USE (AND ABUSE) OF FINANCIAL INFORMATION AND CREDIT REPORTS BY REAL ESTATE PROFESSIONALS
Post Date: 2/22/2013
BY: J. ROBERT ECKLEY
Real Estate and Construction Attorney
Eckley & Associates
January 1, 2013
©2013 ECKLEY & ASSOCIATES, P.C.
REPRINTED FROM "COUNSELOR'S CORNER", Ed. 64
Current Circulation: 75,004 per Month
First, a TEST:
Facts: Your client, Sally, has indicated in the listing options that she would consider selling on a seller-carry. Bill, a buyer-broker, comes with a seller-carry offer as follows: Charlie will buy at 10% down, balance bears 5% interest on a land sale contract amortized at a 30-year rate over 6 years, due in full at the end of 6 years. Bill personally vouches for the buyer on the telephone as a “good guy, well-employed, lots of money.” You pass the written offer and the oral information that “Charlie is good for the money” on to Sally and she says “great” and signs the deal and closes.
True or False? You and Bill have done everything required by law to serve your clients.
Facts: Add to the above facts these extra facts: Charlie gives Bill a short, signed financial statement Charlie drafted that shows “All ASSETS” as $230,000 and “ALL DEBTS” as $10,500.00.” You give that to Sally as a statement of Charlie’s net worth, she likes it, signs and closes.
True of False? Now you and Bill have surely done everything required by law to serve your clients.
Facts: Add even more to the above scenario: Bill gives you a year old TransUnion credit report on Charlie that shows him as “clean.” You call Sally and indicate that you have it and Charlie is “clean.” Sally signs and closes.
True of False? SURELY NOW you and Bill have done everything required by law to serve your clients.
Answer: False, again!
Last Facts: Add the last set of facts to the above situation: Bill gives you a Credit Application signed by Charlie, plus a signed Authorization to Obtain and Verify Bank Credit Information and Employment, all in the forms used by banks, plus a current tri-merge credit report (Experian, Equifax and TransUnion reports combined), on Charlie (with report scoring and FICO scores) plus a signed Financial Statement, all collectively showing Charlie is squeaky clean and is fully employed, has plenty in savings, hardly any debt and in fine financial shape. You jubilantly call Sally and tell her “wow, Charlie is in fabulous financial shape!” Sally indicates that she wants copies of these and intends to work with her CPA and a licensed mortgage broker she knows on determining whether Charlie is creditworthy under retail credit standards. You decline her request saying “it is against the law for you to see these—I even have to shred them after I see them so they will never be accessible again—you will just have to take my word for it.” She declines to do that, cancels the listing and files a complaint with the Real Estate Commissioner’s office against you.
True of False? You complied with law and Sally is all wet and her complaint will go nowhere.
Now the final Answer: FALSE AGAIN, and this time on at least 4 different bases under the law and licensure duties and rules! Moreover, you have committed several federal law violations and fraud. Sally will sue you and win and the DRE will put your head and your shredded license on a stick in front of the Department’s Administrative Offices as an example for others, figuratively speaking.
If you missed any of the answers, above, don’t tell anyone. It’s only a test. But do visit your church, temple or synagogue very, very soon and pray that your nose will soon stop growing. That just has to be embarrassing! Then on the way home pop into a good real estate school for at least 20 more hours of CE on consumer law and real estate fraud. You need one or the other and maybe both. Or, alternatively, you could just read on, get the right answers and repent here and now!
Here is what you should have done in the last question variation: Give her, her CPA and mortgage broker a Credit Confidentiality Agreement which recites that they will not use these documents or this information for any other purpose than evaluating the loan and collection on the loan if it ever goes into default and will hold them otherwise confidential. After they signed this agreement, you should have given Sally and her CPA and mortgage broker all of those documents to keep and let them form the credit opinions and decisions to do or not do the deal and stayed the hell out of the way on this issue!
By not doing so, here are the standards, laws and rules you violated.
First, your fiduciary duty is owed to Sally. In a seller-carry transaction, sale, rental, or lease, your duty is to obtain or help the seller obtain competent traditional financial information about the borrower and to let the seller or landlord and any lawful counselor to the seller or landlord see it, check it out, evaluate it and make a credit call on doing the deal. In addition, the seller-carry deal is not over for Sally by closing, She is going to be in contract with Charlie for 6 years according to its terms. If it was a lease she would be in for the lease term. And Sally is not just evaluating trusting Charlie for the money—but also entrusting him with her largest personal asset, her house! She has every right to keep the financial roadmap Charlie gave in the event this information is needed later for collection. Refusing Sally the means and opportunity to do that breaches your fiduciary duty. Moreover, by being the one making the call on Charlie’s creditworthiness, you have inserted yourself as a “guarantor” of the loan made to Charlie. If Charlie turns out to have lied on his financials or stops making payment on the loan, who made the credit and character call on Charlie? You! Get out your professional insurance policy. Oops! It does not cover credit opinions! Last, any violations of law are also a violation of fiduciary duty and you have committed several legal violations outlined, below. Get ready for the lawsuit from Sally if Charlie ever goes south on that contract or trashes the house and disappears!
