Upon the direct request of a consumer, or an individual acting on behalf of or as a personal representative of a consumer, who asserts in good faith a suspicion that the consumer has been or is about to become a victim of fraud or related crime, including identity theft, a consumer reporting agency described in section 1681a(p) of this title that maintains a file on the consumer and has received appropriate proof of the identity of the requester shall-
In any case in which a consumer reporting agency includes a fraud alert in the file of a consumer pursuant to this subsection, the consumer reporting agency shall-
Upon the direct request of a consumer, or an individual acting on behalf of or as a personal representative of a consumer, who submits an identity theft report to a consumer reporting agency described in section 1681a(p) of this title that maintains a file on the consumer, if the agency has received appropriate proof of the identity of the requester, the agency shall-
In any case in which a consumer reporting agency includes a fraud alert in the file of a consumer pursuant to this subsection, the consumer reporting agency shall-
Upon the direct request of an active duty military consumer, or an individual acting on behalf of or as a personal representative of an active duty military consumer, a consumer reporting agency described in section 1681a(p) of this title that maintains a file on the active duty military consumer and has received appropriate proof of the identity of the requester shall-
Each consumer reporting agency described in section 1681a(p) of this title shall establish policies and procedures to comply with this section, including procedures that inform consumers of the availability of initial, extended, and active duty alerts and procedures that allow consumers and active duty military consumers to request initial, extended, or active duty alerts (as applicable) in a simple and easy manner, including by telephone.
Each consumer reporting agency described in section 1681a(p) of this title that receives a referral of a fraud alert or active duty alert from another consumer reporting agency pursuant to this section shall, as though the agency received the request from the consumer directly, follow the procedures required under-
A reseller shall include in its report any fraud alert or active duty alert placed in the file of a consumer pursuant to this section by another consumer reporting agency.
If a consumer contacts any consumer reporting agency that is not described in section 1681a(p) of this title to communicate a suspicion that the consumer has been or is about to become a victim of fraud or related crime, including identity theft, the agency shall provide information to the consumer on how to contact the Bureau and the consumer reporting agencies described in section 1681a(p) of this title to obtain more detailed information and request alerts under this section.
Each initial fraud alert and active duty alert under this section shall include information that notifies all prospective users of a consumer report on the consumer to which the alert relates that the consumer does not authorize the establishment of any new credit plan or extension of credit, other than under an open-end credit plan (as defined in section 1602(i)1 of this title), in the name of the consumer, or issuance of an additional card on an existing credit account requested by a consumer, or any increase in credit limit on an existing credit account requested by a consumer, except in accordance with subparagraph (B).
No prospective user of a consumer report that includes an initial fraud alert or an active duty alert in accordance with this section may establish a new credit plan or extension of credit, other than under an open-end credit plan (as defined in section 1602(i)1 of this title), in the name of the consumer, or issue an additional card on an existing credit account requested by a consumer, or grant any increase in credit limit on an existing credit account requested by a consumer, unless the user utilizes reasonable policies and procedures to form a reasonable belief that the user knows the identity of the person making the request.
If a consumer requesting the alert has specified a telephone number to be used for identity verification purposes, before authorizing any new credit plan or extension described in clause (i) in the name of such consumer, a user of such consumer report shall contact the consumer using that telephone number or take reasonable steps to verify the consumer's identity and confirm that the application for a new credit plan is not the result of identity theft.
Each extended alert under this section shall include information that provides all prospective users of a consumer report relating to a consumer with-
No prospective user of a consumer report or of a credit score generated using the information in the file of a consumer that includes an extended fraud alert in accordance with this section may establish a new credit plan or extension of credit, other than under an open-end credit plan (as defined in section 1602(i)1 of this title), in the name of the consumer, or issue an additional card on an existing credit account requested by a consumer, or any increase in credit limit on an existing credit account requested by a consumer, unless the user contacts the consumer in person or using the contact method described in subparagraph (A)(ii) to confirm that the application for a new credit plan or increase in credit limit, or request for an additional card is not the result of identity theft.
