply; and



9

o Based on the consumer report, the card issuer provides the borrower with a credit

card with a purchase APR that is not the lowest purchase APR available under

that application or solicitation.

• There are two exceptions to the notice requirement for credit cards:

o If the consumer applies for a credit card in which a creditor provides a single

purchase APR.

o If the consumer is offered the lowest purchase APR available under the credit

card offer for which he or she applied, even if the issuer offers lower rates under a

different credit card offer to other consumers.

Content, Form, and Timing of Notice • A creditor must generally provide the notice before the consummation of the transaction,

or the first transaction for credit cards or other open-end credit, but no earlier than the

time that approval of the credit is communicated to the consumer.

Risk Based Pricing Notice Content

• A statement that a consumer report includes information about a consumer’s credit

history and the type of information included in that history.

• A statement that the terms offered are based on information from that consumer

report.

• A statement that the terms offered “may” be less favorable than those offered other

consumers with better credit histories

• A statement that the consumer has the right to dispute any inaccurate information in

the report

• Each consumer reporting agency that furnished a report used in the credit decision

• An explanation that the consumer may obtain a free consumer report from that

agency within 60 days after receipt of the notice, which would be in addition to the

free credit report that consumers are already entitled to receive under the FACTA

amendments to the FCRA;

• Description of how to obtain the free report from the consumer reporting agency,

along with the toll-free number, if applicable, for each agency; and

• A statement directing consumers to the Federal Trade Commission or CFPB websites

to obtain more information about consumer reports.

• Additional content must be disclosed to consumers in risk-based pricing notices if a



10

credit score is used in setting the material terms of credit:

o A statement that a credit score is a number that takes into account information

in a consumer report, that the consumer‘s credit score was used to set the

terms of credit offered, and that a credit score can change over time to reflect

changes in the consumer‘s credit history;

o The credit score used by the person in making the credit decision;

o The range of possible credit scores under the model used to generate the credit

score;

o All of the key factors that adversely affected the credit score, which shall not

exceed four key factors, except that if one of the key factors is the number of

enquiries made with respect to the consumer report, the number of key factors

shall not exceed five;

o The date on which the credit score was created

o The name of the consumer reporting agency or other person that provided the

credit score.

Account Review Notice • A notice must be provided if creditor reviews a consumer’s credit account, and based on

credit report information, increases the APR on that account.

• A notice must be provided if a credit card issuer periodically obtains consumer reports in

order to review the terms of the credit it has extended to a consumer and based on that

review increases the APR.

• Notices issued in response to account review must include the same basic information as

notices provided for credit applicants.

• The notice must be provided at the time the decision to increase the APR is

communicated to the consumer.

Exceptions

Application for Specific Terms Exception A risk-based pricing notice is not required if the consumer applies for and is granted specific

terms for credit, unless those terms were specified after the credit was applied for and after the

creditor obtained a consumer report.



11

Adverse Action Exception A creditor does not have to provide a risk-based pricing notice if it provides an adverse action

notice under Section 615(a) of the FCRA.

Prescreened Solicitations Exception A creditor does not have to provide a risk-based pricing notice if it obtains a consumer report

that is a prescreened list and uses that report to make a firm offer of credit to a consumer,

regardless of whether the material terms of such an offer differ from the terms the creditor

includes in firm offers of credit to other consumers.

Credit Score Disclosure Exception for Non-mortgage Credit

• A creditor may provide a credit score disclosure instead of the risk-based pricing notice.

• The disclosure must contain the consumer’s credit score along with explanatory

information regarding the score, and information regarding the use of consumer reports

and scores in the underwriting process.

• Under this exception, a creditor must provide this disclosure to any consumer who

requested an extension of credit.

• Use of this notice does not give the consumer a right to a free copy of their credit report.

Credit Score Disclosure Exception for Mortgage Loans: For mortgage loans, creditors are allowed to add supplementary information to the already

required credit score disclosure for mortgage loans.

Credit Score Disclosure Exception When no Credit Score is Available A creditor provides this disclosure when the credit score for a particular consumer is unavailable

from the consumer reporting agency the creditor regularly uses.

Model Forms

Number Name Use When

H-1 Risk-Based

Pricing Notice • The creditor only provides a RBP to applicants who don’t

qualify for its best rate.