Second, all of the residential resale agreements and seller-carry addendums or subparts out there have a credit check option and contingency that must be completed as a “yes” or “no.” Usually the form has a little line or box to be checked making “approval of buyer’s/lessee’s credit” by seller or lessor a condition of the deal. No agent wanting to stay in this business much longer ever fails to check that line or box with a “yes,” making seller’s or lessor’s PERSONAL AND INFORMED opinion of the buyer’s credit the central contingency of the deal. I cannot think of a single fact pattern or time when that line or box would be completed as “no credit check” unless the agents are stupid or crooks. That’s a red flag for fraud and that Charlie is quite likely a financial turnip. Note something more about that line or box: All of those boxes indicate that the information will be given to the ONE MAKING THE LOAN. That’s SALLY, NOT YOU!
How and why did YOU insert yourself in this process set out in the contract? And WHY? Because you just wanted to use your Mortgage Originator’s or Mortgage Broker’s license for fun? Say WHAT!? That’s right. Only the seller or lessor or a licensed mortgage broker can make a creditworthiness call. The consumer law says that if it is not going to be Sally, then it is going to be her CPA, banker, financial advisor, attorney or, in some cases (see Dodd Frank Act, below) her mortgage broker who is engaged as required by the DFA. It does not say a real estate licensee. YOU are not included in the “approved list” of credit-reviewers. Get that? The very fact you are there doing that is unlawful. Without a separate mortgage license, in fact, you are excluded. It is not even part of the real estate licensee’s approved acts to “develop, analyze and approve credit” according to all of the real estate licensure statutes out there. Last, unless you have signed consents for credit release form the buyer or lessee, you have obtained credit information in violation of the Fair Credit Reporting Act. That’s civilly actionable and a crime. Is THAT why you wanted to “hold and shred the evidence?” Because it was obtained in violation of law? That’s even worse. No BOTH Sally and Charlie can sue you. That brings me to the third point.
Third, under the Dodd Frank Act (“DFA”), becoming the law governing transactions like this in 2013, and the regulations promulgated by the Consumer Financial Protection Bureau (the “CFPB” and ditto as to what it does), because the land sale contract runs longer than 5 years and because it has a balloon payment in it, it is clearly required by federal law that the borrower be established by comprehensive retail mortgage underwriting techniques as being capable of paying and otherwise performing and now only a licensed Mortgage Originator (“LMO”) or licensed Mortgage Broker (LMB”) aiding the Seller can lawfully pass those opinions! Only Sally’s CPA, lawyer or mortgage broker might know that and what is required to comply. If the contract term was a period that would fully amortize and there were no balloons, then the deal is exempt from having an LMO or LMB approve it under the DFA, but the duty to give all of the written documents to Sally, her CPA, LMO or LMB or to assure they have a way of getting them as part of the residential resale agreement as a matter of law. Let them make the credit call. That is the fiduciary contractual and statutory duty. In some states (like Arizona), providing the written information to the seller or lessor FOR THEM TO KEEP is expressly provided by the real estate licensure statutes or by DRE rules or substantive policy statements. In all states, the DRE licensure rules require compliance with federal law and the DFA is federal law. Thus, in every state the DFA rules are also rules governing licensure. Last point: If you try to pass an opinion or perform an act only permitted an LMO or LMB, then you are also acting like one without a license to do so. Now it’s the state financial and banking regulators calling you for a hearing on unlicensed practice!
Fourth, some otherwise very honest real estate brokers believe they are required by consumer law to hold all of the materials confidential from Sally and to destroy them after use. Also some very corrupt ones simply just hold the financials, never give them to the seller or his lawful DFA-approved representatives and destroy them because they know the buyer or lessee stinks and they want the deal to close, anyway. The law punishes both wrongs equally.
There is no law that states that the one extending credit cannot see and retain the financial for his borrower! In fact, the law is exactly the opposite in transactions like Sally’s. It’s not just fiduciary duty, licensure rules and the DFA that says that. The federal Fair Credit Reporting Act (“FCRA”) EXPRESSLY DIRECTS that any person or entity who is extending consumer credit in a sale or lease get, review, develop, hold, analyze and keep the credit information and documents received from and about the borrowers, inclusive of credit reports about the borrower from a third-party source like credit reporting agencies, whether or not the deal ever hardens and certainly if it closes! That includes signed Credit Applications, tri-merge credit reports, FICO scores, Financial Statements. The works. All go to the creditor to review, have and hold throughout the entire time of the debt and for the very good reasons and purposes noted above.
Aside from the fact that it is law and a civil and criminal violation to contort this process, how simply in pure sanity could all credit application information be seen and belong to everyone else BUT the one issuing the credit, i.e. the SELLER or the LESSOR!? That is ludicrous!
