§ 1681c–1 — Identity Theft Prevention; Fraud Alerts And Active Duty Alerts

of this title), in the name of the consumer, or issuance of an additional card on an existing credit account requested by a consumer, or any increase in credit limit on an existing credit account requested by a consumer, except in accordance with subparagraph (B).(B) Limitation on users(i) In generalNo prospective user of a consumer report that includes an initial fraud alert or an active duty alert in accordance with this section may establish a new credit plan or extension of credit, other than under an open-end credit plan (as defined in section 1602(i) 1 of this title), in the name of the consumer, or issue an additional card on an existing credit account requested by a consumer, or grant any increase in credit limit on an existing credit account requested by a consumer, unless the user utilizes reasonable policies and procedures to form a reasonable belief that the user knows the identity of the person making the request.(ii) VerificationIf a consumer requesting the alert has specified a telephone number to be used for identity verification purposes, before authorizing any new credit plan or extension described in clause (i) in the name of such consumer, a user of such consumer report shall contact the consumer using that telephone number or take reasonable steps to verify the consumer’s identity and confirm that the application for a new credit plan is not the result of identity theft.(2) Requirements for extended alerts(A) NotificationEach extended alert under this section shall include information that provides all prospective users of a consumer report relating to a consumer with—(i) notification that the consumer does not authorize the establishment of any new credit plan or extension of credit described in clause (i), other than under an open-end credit plan (as defined in section 1602(i) 1 of this title), in the name of the consumer, or issuance of an additional card on an existing credit account requested by a consumer, or any increase in credit limit on an existing credit account requested by a consumer, except in accordance with subparagraph (B); and(ii) a telephone number or other reasonable contact method designated by the consumer.(B) Limitation on usersNo prospective user of a consumer report or of a credit score generated using the information in the file of a consumer that includes an extended fraud alert in accordance with this section may establish a new credit plan or extension of credit, other than under an open-end credit plan (as defined in section 1602(i) 1 of this title), in the name of the consumer, or issue an additional card on an existing credit account requested by a consumer, or any increase in credit limit on an existing credit account requested by a consumer, unless the user contacts the consumer in person or using the contact method described in subparagraph (A)(ii) to confirm that the application for a new credit plan or increase in credit limit, or request for an additional card is not the result of identity theft.(i) National security freeze(1) DefinitionsFor purposes of this subsection:(A) The term “consumer reporting agency” means a consumer reporting agency described in section 1681a(p) of this title.(B) The term “proper identification” has the meaning of such term as used under section 1681h of this title.(C) The term “security freeze” means a restriction that prohibits a consumer reporting agency from disclosing the contents of a consumer report that is subject to such security freeze to any person requesting the consumer report.(2) Placement of security freeze(A) In generalUpon receiving a direct request from a consumer that a consumer reporting agency place a security freeze, and upon receiving proper identification from the consumer, the consumer reporting agency shall, free of charge, place the security freeze not later than—(i) in the case of a request that is by toll-free telephone or secure electronic means, 1 business day after receiving the request directly from the consumer; or(ii) in the case of a request that is by mail, 3 business days after receiving the request directly from the consumer.(B) Confirmation and additional informationNot later than 5 business days after placing a security freeze under subparagraph (A), a consumer reporting agency shall—(i) send confirmation of the placement to the consumer; and(ii) inform the consumer of—(I) the process by which the consumer may remove the security freeze, including a mechanism to authenticate the consumer; and(II) the consumer’s right described in section 1681m(d)(1)(D) of this title.(C) Notice to third partiesA consumer reporting agency may advise a third party that a security freeze has been placed with respect to a consumer under subparagraph (A).(3) Removal of security freeze(A) In generalA consumer reporting agency shall remove a security freeze placed on the consumer report of a consumer only in the following cases:(i) Upon the direct request of the consumer.(ii) The security freeze was placed due to a material misrepresentation of fact by the consumer.(B) Notice if removal not by requestIf a consumer reporting agency removes a security freeze under subparagraph (A)(ii), the consumer reporting agency shall notify the consumer in writing prior to removing the security freeze.(C) Removal of security freeze by consumer requestExcept as provided in subparagraph (A)(ii), a security freeze shall remain in place until the consumer directly requests that the security freeze be removed. Upon receiving a direct request from a consumer that a consumer reporting agency remove a security freeze, and upon receiving proper identification from the consumer, the consumer reporting agency shall, free of charge, remove the security freeze not later than—(i) in the case of a request that is by toll-free telephone or secure electronic means, 1 hour after receiving the request for removal; or(ii) in the case of a request that is by mail, 3 business days after receiving the request for removal.