• The creditor doesn’t use a credit score to set “material terms”

of credit

H-2 Account Review

Risk Based

Pricing Notice

• The creditor increases a consumer’s APR during an account

review

• The creditor doesn’t use a credit score in its decision

• The creditor doesn’t provide and Adverse Action Notice



12

Number Name Use When

(but, um, you have to)

H-3 Exception Notice

for Residential

Real Property

• The application is for a loan secured by one to four units of

residential real property

H-4 Exception Notice

(non Real Estate) • The creditor provides a RBP to all applicants

H-5 Exception Notice:

Credit Score Not

available

• Credit score for the applicant is unavailable

H-6 Risk-Based

Pricing Notice

with Credit Score

Information

• The creditor only provides a RBP to applicants who don’t

qualify for its best rate.

• The creditor uses a credit score to set “material terms” of

credit

H-7 Account Review

Risk Based

Pricing Notice

with Credit Score

Information

• The creditor increases a consumer’s APR during an account

review

• The creditor uses a credit score in its decision

• The creditor doesn’t provide and Adverse Action Notice

(again, you have to)

Obligations of Furnishers of Credit Data

Reporting Inaccurate Information • A creditor is prohibited from providing incorrect information to a CRA it knows (or

consciously avoid knowing) is inaccurate.

• A creditor is not subject to this prohibition if it clearly and conspicuously specifies an

address to which consumers may write in order to report that certain information is

inaccurate.

Duty to Correct and Update Information • A creditor must provide updated information to a CRA anytime it discovers it is reporting

incomplete or inaccurate information.

• Creditors must notify all CRAs that received the information of any corrections.



13

Furnisher Accuracy Rules A creditor must establish and implement reasonable written policies and procedures to ensure the

accuracy and integrity of information that it furnishes to credit bureaus. (PolicyPro Model Policy

11003)

Furnisher Accuracy Policy and Procedure Content

• Establishing and implementing a system for furnishing information that is appropriate

to the nature, size, complexity, and scope of the financial institution’s operations.

• Using standard data reporting formats and standard procedures for compiling and

furnishing data to CRAs.

• Maintaining records for a reasonable period of time in order to substantiate the

accuracy of any information it furnishes that is subject to a direct dispute.

• Establishing and implementing appropriate internal controls regarding the accuracy

and integrity of consumer information, such as by implementing standard procedures

and verifying random samples of information provided to CRAs.

• Training staff that participates in activities related to the furnishing of information to

CRAs to implement the policies and procedures.

• Providing for appropriate and effective oversight of relevant service providers whose

activities may affect the accuracy or integrity of information furnished to CRAs.

• Furnishing information to CRAs following mergers, portfolio acquisitions or sales, or

other acquisitions or transfers of accounts or other obligations in a manner that

prevents re-aging of information, duplicative reporting, or other problems that may

similarly affect the accuracy or integrity of the information furnished.

• Deleting, updating, and correcting information in the creditor’s records, as

appropriate, to avoid furnishing inaccurate information.

• Conducting reasonable investigations of disputes.

• Designing technological and other means of communication with CRAs to prevent

duplicative reporting of accounts, erroneous association of information with the

wrong consumer(s), and other occurrences that may compromise the accuracy or

integrity of information provided to CRAs.

• Providing CRAs with sufficient identifying information to enable the consumer

reporting agency properly to identify the consumer.



14

Investigating Direct Disputes • Creditors must investigate a direct dispute if it relates to an account at the institution and

involves specific information regarding that account.

• The creditor does not have to investigate anything having to do with:

o The consumer’s identifying information (DOB, SSN, address, etc.)

o The identity of past employers

o Inquiries or requests for consumer reports

o Information derived from public records (e.g., judgments, bankruptcies),

o Fraud or active duty alerts

o Information provided by another furnisher

o Direct disputes submitted by credit repair organizations.

Address for Disputes A creditor will only be required to investigate a direct dispute if a consumer submits a dispute

notice to the creditor at:

• An address provided by the creditor and set forth on the consumer report relating to that

consumer

• An address clearly and conspicuously specified by the creditor for submitting direct

disputes that is provided to the consumer in writing

• Any creditor address if the creditor has not otherwise specified an address for submitting

direct disputes

Dispute Notice Contents A consumer’s dispute notice must include:

• Sufficient information to identify the account or other relationship that is in dispute, such

as an account number and the name, address and telephone number of the consumer

• The specific information that the consumer is disputing and an explanation of the basis

for the dispute

• Any supporting documentation or other information reasonably required by the creditor

to substantiate the basis of the dispute (e.g., a copy of consumer report allegedly

containing the inaccurate information, a police report, ID theft affidavit, court order,

account statements, etc.)