For purposes of this subsection:
Upon receiving a direct request from a consumer that a consumer reporting agency place a security freeze, and upon receiving proper identification from the consumer, the consumer reporting agency shall, free of charge, place the security freeze not later than-
Not later than 5 business days after placing a security freeze under subparagraph (A), a consumer reporting agency shall-
A consumer reporting agency may advise a third party that a security freeze has been placed with respect to a consumer under subparagraph (A).
A consumer reporting agency shall remove a security freeze placed on the consumer report of a consumer only in the following cases:
If a consumer reporting agency removes a security freeze under subparagraph (A)(ii), the consumer reporting agency shall notify the consumer in writing prior to removing the security freeze.
Except as provided in subparagraph (A)(ii), a security freeze shall remain in place until the consumer directly requests that the security freeze be removed. Upon receiving a direct request from a consumer that a consumer reporting agency remove a security freeze, and upon receiving proper identification from the consumer, the consumer reporting agency shall, free of charge, remove the security freeze not later than-
If a third party requests access to a consumer report of a consumer with respect to which a security freeze is in effect, where such request is in connection with an application for credit, and the consumer does not allow such consumer report to be accessed, the third party may treat the application as incomplete.
Upon receiving a direct request from a consumer under subparagraph (A)(i), if the consumer requests a temporary removal of a security freeze, the consumer reporting agency shall, in accordance with subparagraph (C), remove the security freeze for the period of time specified by the consumer.
A security freeze shall not apply to the making of a consumer report for use of the following:
At any time a consumer is required to receive a summary of rights required under section 1681g of this title, the following notice shall be included:
"CONSUMERS HAVE THE RIGHT TO OBTAIN A SECURITY FREEZE
"You have a right to place a 'security freeze' on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit.
"As an alternative to a security freeze, you have the right to place an initial or extended fraud alert on your credit file at no cost. An initial fraud alert is a 1-year alert that is placed on a consumer's credit file. Upon seeing a fraud alert display on a consumer's credit file, a business is required to take steps to verify the consumer's identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting 7 years.
"A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account that requests information in your credit report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.".
A consumer reporting agency shall establish a webpage that-
The Federal Trade Commission shall establish a single webpage that includes a link to each webpage established under subparagraph (A) within the Federal Trade Commission's website www.Identitytheft.gov, or a successor website.
As used in this subsection:
Upon receiving a direct request from a protected consumer's representative that a consumer reporting agency place a security freeze, and upon receiving sufficient proof of identification and sufficient proof of authority, the consumer reporting agency shall, free of charge, place the security freeze not later than-
Not later than 5 business days after placing a security freeze under subparagraph (A), a consumer reporting agency shall-
If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a direct request under subparagraph (A), the consumer reporting agency shall create a record for the protected consumer.
After a security freeze has been placed under paragraph (2)(A), and unless the security freeze is removed in accordance with this subsection, a consumer reporting agency may not release the protected consumer's consumer report, any information derived from the protected consumer's consumer report, or any record created for the protected consumer.
A consumer reporting agency shall remove a security freeze placed on the consumer report of a protected consumer only in the following cases:
If a consumer reporting agency removes a security freeze under subparagraph (A)(iii), the consumer reporting agency shall notify the protected consumer's representative in writing prior to removing the security freeze.
Except as provided in subparagraph (A)(iii), a security freeze shall remain in place until a protected consumer's representative or protected consumer described in subparagraph (A)(ii) directly requests that the security freeze be removed. Upon receiving a direct request from the protected consumer's representative or protected consumer described in subparagraph (A)(ii) that a consumer reporting agency remove a security freeze, and upon receiving sufficient proof of identification and sufficient proof of authority, the consumer reporting agency shall, free of charge, remove the security freeze not later than-
Upon receiving a direct request from a protected consumer or a protected consumer's representative under subparagraph (A)(i), if the protected consumer or protected consumer's representative requests a temporary removal of a security freeze, the consumer reporting agency shall, in accordance with subparagraph (C), remove the security freeze for the period of time specified by the protected consumer or protected consumer's representative.