(D) Third-party requestsIf a third party requests access to a consumer report of a consumer with respect to which a security freeze is in effect, where such request is in connection with an application for credit, and the consumer does not allow such consumer report to be accessed, the third party may treat the application as incomplete.(E) Temporary removal of security freezeUpon receiving a direct request from a consumer under subparagraph (A)(i), if the consumer requests a temporary removal of a security freeze, the consumer reporting agency shall, in accordance with subparagraph (C), remove the security freeze for the period of time specified by the consumer.(4) ExceptionsA security freeze shall not apply to the making of a consumer report for use of the following:(A) A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owed by the consumer to that person or entity, or a prospective assignee of a financial obligation owed by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owed for the account, contract, or negotiable instrument. For purposes of this subparagraph, “reviewing the account” includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.(B) Any Federal, State, or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena.(C) A child support agency acting pursuant to part D of title IV of the Social Security Act (42 U.S.C. 651 et seq.).(D) A Federal agency or a State or its agents or assigns acting to investigate fraud or acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities, provided such responsibilities are consistent with a permissible purpose under section 1681b of this title.(E) By a person using credit information for the purposes described under section 1681b(c) of this title.(F) Any person or entity administering a credit file monitoring subscription or similar service to which the consumer has subscribed.(G) Any person or entity for the purpose of providing a consumer with a copy of the consumer’s consumer report or credit score, upon the request of the consumer.(H) Any person using the information in connection with the underwriting of insurance.(I) Any person using the information for employment, tenant, or background screening purposes.(J) Any person using the information for assessing, verifying, or authenticating a consumer’s identity for purposes other than the granting of credit, or for investigating or preventing actual or potential fraud.(5) Notice of rightsAt any time a consumer is required to receive a summary of rights required under section 1681g of this title, the following notice shall be included:“Consumers Have the Right To Obtain a Security Freeze“You have a right to place a ‘security freeze’ on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit.“As an alternative to a security freeze, you have the right to place an initial or extended fraud alert on your credit file at no cost. An initial fraud alert is a 1-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting 7 years.“A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account that requests information in your credit report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.”.(6) Webpage(A) Consumer reporting agenciesA consumer reporting agency shall establish a webpage that—(i) allows a consumer to request a security freeze;(ii) allows a consumer to request an initial fraud alert;(iii) allows a consumer to request an extended fraud alert;(iv) allows a consumer to request an active duty fraud alert;(v) allows a consumer to opt-out of the use of information in a consumer report to send the consumer a solicitation of credit or insurance, in accordance with section 1681m(d) of this title; and(vi) shall not be the only mechanism by which a consumer may request a security freeze.(B) FTCThe Federal Trade Commission shall establish a single webpage that includes a link to each webpage established under subparagraph (A) within the Federal Trade Commission’s website www.Identitytheft.gov, or a successor website.(j) National protection for files and credit records of protected consumers(1) DefinitionsAs used in this subsection:(A) The term “consumer reporting agency” means a consumer reporting agency described in section 1681a(p) of this title.(B) The term “protected consumer” means an individual who is—(i) under the age of 16 years at the time a request for the placement of a security freeze is made; or(ii) an incapacitated person or a protected person for whom a guardian or conservator has been appointed.(C) The term “protected consumer’s representative” means a person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer.(D) The term “record” means a compilation of information that—(i) identifies a protected consumer;(ii) is created by a consumer reporting agency solely for the purpose of complying with this subsection; and(iii) may not be created or used to consider the protected consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.(E) The term “security freeze” means a restriction that prohibits a consumer reporting agency from disclosing the contents of a consumer report that is the subject of such security freeze or, in the case of a protected consumer for whom the consumer reporting agency does not have a file, a record that is subject to such security freeze to any person requesting the consumer report for the purpose of opening a new account involving the extension of credit.(F) The term “sufficient proof of authority” means documentation that shows a protected consumer’s representative has authority to act on behalf of a protected consumer and includes—(i) an order issued by a court of law;(ii) a lawfully executed and valid power of attorney;(iii) a document issued by a Federal, State, or local government agency in the United States showing proof of parentage, including a birth certificate; or(iv) with respect to a protected consumer who has been placed in a foster care setting, a written communication from a county welfare department or its agent or designee, or a county probation department or its agent or designee, certifying that the protected consumer is in a foster care setting under its jurisdiction.