15

Investigation Procedures

• A creditor must complete its investigation of direct disputes within 30 days of receiving

the dispute notice.

• If the investigation finds that the information in the report was inaccurate, the creditor

must correct the error and provide accurate information to the credit bureau.

• Results of the investigation must be reported to the consumer upon completion.

Frivolous Disputes

• A creditor is not be required to investigate disputes that are determined to be frivolous or

irrelevant, such as:

o Those containing insufficient information to conduct an investigation

o Substantially similar disputes that were previously submitted to the creditor or a

CRA by or on behalf of the consumer

• Upon making a determination that a dispute is frivolous or irrelevant, the creditor must

notify the consumer not later than 5 business days after making the determination, by

mail (or other means if authorized for that purpose by the consumer)

• The notice to the consumer must explain the reasons for the creditor’s determination that

the dispute was frivolous

Investigating Disputes from CRAs When a CRA notifies the creditor that a consumer disputes the completeness or accuracy of

information provided, the creditor must:

• Conduct an investigation and review all relevant information provided by the CRA,

including information given to the CRA by the consumer.

• Report the results to the CRA, and, if the investigation establishes that the information

was, in fact, incomplete or inaccurate, report the results to all CRAs that compile and

maintain files on nationwide basis to which the creditor provided the information.

• Complete the investigation and make necessary corrections within 30 days from the date

the CRA receives the dispute (or 45 days, if the consumer later provides relevant

additional information to the CRA).

Reporting Voluntary Account Closures Creditors must promptly report voluntary account closures to CRAs.

Reporting Delinquency Dates Within 90 days of reporting to a CRA that an account is a delinquent, has been placed for

collection, charged to profit or loss, or subject to any similar action, the creditor must provide the



16

CRA with the month and the year of the commencement of the delinquency that immediately

preceded the action.

Identity Theft Notifications • Creditors are required to have reasonable procedures in place to respond to any

notification from a credit bureau that information they have furnished was the result of

identity theft, and to prevent refurnishing that information in the future.

• Information a consumer has identified as resulting from ID theft must not be furnished

unless the creditor later learns or is informed by the consumer that the information

actually is correct.

• If the creditor learns it has furnished information that is incorrect due to ID theft, each

consumer-reporting agency that received the incorrect information must be notified and

the creditor must from then on report only complete and accurate information.

• If the creditor is notified that a debt has resulted from identity theft, that debt may not be

sold, transferred, or placed for collection.

Fraud Alerts and Active Duty Alerts • CRAs maintain an alert system to notify all prospective users of consumer reports that a

consumer may be a victim of fraud, including ID theft, or that a consumer is an “active duty

military consumer,” as applicable.

• Consumers may request that fraud alerts be placed on their credit reports for an initial period

of 90 days, or for an extended period lasting seven years.

• Active duty military consumers may request that an “active duty alert” be placed on their

credit report files during the period of their active duty.

Responding to Fraud and Active Duty Alerts • A creditor must maintain procedures to form a “reasonable belief” it knows the true

identity of a consumer with an alert on his or her credit report before establishing a new

credit plan, issuing additional cards on an existing credit account, or increasing any credit

limit in the subject consumer’s name.

• For initial active duty alerts, if the consumer has specified a telephone number in the

alert, the creditor cannot extend any credit until it contacts the consumer using that

number, or takes other reasonable steps to verify the person’s identity and confirm that

the application for credit is not the result of ID theft.



17

• For extended alerts, the creditor must contact the consumer in person, at the telephone

number indicated in the alert, or other reasonable contact method specified by the

consumer before credit is granted or additional cards are sent.

Identity Theft Red Flags Financial Institutions must develop and implement a written Identity Theft Prevention Program

that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a

covered account or any existing covered account.

Covered Accounts Covered accounts are:

• Accounts offered or maintained primarily for personal, family, or household purposes

that involve or are designed to permit multiple payments or transactions or

• Any other accounts the financial institution offers or maintains for which there is a

reasonably foreseeable risk to members or to the safety and soundness of the financial

institution from ID theft, including financial, operational, compliance, reputation, or

litigation risks.

Red Flags Red flags are patterns, practices, or activities that indicate a possible risk of ID theft.