Notably, there is a group that is not to see these. The FRCA does not allow mere REAL ESTATE AGENTS these review and handling rights! Just the opposite of this false real estate wife’s tale! The agents do have a DRE licensure duty in all states: It is to keep copies in their files of any and all documents generated in the deal and to keep all of it confidential. BUT NOT CONFIDENTIAL FROM THE CREDITOR MAKING THE LOAN! Confidential as to all other third persons! The real estate agent has to use the right forms or see that they are used. If the agent is developing the information for use of the seller/lessor, as the case may be, he or she must present the buyer/lessee proper credit information and release forms to do it with or assure that the party gets to licensed credit reporting agency, an LMO or LMB who can if he does not know how. The buyer must consent to the credit inquiry by law. The consent forms exist. When you do not use them, you have violated the credit reporting and investigation laws per se before you even got to who gets to see them or keep them!
As to the right documents, one needs this as a minimum: A signed Authorization and Release to Examine Credit, a signed Financial Statement, a tri-merge credit report and a FICO score. Most Financial Statements have a release in them for other creditors and the employer to give information on the borrower to verify what is said on the statement. Tri-merges often show judgments. The title report will show if a judgment is outstanding against the debtor in the County and whether such things as unpaid income tax liens have attached.
Many times, to get things started, the debtor can get at least the tri-merges and FICO scores himself and present them to the creditor and some of these resources are readily out there. See for example www.annualcreditreport.com for the free annual tri-merge credit report each US citizen is entitled to. If the borrower has already obtained one that year, there will be a charge assessed on line for the next one. That site also will (for an extra fee) also hyperlink to FICO to generate a FICO score. Just a tri-merge and especially a report from just one agency of the three that report (and often miss things that having all three will usually catch) is not enough.
To be up to professional retail credit standards, there must be a release by the borrower to even do such a study, and the packet must still be accompanied with at least the borrower’s signed and sworn Financial Statement on a real form, such as what the Banks use to extend credit, which form must always include a release for further credit and employment inquiry and information from the borrower. If you do not have these, most credit reporting agencies do and can give you the proper ones or handle this reporting directly by working with the buyer/lessee. If you cannot find these bare forms, proprietorial ones can be obtained at a fee by writing to email@example.com (that site does not do credit reporting, credit checks or obtain and process financials—it offers blank forms, only) and asking for them.
Telling a seller or lessor that “by law they cannot see or keep financial information” on the very person or entity to whom or which they are extending credit is not only a violation of the above duties and rules, it is just a flat out lie! That kicks in other provisions of the licensure, state and federal law. Lies and frauds about material facts are always capable of civil, criminal and licensure prosecution. If you or your brokerage is doing that, you are toast the first time a client, customer, their agent, CPA or attorney, LMO or LMB reports you, whether or not there was any damage done, but certainly moreso if there was. And if the later-proven-as-a-turnip borrower YOU approved absconded a month after closing without paying the seller or landlord, stole the appliances or burned the place down, you will certainly find yourself coughing up your life savings to cover the losses to boot.
P.S. Below are some selected extracts from Epic.org regarding the credit reporting laws for further reference. The full article can be found at: http://epic.org/privacy/fcra/#privacy, and has many active links leading the reader to even more information.
The Fair Credit Reporting Act (FCRA), Public Law No. 91-508, was enacted in 1970 to promote accuracy, fairness, and the privacy of personal information assembled by Credit Reporting Agencies (CRAs).
CRAs assemble reports on individuals for businesses, including credit card companies, banks, employers, landlords, and others. The FCRA provides important protections for credit reports, consumer investigatory reports, and employment background checks. The FCRA is a complex statute that has been significantly altered since 1970 by Congress and the courts. The Act's primary protection requires that CRAs follow "reasonable procedures" to protect the confidentiality, accuracy, and relevance of credit information. To do so, the FCRA establishes a framework of Fair Information Practices for personal information that include rights of data quality (right to access and correct), data security, use limitations, requirements for data destruction, notice, user participation (consent), and accountability.
The Federal Trade Commission (FTC) issues commentaries on the statute, but does not engage in rulemaking for the FCRA.
CRAs may also be referred to as "credit bureaus" or "consumer reporting agencies."
- Text of the Fair Credit Reporting Act of 1970, 15 U.S.C. §§ 1681-1681u.
- FTC Commentary on the FCRA, 16 C.F.R. Part 600.
- FTC Staff Opinion Letters on the FCRA.
Permissible Uses of the Credit Report
The FCRA limits the use of the credit report to certain purposes by a creditor, employer or government agency. They are:
- Applications for credit, insurance, loans and rentals for personal, family or household purposes.
- Employment, which includes hiring, promotion, reassignment or retention. A CRA may not release a credit report for employment decisions without consent.
- Court orders, including grand jury subpoenas.
- "Legitimate" business needs in transactions initiated by the consumer for personal, family, or household purposes.