In this subsection:
A consumer reporting agency described in section 1681a(p) of this title shall provide a free electronic credit monitoring service that, at a minimum, notifies a consumer of material additions or modifications to the file of the consumer at the consumer reporting agency to any consumer who provides to the consumer reporting agency-
Not later than 1 year after May 24, 2018, the Federal Trade Commission shall promulgate regulations regarding the requirements of this subsection, which shall at a minimum include-
1See References in Text note below.
15 U.S.C. § 1681c-1
EDITORIAL NOTES
REFERENCES IN TEXTSection 1602(i) of this title, referred to in subsec. (h), was redesignated section 1602(j) of this title by Pub. L. 111-203, title X, §1100A(1)(A), July 21, 2010, 124 Stat. 2107. The Social Security Act, referred to in subsec. (i)(4)(C), is act Aug. 14, 1935, ch. 531, 49 Stat. 620. Part D of title IV of the Act is classified generally to part D (§651 et seq.) of subchapter IV of chapter 7 of Title 42, The Public Health and Welfare. For complete classification of this Act to the Code, see section 1305 of Title 42 and Tables.
AMENDMENTS2018-Subsec. (a)(1)(A). Pub. L. 115-174, §301(a)(1), substituted "1 year" for "90 days".Subsecs. (i), (j). Pub. L. 115-174, §301(a)(2), added subsecs. (i) and (j).Subsec. (k). Pub. L. 115-174, §302(d)(1), added subsec. (k). 2010-Subsecs. (c)(1), (g). Pub. L. 111-203 substituted "the Bureau" for "the Commission".
STATUTORY NOTES AND RELATED SUBSIDIARIES
EFFECTIVE DATE OF 2018 AMENDMENT Pub. L. 115-174, title III, §301(c), May 24, 2018, 132 Stat. 1332, provided that: "The amendments made by this section [amending this section and section 1681t of this title] shall take effect on the date that is 120 days after the date of enactment of this Act [May 24, 2018]." Amendment by section 302(d)(1) of Pub. L. 115-174 effective 1 year after May 24, 2018, see section 302(e) of Pub. L. 115-174 set out as a note under section 1681a of this title.
EFFECTIVE DATE OF 2010 AMENDMENT Amendment by Pub. L. 111-203 effective on the designated transfer date, see section 1100H of Pub. L. 111-203 set out as a note under section 552a of Title 5, Government Organization and Employees.
EFFECTIVE DATESection subject to joint regulations establishing effective dates as prescribed by Federal Reserve Board and Federal Trade Commission, except as otherwise provided, see section 3 of Pub. L. 108-159 set out as an Effective Date of 2003 Amendment note under section 1681 of this title.
REGULATIONS Pub. L. 108-159, title I, §112(b), Dec. 4, 2003, 117 Stat. 1959, as amended by Pub. L. 111-203, title X, §1088(b)(1), July 21, 2010, 124 Stat. 2092, provided that: "The Bureau shall prescribe regulations to define what constitutes appropriate proof of identity for purposes of sections 605A, 605B, and 609(a)(1) of the Fair Credit Reporting Act [15 U.S.C. 1681c-1, 1681c-2, 1681g(a)(1)], as amended by this Act."
PUBLIC CAMPAIGN TO PREVENT IDENTITY THEFT Pub. L. 108-159, title I, §151(b), Dec. 4, 2003, 117 Stat. 1964, provided that: "Not later than 2 years after the date of enactment of this Act [Dec. 4, 2003], the Commission shall establish and implement a media and distribution campaign to teach the public how to prevent identity theft. Such campaign shall include existing Commission education materials, as well as radio, television, and print public service announcements, video cassettes, interactive digital video discs (DVD's) or compact audio discs (CD's), and Internet resources."[For definitions of terms used in section 151(b) of Pub. L. 108-159 set out above, see section 2 of Pub. L. 108-159 set out as a Definitions note under section 1681 of this title.]
- Administration
- the terms "Administration" and "Administrator" mean the Small Business Administration and the Administrator thereof, respectively; and