ID Theft Red Flags

• A fraud or active duty alert on the credit report

• A notice of address discrepancy provided by a credit bureau

• The credit report or a use of the account that indicates a pattern of activity

inconsistent with the history or pattern of activity usually associated with the

consumer

• The financial institution is notified of unauthorized charges or transactions in

connection with the account

• Personal information provided is inconsistent when compared to external information

sources (e.g., credit bureau report)

• Personal information associated with fraudulent activity, such as an invalid address

and phone number

• There is a request for additional authorized users for the account or a request for new,

additional, or replacement cards shortly after a request for a change of address



18

• When the account is being used after being inactive for a long time

• Mail is returned repeatedly as undeliverable even though transactions on the account

continue to be conducted

ID Theft Program Requirements

ID Theft Program Requirements

• The program must be risk-based and appropriate to the size and complexity of the

institution, as well as the nature and scope of its activities.

• The institution’s board of directors or a board committee must approve the initial

program.

• The board, any appropriate committees, or a designated a senior management employee

must be involved in the oversight, development, implementation and continued

administration of the program;

• Staff must be trained as necessary to effectively implement the program

• The institution must exercise appropriate oversight of any service provider arrangements

to ensure that vendors have policies and procedures in place to detect, prevent and

mitigate the risk of ID theft.

• Every program must contain “reasonable policies and procedures” to:

o Identify relevant red flags and incorporate them into the program

o Detect red flags that have been incorporated into the program

o Respond appropriately to any red flags that are detected to prevent and mitigate

identity theft.

o Ensure the program is updated periodically

Change of Address Requests for Card Issuers • Card issuers must assess the validity of change of address requests.

• Validation is required when a card issuer receives a change-of-address notice and then,

within a short period of time (at least 30 days) afterwards receives a request for an

additional or replacement card.



19

• The card issuer is prohibited from issuing a new card unless it takes steps to assess

whether the change of address is valid, such as:

o Notifying the cardholder at the old address

o Notifying the cardholder through some other means of communication that the

cardholder has previously agreed to

o Using another method of assessing the validity of the change of address that the

issuer has included in its red flag program

Address Discrepancies

Responding to Address Discrepancy Reports • Financial institutions must have reasonable policies and procedures to respond to notices

of address discrepancy received from a CRA.

• The policies and procedures must be designed to enable the financial institution to form a

reasonable belief that a consumer report relates to the consumer about whom it has

requested the report.

• The financial institution can only use a consumer report if it has verified the information

actually belongs to the individual for whom the report was obtained.

Furnishing Addresses Financial institutions are required maintain reasonable policies and procedures for furnishing a

consumer’s address to a consumer reporting agency that the creditor has reasonably confirmed is

accurate.

Prescreening Rules Financial institutions that request prescreened lists from CRAs to in order to market to consumer

must follow certain rules.

Notice Accompanying Prescreened Offer A financial institution that uses credit reports to make prescreened solicitations must provide

notices to consumers that contain an initial prominent statement that provides basic opt-out

information followed by a separate, longer explanation that provides additional details.

FCRA Prescreen Short Notice

• Be a simple and easy to understand statement that the consumer has a right to opt-

out of receiving prescreened solicitations

• Include a toll-free telephone number of the credit bureau(s) that the consumer



20

may call to opt-out.

FCRA Prescreen Long Notice

• Be simple and easy to understand.

• State that information contained in the consumer’s credit report was used in

connection with the offer.

• State that the consumer received the credit or insurance offer because he or she

met certain criteria for creditworthiness or insurability.

• State that the offer may not be extended after the consumer responds to the offer

if he or she does not meet the applicable criteria, including providing acceptable

property as collateral.

• State that the consumer has the right to prohibit credit report information from

being used with credit or insurance transactions not initiated by the consumer.

• Provide opt-out procedures.

Prescreened Offers • A financial institution must make an offer of credit to all consumers who pass the

prescreening process.

• The offer may contain certain conditions.

Permissible Prescreen Offer Conditions

• The consumer must first be determined to meet any specific criteria that the financial

institution established prior to selection.

• The consumer must provide proof that he or she continues to meet the criteria the

financial institution established prior to the prescreening process.

• The consumer must provide acceptable collateral if the collateral requirement was

established before the prescreening was performed and the offer of credit made to the

consumer disclosed the collateral requirement.

Record Retention • Financial Institutions that obtain prescreened lists, and make offers of credit based on

such lists, must maintain a record of the criteria used to select the consumers who are to



21

receive the offer of credit and any requirements for furnishing collateral as a condition for

the extension of credit.

• This information must be maintained for a three-year period beginning on the date the

offer of credit is made.