- Account review. Periodically, banks and other companies review credit files to determine whether they wish to retain the individual as a customer.
- Licensing (professional applying for a license).
- Child support payment determinations.
- Law enforcement access: Government agencies with authority to investigate terrorism and counterintelligence have secret access to credit reports.
- Judgment Collections on any of the above rightful uses.
Specific prior consent is required before consumer reports with medical information can be released. There is no authorization for a real estate licensee to pull credit for a consumer transaction. In most cases where consensual credit is being extended, a written release by the consumer is required and the information is to be given only to the creditor.
Target marketing is not a permissible use of credit reports.
The FCRA was re-visited by the 108th Congress in 2003, when the body enacted the "Fair and Accurate Credit Transactions Act of 2003" (FACTA). The Act preempts some state privacy protections, but includes a number of improvements to credit reporting law, including free credit reports annually.
What You Can Do to Protect Consumer Credit Reports
Be careful with your personally-identifying information, and in particular, do not reveal your Social Security Number, date of birth, or mother's maiden name to others, except when necessary. Request your credit report to inspect it for errors, to determine whether accounts have been opened without your knowledge or consent, and to see what entities are requesting your credit history. The CRA may charge you for access to your report. Currently, the charge as set by federal law is $9.
The FCRA's Provisions
Because credit reports can include sensitive personal information and because they are used to evaluate the ability to participate in so many different activities in modern life, they are subject regulations that follow a framework of Fair Information Practices.
The FCRA establishes rights and responsibilities for "consumers," "furnishers," and "users" of credit reports:
- Consumers are individuals.
- Furnishers are entities that send information to CRAs regarding creditworthiness in the normal course of business.
- Users of credit reports are entities that request a report to evaluate a consumer for some purpose.
What qualifies as a Credit Reporting Agency (CRA)?
A consumer reporting agency (CRA) is an entity that assembles and sells credit information and financial information about individuals.
There are three national CRAs in the United States: Experian (formerly TRW), Trans Union, and Equifax (formerly Retail Credit Co.). There are also many smaller credit reporting agencies that usually concentrate on reporting on individuals living in certain regions of the country.
Inspection bureaus, companies that sell information to insurance companies and assist in performing background checks, often are considered CRAs as well. Tenant screening and check approval companies are also considered CRAs.
Depending on the nature of the operation, other companies can be considered CRAs. Courts have held that private investigators, detective agencies, collection agencies, and even college placement offices can be CRAs under the law.
Consumer Credit Reports and Investigative Consumer Reports (ICRs)
Consumer credit reports contain information on financial accounts, and include credit card balances and mortgage information. Credit reports are used for evaluating eligibility for credit, insurance, employment, and tenancy; the ability to pay child support; professional licensing (for instance, to become an attorney); or for any purpose that a consumer approves.
A consumer credit report will contain basic identifying information (name, address, previous address, Social Security Number, marital status, employment information, number of children) along with:
- Financial information: Estimated income, employment, bank accounts, value of car and home.
- Public records information: Such as arrests, bankruptcies, and tax liens.
- Tradelines: Credit accounts and their status. This will also include the data subject's payment habits on credit accounts.
- Collection Items: Whether the data subject has unpaid or disputed bills.
- Current Employment and employment history.
- Requests for the credit report: The number of requests for the data subject's report and the identity of the requestors.
- Narrative information: A statement by the data subject or by the furnisher regarding disputed items on the credit report.
- Health information.
Certain information about consumers are excluded from the definition of "credit report." This includes "transaction and experience" information, that is, records of purchases of goods and services by the consumer. Additionally, corporations may share credit report information among affiliates as long as notice and opt-out is provided to the consumer.
CRAs can also prepare "investigative consumer reports," (ICRs) dossiers on consumers that include information on character, reputation, personal characteristics, and mode of living. ICRs are complied from personal interviews with persons who know the consumer. Since ICRs include especially sensitive information, the FCRA affords greater protections for them. For instance, within three days of requesting an ICR, the requestor must inform the consumer that an ICR is being compiled. The consumer also can request a statement explaining the nature and scope of the investigation underlying the ICR.
The Credit "Score"
The credit score is a "grade" of creditworthiness. Individuals with good credit scores can obtain credit more easily, and at lower interest rates. The precise algorithm used to develop the credit score is not publicly known. However, the following factors probably affect the overall number: the amount of money owed to creditors, payment history, whether the individual is seeking new extensions of credit, and the types of credit lines that an individual currently holds.
The Fair and Accurate Credit Transactions Act of 2003 (FACTA), which amended the FCRA, now requires CRAs to disclose a consumer's credit score for a "fair and reasonable fee" (to be determined by the FTC). The disclosure must include the score along with the range of possible scores. Mortgage lending companies must also provide the credit score upon request, in addition to the key factors of the underlying automated underwriting system if one is used. Some credit services companies also sell the credit score and advice for improving it for a fee.