(G) The term “sufficient proof of identification” means information or documentation that identifies a protected consumer and a protected consumer’s representative and includes—(i) a social security number or a copy of a social security card issued by the Social Security Administration;(ii) a certified or official copy of a birth certificate issued by the entity authorized to issue the birth certificate; or(iii) a copy of a driver’s license, an identification card issued by the motor vehicle administration, or any other government issued identification.(2) Placement of security freeze for a protected consumer(A) In generalUpon receiving a direct request from a protected consumer’s representative that a consumer reporting agency place a security freeze, and upon receiving sufficient proof of identification and sufficient proof of authority, the consumer reporting agency shall, free of charge, place the security freeze not later than—(i) in the case of a request that is by toll-free telephone or secure electronic means, 1 business day after receiving the request directly from the protected consumer’s representative; or(ii) in the case of a request that is by mail, 3 business days after receiving the request directly from the protected consumer’s representative.(B) Confirmation and additional informationNot later than 5 business days after placing a security freeze under subparagraph (A), a consumer reporting agency shall—(i) send confirmation of the placement to the protected consumer’s representative; and(ii) inform the protected consumer’s representative of the process by which the protected consumer may remove the security freeze, including a mechanism to authenticate the protected consumer’s representative.(C) Creation of fileIf a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a direct request under subparagraph (A), the consumer reporting agency shall create a record for the protected consumer.(3) Prohibition on release of record or file of protected consumerAfter a security freeze has been placed under paragraph (2)(A), and unless the security freeze is removed in accordance with this subsection, a consumer reporting agency may not release the protected consumer’s consumer report, any information derived from the protected consumer’s consumer report, or any record created for the protected consumer.(4) Removal of a protected consumer security freeze(A) In generalA consumer reporting agency shall remove a security freeze placed on the consumer report of a protected consumer only in the following cases:(i) Upon the direct request of the protected consumer’s representative.(ii) Upon the direct request of the protected consumer, if the protected consumer is not under the age of 16 years at the time of the request.(iii) The security freeze was placed due to a material misrepresentation of fact by the protected consumer’s representative.(B) Notice if removal not by requestIf a consumer reporting agency removes a security freeze under subparagraph (A)(iii), the consumer reporting agency shall notify the protected consumer’s representative in writing prior to removing the security freeze.(C) Removal of freeze by requestExcept as provided in subparagraph (A)(iii), a security freeze shall remain in place until a protected consumer’s representative or protected consumer described in subparagraph (A)(ii) directly requests that the security freeze be removed. Upon receiving a direct request from the protected consumer’s representative or protected consumer described in subparagraph (A)(ii) that a consumer reporting agency remove a security freeze, and upon receiving sufficient proof of identification and sufficient proof of authority, the consumer reporting agency shall, free of charge, remove the security freeze not later than—(i) in the case of a request that is by toll-free telephone or secure electronic means, 1 hour after receiving the request for removal; or(ii) in the case of a request that is by mail, 3 business days after receiving the request for removal.(D) Temporary removal of security freezeUpon receiving a direct request from a protected consumer or a protected consumer’s representative under subparagraph (A)(i), if the protected consumer or protected consumer’s representative requests a temporary removal of a security freeze, the consumer reporting agency shall, in accordance with subparagraph (C), remove the security freeze for the period of time specified by the protected consumer or protected consumer’s representative.(k) Credit monitoring(1) DefinitionsIn this subsection:(A) The term “active duty military consumer” includes a member of the National Guard.(B) The term “National Guard” has the meaning given the term in section 101(c) of title 10.(2) Credit monitoringA consumer reporting agency described in section 1681a(p) of this title shall provide a free electronic credit monitoring service that, at a minimum, notifies a consumer of material additions or modifications to the file of the consumer at the consumer reporting agency to any consumer who provides to the consumer reporting agency—(A) appropriate proof that the consumer is an active duty military consumer; and(B) contact information of the consumer.(3) RulemakingNot later than 1 year after May 24, 2018, the Federal Trade Commission shall promulgate regulations regarding the requirements of this subsection, which shall at a minimum include—(A) a definition of an electronic credit monitoring service and material additions or modifications to the file of a consumer; and(B) what constitutes appropriate proof.(4) Applicability(A) Sections 1681n and 1681o of this title shall not apply to any violation of this subsection.(B) This subsection shall be enforced exclusively under section 1681s of this title by the Federal agencies and Federal and State officials identified in that section.