Medical Information

General Prohibition A creditor may not obtain or use medical information pertaining to a consumer in connection

with any determination of the consumer's eligibility, or continued eligibility, for credit, except in

certain limited circumstances.

Eligibility, or Continued Eligibility, for credit Eligibility, or Continued Eligibility, for credit means the consumer's qualification or fitness to

receive, or continue to receive, credit, including the terms on which credit is offered. The term

does not include:

• Any determination of the consumer's qualification or fitness for employment, insurance

(other than a credit insurance product), or other non-credit products or services;

• Authorizing, processing, or documenting a payment or transaction on behalf of the

consumer in a manner that does not involve a determination of the consumer's eligibility,

or continued eligibility, for credit; or

• Maintaining or servicing the consumer's account in a manner that does not involve a

determination of the consumer's eligibility, or continued eligibility, for credit.

Unsolicited Medical information A creditor does not obtain medical information in violation of the prohibition if it receives

medical information pertaining to a consumer in connection with any determination of the

consumer's eligibility, or continued eligibility, for credit without specifically requesting medical

information.

Even unsolicited medical information may only be used in determining a consumer’s eligibility,

or continued eligibility, for credit if an exception applies.

Financial Information Exceptions for Obtaining and Using Medical Information A creditor may obtain and use medical information pertaining to a consumer in connection with

any determination of the consumer's eligibility, or continued eligibility, for credit so long as:

• The information is the type of information routinely used in making credit eligibility

determinations, such as information relating to debts, expenses, income, benefits, assets,

collateral, or the purpose of the loan, including the use of proceeds;



22

• The creditor uses the medical information in a manner and to an extent that is no less

favorable than it would use comparable information that is not medical information in a

credit transaction; and

• The creditor does not take the consumer's physical, mental, or behavioral health,

condition or history, type of treatment, or prognosis into account as part of any such

determination.

Examples A creditor is permitted to obtain and use information about:

• The dollar amount, repayment terms, repayment history, and similar information

regarding medical debts to calculate, measure, or verify the repayment ability of the

consumer, the use of proceeds, or the terms for granting credit

• The value, condition, and lien status of a medical device that may serve as collateral to

secure a loan

• The dollar amount and continued eligibility for disability income, workers' compensation

income, or other benefits related to health or a medical condition that is relied on as a

source of repayment

• The identity of creditors to whom outstanding medical debts are owed in connection with

an application for credit, including but not limited to, a transaction involving the

consolidation of medical debts.

Specific Exceptions for Obtaining and Using Medical Information A creditor may obtain and use medical information pertaining to a consumer in connection with

any determination of the consumer's eligibility, or continued eligibility, for credit:

• To determine whether the use of a power of attorney or legal representative that is

triggered by a medical condition or event is necessary and appropriate or whether the

consumer has the legal capacity to contract when a person seeks to exercise a power of

attorney or act as legal representative for a consumer based on an asserted medical

condition or event

• To comply with applicable requirements of local, state, or Federal laws

• To determine, at the consumer's request, whether the consumer qualifies for a legally

permissible special credit program or credit-related assistance program (additional

conditions apply)

• To the extent necessary for purposes of fraud prevention or detection;

• In the case of credit for the purpose of financing medical products or services, to

determine and verify the medical purpose of a loan and the use of proceeds



23

• Consistent with safe and sound practices, if the consumer or the consumer's legal

representative specifically requests that the creditor use medical information in

determining the consumer's eligibility, or continued eligibility, for credit, to

accommodate the consumer's particular circumstances, and such request is documented

by the creditor;

• Consistent with safe and sound practices, to determine whether the provisions of a

forbearance practice or program that is triggered by a medical condition or event apply to

a consumer;

• To determine the consumer's eligibility for, the triggering of, or the reactivation of a debt

cancellation contract or debt suspension agreement if a medical condition or event is a

triggering event for the provision of benefits under the contract or agreement;

• To determine the consumer's eligibility for, the triggering of, or the reactivation of a

credit insurance product if a medical condition or event is a triggering event for the

provision of benefits under the product.

Disposal of Records • Financial institutions must maintain appropriate measures to properly dispose of

consumer information derived from consumer reports.

• These measures may be implemented in conjunction with Information Security measures

required by the NCUA’s Guidelines for Safeguarding Member Information.

Documents

Fair Credit Reporting Act · 2020. 4. 15. · Fair Credit Reporting Act Consumer Loan Compliance: Section 2 6 • The creditor may not include the notice in the Truth in Lending disclosures