- Credit Score Accuracy and Implications for Consumers (PDF), National Credit Reporting Association (NCRA) and the Consumer Federation of America (CFA), December 2002.
- Richard Le Febvre, AAA American Credit Bureau.
- Credit Where Credit Is Due, Washington Post, January 2, 2003.
- Survey of Three Big Sources Finds Credit Scores Can Clash, Wall Street Journal, December 18, 2002.
- Flaws in Credit Reports Could Hurt Millions of Consumers, Wall Street Journal, December 17, 2002.
- Credit-Scoring Firms Push Sale of Data to Consumers, Wall Street Journal, November 20, 2002.
- Know the Score Before You Borrow, Klipinger Personal Finance, March 6, 2002.
Your Right to Access Your Credit File
You can request your file by contacting the CRA directly. The CRA may charge you a fee for access, which currently is set by the FTC at $9.00. However, six states (Colorado, Georgia, Maryland, Massachusetts, New Jersey, and Vermont) have passed laws that require CRAs to issue a free report to residents upon request. Other states have set a reduced price by statute (Connecticut, Maine, Minnesota, California, and Montana).
You have a right to a free copy when an entity takes an "adverse action" against you based in whole or part on the report. Adverse actions are defined broadly under the act. They include: denial, termination, or an unfavorable change in the offer of credit or insurance; denial or an unfavorable change in employment or licensing. After an adverse action, the user of the credit report must send the individual information on how to obtain a free credit report from the CRA.
Free copies are also justified where the individual is unemployed and seeking employment, where the report is inaccurate because of fraud, and where the individual is on welfare.
Under the Fair and Accurate Credit Transactions Act of 2003 that amended the FCRA, consumers may now request a free annual credit report from each of the three major CRAs. This right will be made available incrementally over time based on geographic location. Although credit reports are made available to users (credit granting companies) instantaneously, consumers will have to wait up to fifteen days to receive their copies. Within one year, the FTC must establish a centralized source where consumers can request these reports. "Nationwide specialty credit reporting agencies" -- insurance, landlord-tenant, employment agencies-- will also be required to provide one free annual credit report upon request.
- Equifax 800.685.1111.
- Experian 888.397.3742.
- Trans Union 800.916.8800.
The Credit "Header"
A credit header is identifying information from a credit report. It includes name, mother's maiden name, date of birth, sex, address, prior addresses, telephone number, and the Social Security Number.
Credit headers came into use after the FTC changed its definition of a credit report in the course of settling a case against TRW (now Experian). The FTC allowed the CRAs to treat headers as "above the line" information and to sell it with no legal protections for the individual. The reasoning was that this information did not relate to credit, and thus should not be considered part of the credit report.
Credit headers are used for location of individuals and for target marketing. They are sold in bulk by the CRAs and can be purchased online.
- Ed Mierzwinski, Data Dealers Seizing Control Over Our Lives, US PIRG.
- Statement of Edmund Mierzwinski, Consumer Program Director, U.S. Public Interest Research Group Testimony Before the Subcommittee on Social Security of the House Committee on Ways and Means Hearing on Use and Misuse of Social Security Numbers, May 22, 2001.
Risk-Based Pricing Notices
The Fair and Accurate Credit Transactions Act of 2003, which updates the FCRA, requires that a creditor notify a consumer when it offers her credit terms that are "materially less favorable than the most favorable terms available to a substantial proportion of consumers." Previous to the amendments, creditors were not required to so inform consumers when the negative information in the credit report resulted in the offer of poor credit terms.
The Fair and Accurate Credit Transactions Act of 2003 restricts CRAs from reporting medical information in reports that will be used for employment, credit transactions or insurance transactions unless the consumer consents to such disclosures. The consent must be (a) in writing, (b) specific and (c) descriptive of the use for which the agency is disclosing the information (these specific requirements for consent are not necessary if the disclosure if for an insurance transaction). Furthermore, CRAs are prohibited from disclosing the name, address and telephone number of the medical furnisher (e.g. the hospital) responsible for specific information in the report. Creditors are disallowed from using consumer medical information in deciding whether to grant, or to continue granting, credit to a consumer.
Although the sharing of information between affiliates is generally excluded, medical information is extended additional protection. The following types of information are protected: an individualized list or description based on the consumer's payment transactions for medical products or services, or an aggregate list of consumers who paid for a medical product or service. On the other hand, exceptions are provided for certain information exchanges including those related to insurance transactions and disclosures authorized by the Department of Health and Services.
Special Rights in the Employment Context--Background Checks
Since September 11, 2001, many employers have either begun or expanded background check programs on current employees or new hires. Because they have become so prevalent, simple background checks can now be done for under $20, and more complex investigations may be hundreds of dollars.
Employers can request standard consumer credit reports or investigative consumer reports (ICRs) on their employees. Employers request the reports for hiring, promotion, reassignment, or retention decisions. In doing so, the employer must certify to the CRA that it will comply with the FCRA. The employer must also gain the individual's written consent before obtaining the report.
