Fair Credit Reporting Act Overview

Fair Credit Reporting Act (FCRA) and Amendments

• FCRA became effective in 1971, significantly amended by the 2003 FACT Act.
• The 2010 Dodd-Frank Act gave the CFPB rule-making authority (with exceptions) under FCRA.
• 12 CFR Part 1022 (76 Fed. Reg. 79308) restated FCRA regulations in 2011 under CFPB authority.

Consumer Disclosure Requirements

• Creditors must disclose credit scores to consumers if used in credit decisions.
• Disclosure must include: Explanation of credit score, how it impacts terms, how scores are calculated, the specific score used, possible score ranges, factors affecting the score, date of score creation, and the credit reporting agency.
• Additional disclosures for adverse actions: Oral, written, or electronic notice, consumer reporting agency details, statement that the agency did not make the decision, consumer's rights to a free report and dispute options.
• Opt-out notice required when lenders use pre-screened consumer reports.

Identity Theft Provisions

• Consumers can add a free fraud alert to their credit report.
• Alerts automatically apply to all three major bureaus.
• Alerts instruct recipients to verify identity before processing applications.
• Three types of fraud alerts: Temporary/Initial (90 days/1 year, renewable), Active-duty (1 year, unless removed), Extended Fraud Victim (7 years).
• For extended fraud victim alert, a copy of law enforcement identity theft report is needed.

Rights to Free Annual Consumer Reports

• Provisions for increased access to consumer reports for improved accuracy.
• Dodd-Frank Act mandates disclosure of credit scores and related information if used in adverse action or risk-based pricing.

Parties Covered by FCRA/FACTA

• Procurers and users of credit information (e.g., creditors, purchasers of dealer paper).
• "Creditor" includes anyone regularly extending/renewing credit, arrangers of credit, or assignees.
• Furnishers and transmitters of information to consumer reporting agencies.
• Marketers of credit/insurance products; Employers.

Contents of Credit Reports

• Required: Bankruptcy information, adverse credit score factors, account closure indications, consumer dispute information, full credit card numbers, address discrepancies.
• Excluded: Bankruptcies >10 years old, civil suits/judgments/arrest records/tax liens/collections >7 years old (some exceptions for statutes of limitations), medical information (some restrictions), criminal convictions >7 years old.

Permissible Purposes for Credit Reports

• Responding to court orders.
• Consumer written instructions.
• Party requests for credit extension, employment, insurance underwriting, licensing, valuation/risk assessment of credit obligations based on legitimate business need, consumer-initiated business transactions, account review to assess continued account eligibility.
• Government authority (e.g., government-sponsored travel charge cards, child support enforcement, failed bank liquidation).

Federal Trade Commission (FTC) Authority

• FTC retained rule-making/enforcement authority for identity theft via "Red Flag" rules (16 CFR Part 681).

Covered Accounts & Red Flags

• "Covered account" defined as accounts primarily for personal/family use, requiring multiple transactions, or those reasonably foreseeing identity theft risk.
• "Red flag" is a pattern/practice/activity indicating possible identity theft (alerts, suspicious documents, identity information, unusual account activity, notifications from customers/victims/law enforcement).

Identity Theft Prevention Program

• Financial institutions/creditors with covered accounts must develop and implement a written Identity Theft Prevention Program.
• Program must be appropriate to institution size, complexity, and operational scope to detect, prevent, and mitigate identity theft losses.