A patchwork of federal and state laws do limit the ability of employers to use background checks. Some states do not allow the consideration of arrest data (without a conviction) in employment decisions. Other states allow the consideration of conviction information only in certain circumstances. And, federal Equal Employment Opportunity Commission (EEOC) regulations prevent employers from taking adverse action against an individual for merely having a criminal conviction--the conviction must be relevant to the job, or there must be some other sound business reason for taking action against the individual.
The Fair and Accurate Credit Transactions Act of 2003, which updated the FCRA, excluded additional categories of employee investigation data from credit reports, thus eli mating protections offered by the FCRA. If the investigation is of suspected misconduct relating to employment, compliance with the law, or compliance with preexisting written policies of the employer, such information is not regulated by the FCRA. However, if the employer takes an adverse action due to such investigations, the employee has a right of notice.
The FCRA also prohibits the provision of reports that contain medical information for employment purposes without notice and explicit affirmative consent for release of the health data.
It is important to note that the FCRA does not apply to investigations performed by companies or individuals who are not CRAs.
Law Enforcement Access to the Credit Report
Federal, state, and municipal agencies can obtain basic identifying information (name, address, former address, employment) on any consumer through a CRA.
For many years, the FBI has had access to credit reports for counterintelligence purposes. In order to obtain the report, the FBI has to certify that the information is necessary for "the conduct of an authorized investigation to protect against international terrorism or clandestine intelligence activities." FBI access to the credit report is secret--the CRA is not allowed is disclose that the consumers' file was accessed. The Attorney General is required to report semiannually on the requests made by the FBI for credit reports to Congress.
The USA PATRIOT Act, passed in the wake of the September 11, 2001 terrorist attacks, broadened law enforcement access to credit reports. 15 U.S.C. § 1681v allows any government agency that is authorized to conduct intelligence or counterintelligence investigations or analysis of international terrorism to gain access to credit reports. Similar to the FBI access provision, the agency must certify that the credit report is necessary for investigation or analysis. The CRA is not permitted to disclose that the government agency sought the credit report. But, unlike the FBI provision, requests made under § 1681v do not have to be disclosed to Congress. It is likely that the FBI will use this new route to obtain credit reports than the former one because it lacks the reporting requirement.
State Protections May Be Broader than the FCRA ("Preemption")
The FCRA, like many other privacy statutes, provides a federal baseline of protections for individuals. The FCRA is only partially preemptive, meaning that except in a few narrow circumstances, state legislatures may pass laws to supplement the protections made by the FCRA. Some states have passed laws requiring the CRAs to provide reduced cost, or free credit reports. For detailed information about preemption, see EPIC's Privacy and Preemption Page.
Prior to the Fair and Accurate Credit Transactions Act of 2003 (FACTA) amendments, the FCRA provided that state laws passed after January 1, 2004 that offered greater protections for consumers would preempt the federal FCRA law. With this date -- and threat to the credit reporting industry -- fast approaching, the financial industry worked with Congress to develop and pass the 2003 FACTA amendments, eliminating this provision.
FACTA also overhauled other preemption provisions in FCRA. In "exchange" for the additional rights provided to consumers, broad preemption power was given to the FCRA in the 2003 amendments. All "subject matter" preemption provisions were retained, including matters such as the consumers' right to opt-out of prescreening reports and affiliate exchange of information (except a Vermont law which remains effective). Additionally, other subject matter preemptions were implemented, including the right to opt-out of certain affiliate marketing. The FACTA provides further preemptions for disclosure of credit scores (subject to certain exceptions for existing California and Colorado statutes). Finally, free credit reports are also preemptively regulated by the FACTA (except for existing statutes in CO, GA, ME, MA, NJ, and VA).
The extent to which the FACTA preempts state identity theft laws remains unclear. The provisions appear to allow states to enact stronger laws to protect their citizens from identity theft. But certain areas of identity theft regulation are then specifically excepted, thus again providing preemption. These include areas such truncation of credit/debit card numbers on electronic receipts and requiring CRAs to block identity-theft related information.
Right to Correct Inaccurate Information
Individuals may dispute inaccurate information that appears in a credit report. CRAs are required to investigate disputes and provide a report back to the consumer. If the CRA cannot resolve the dispute, the individual can add a statement to the credit report. Inaccurate or unverifiable information must be removed within 30 days of notice of the dispute. The Fair and Accurate Credit Transactions Act of 2003 (FACTA) -- amendments to the FCRA -- requires that investigation be "reasonable," although this standard is much lower than the requirements in creating the credit report which specify that there be "reasonable procedures to assure maximum possible accuracy."
Individuals may also dispute inaccurate information with the furnisher. If an individual disputes inaccurate information with a furnisher, that furnisher cannot report the information to a CRA without also including a notice of the dispute. If a furnisher determines that the information is inaccurate, it must block that information from being re-reported to CRAs -- a common and major problem in the credit reporting industry.
The FCRA limits the length of time some information can appear in a consumer report. For instance, bankruptcies must be removed from the report after 10 years. Civil suits, civil judgments, paid tax liens, accounts placed for collection, and records of arrest can only appear for 7 years. Records of criminal convictions can remain on the report indefinitely.
The FACTA provides consumers with additional rights to accurate credit information furnishing and reporting. The agencies that oversee FCRA enforcement will issue guidelines and regulations for credit information furnishers to ensure information accuracy and integrity.
Consumers may now directly dispute fraudulent transactions with the furnisher, the result of another FACTA amendment. Previously, a consumer was forced to pursue the dispute only with the CRA. The furnisher must investigate the disputed transactions and inform the consumer of the results. In exchange for this new right, the credit reporting industry successfully lobbied for a provision requiring that consumers be the party to initiate the dispute, disallowing "credit repair" agencies from disputing the transactions on behalf of the consumer. Additionally, the standard applied to furnishers in supplying credit information has been raised. Previously the FCRA required a furnisher to not report information that it "knows or consciously avoids knowing that the information is inaccurate." The FCRA now requires that a CRA not report information that it "knows or has reasonable cause to believe is inaccurate."On the "other end," when a CRA determines that transaction information is fraudulent, it must notify the furnisher that the information has been modified or deleted.
Before the 2003 FACTA amendments, one of consumers' only opportunities to discover the existence of negative information on their credit reports was when they were subjected to an adverse credit decision by an credit granting company. Now, when a furnisher reports negative information, it must notify the consumer within thirty days using a thirty word maximum notice to be designed by the Federal Reserve Board. Unfortunately, it appears that furnishers will be able to avoid meaningful notices because they can insert the notice with the standard contract documentation.
The FCRA affords individuals a private right of action that can be pursued in federal or state court against CRAs, users of credit reports, and furnishers. In certain circumstances, individuals can obtain attorney's fees, court costs, and punitive damages. Additionally, the FTC can enforce provisions of the act. Criminal penalties can be brought against those who knowingly and willfully obtain a consumer report under false pretenses.
The "qualified immunity provision" limits the situations in which a consumer can pursue legal action against a CRA. For the certain types of disclosures -- disclosures to consumers, condition and form of disclosure to consumers, requirements on users, and disclosure by user after taking adverse action against a consumer -- a consumer may only bring suit if the CRA acted with "malice or willful intent to injure." The Fair and Accurate Credit Transactions Act of 2003 (FACTA) amendments to the FCRA expanded the enumerated list of types of disclosure for which CRA liability is limited in this way. These new types of disclosures, which if violated are limited by the qualified immunity, include, among others: the requirement that agencies withhold the last five SSN digits when requested by a consumer; allowing identity theft victims to obtain business transaction information from businesses that have done business with the thief; and requiring mortgage lenders to disclose credit scores to loan applicants.
Furthermore, FACTA incorporated the new furnisher responsibilities into the qualified immunity provisions. These include, for example, requiring financial institutions to notify customers that they are furnishing negative information to CRAs about that customer -- into the qualified immunity provision. Other liability provisions were also limited by FACTA with respect to other new responsibilities established by the amendments. One such limitation prevents consumers from forcing a CRA to issue red flag guidelines and regulations.
The ability of states to pursue legal action against a CRA was also limited by the FACTA amendments. Even for major violations -- failure to provide accurate information, failure to comply with guidelines to protect accuracy and integrity of consumer information, etc. -- states must first obtain an injunction against the CRA. Only then may it seek damages for violations of the FCRA.
The FACTA added significant identity theft provisions to the FCRA, but most of these provisions are remedial and will not prevent identity theft.
These include the ability to issue one-call fraud alerts, extended fraud alerts and active military duty alerts. Additionally, new responsibilities are placed on users of credit reports (e.g. a lending company). These include red-flag guidelines, providing identity theft victims with business transaction information, and protecting certain consumer information.
All fraud alerts are now "one-call." If an agency receives a request for a fraud alert, it must notify the other CRAs also. The fraud alert is also communicated to users requesting the consumer's credit report. Additionally, the CRA must notify the consumer of her right to a free credit report which the FACTA requires to be delivered within three days of request. "Initial fraud alerts" last for ninety days.
A fraud alert indicates that a consumer does not authorize new credit, an additional card on an existing account, or increases in the credit limit of an existing account. A consumer may provide a telephone contact number in which case a credit user must verify the consumer's identity over the phone on that number. An exception to that rule allows a credit user to "take reasonable steps" instead of calling the consumer for an "initial fraud alert" or an "active military duty alert."
If the consumer has filed a report with a law enforcement agency, she may request an "extended fraud alert" that lasts for seven years. CRAs must also exclude the consumer from prescreening lists for five years. Finally, it must notify the consumer of her right to two free credit reports within twelve months of the fraud alert request. Deployed military personnel can request an "active military duty alert" that remains active for twelve months.
The FACTA requires the FTC, the National Credit Union Administration, and other certain banking agencies to jointly issue regulations requiring creditors to establish "reasonable policies and procedures" for implementing "red flag" guidelines regarding identity theft. Additionally, businesses who have dealt with an identity thief must, under certain circumstances, provide information about those transactions to the identity theft victim. However, the rule is weakened by several provisions, the absence of a consumer's enforcement action, and preemption of state law.
FCRA also now limit data disclosures that can lead to identity theft. Merchants will be required, over time, to truncate credit and debit numbers on electronically printed receipts. Consumers will also have the right to request that a CRA withhold their last five SSN digits on credit reports.
Inadequate CRA security also can contribute to identity theft. In November 2002, a prosecution was brought against a group of suspects who allegedly orchestrated the theft of 30,000 individuals' identities. The suspects used terminals that are commonly present in auto dealerships and apartment finding companies to gain access to thousands of credit reports. The reports were then used to open new lines of credit in others' names.
The FACTA also provides new rights for those that have suffered identity theft. CRAs and credit furnishers must help identity theft victims recover and restore their credit history. If a consumer can show a CRA that identity theft data is included in their report, the CRA must block that information within four days and notify the furnisher of the report of the fraudulent data. The consumer must establish proof of identity, a copy of an identity theft report, the fraudulent information, and a statement that the information is unrelated to any transaction of the consumer.
Furnishers of credit information also have new responsibilities under FACTA. Upon notification of fraudulent data by either a CRA or the consumer herself, the furnisher must not re-send the fraudulent data. Also, for such fraudulent information, the furnisher may not sell the debt, transfer the debt, or place it for collection. A debt collector who is notified by the consumer that the debt may be fraudulent or may have resulted from identity theft is obligated to notify creditors of the fraudulent debt. Finally, a nationwide CRA that receives an identity theft complaint must -- as with identity theft "fraud alerts" -- notify the other CRAs.
The statute of limitations for bringing an action for a violation of the FCRA is two years from the date of discovery of the violation by the consumer, although the action must be brought within five years of the date of the actual violation.
Comprehensive resources on identity theft can be found online at the Privacy Rights Clearinghouse Web Site, the Identity Theft Resource Center Web Site, Mari Frank's Identitytheft.org, the Federal Trade Commission Web Site, and on the Web Site of your State Attorney General.
- Identity Theft: What to Do if It Happens to You, CALPIRG and Privacy Rights Clearinghouse.
- What Can Consumers Do To Avoid Becoming Theft of Identity Victims?, US PIRG.
- Thanks for Not Stealing My Identity, New York Times, December 6, 2002.
- Identity Theft More Often an Inside Job, Old Precautions Less Likely to Avert Costly Crime, Experts Say, Washington Post, December 3, 2002.
- Huge Identity Theft Ring Busted, MSNBC, November 25, 2002.
Consumer Credit Reports Are Often Inaccurate
In order to gain passage of the FCRA in 1970, consumer advocates gave CRAs a big concession--immunity from defamation lawsuits based on information in the reports. Since defamation actions are limited, individuals often obtain redress against CRAs by suing for failure to correct inaccurate information
A March 1998 study conducted by US Public Interest Research Group (US PIRG) showed that 29% of credit reports contained serious inaccuracies (false judgments, false delinquency notices) that could result in denial of credit. Overall, PIRG found that 70% of reports had some type of error. Further, 20% of reports were missing creditworthiness information that would have assisted a consumer in obtaining credit. This results in lost jobs, denied mortgage applications, and higher interest rates for those who do obtain credit.
In the early 1990s, TRW (now Experian) identified all 3,000 residents of Norwich, Vermont as delinquent in property taxes, and failed to correct the inaccuracy after individuals identified the error.
Credit reports can also be inaccurate where there is incomplete information. In 1999, several banks admitted to withholding positive information about individuals so that their customers would not be lured away by competitors offering better credit terms. A 1999 Office of the Comptroller of the Current press release reads: "Some lenders appear to have stopped reporting information about sub prime borrowers to protect against their best customers being picked off by competitors."
US PIRG has recommended some solutions to credit report inaccuracies: First, the CRAs should mail free reports to consumers once a year so that consumers can check the accuracy of their files. Second, the CRAs should be placed on a greater obligation to correct errors and ensure the accuracy of information. This includes repealing portions of the FCRA that give defamation immunity to CRAs. Last, the FTC should ensure that consumers can contact CRA personnel to make corrections.
- Data on Complaints to the FTC Regarding the Credit Reporting Agencies, FTC, June 2003.
- Comptroller Urges Industry to End Abusive Practices And Elevate Customer Service Standards, OCC Press Release, June 7, 1999.
- Mistakes Do Happen: Credit Report Errors Mean Consumers Lose, US PIRG, March 1998.
- What to do if your credit report is wrong, and/or you're the victim of theft of identity.