# s a public service, the staff of the Federal Trade Commission (FTC) has (2026)

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/agency%3Aftc%3A96e51d1dd06d40ba

## Record

- **Collection:** Agency decision
- **Document type:** Agency decision

## Text

Fair Credit
Reporting
Act
15 U.S.C § 1681

Revised
March 2026

A

s a public service, the staff of the Federal Trade Commission (FTC) has
prepared the following complete text of the Fair Credit Reporting Act
(FCRA), 15 U.S.C. § 1681 et seq. Although staff generally followed the
format of the U.S. Code as published by the Government Printing Office, the
format of this text does differ in minor ways from the Code (and from West’s
U.S. Code Annotated). For example, this version uses FCRA section numbers
(§§ 601-629) in the headings. (The relevant U.S. Code citation is included with
each section heading and each reference to the FCRA in the text.) Although the
staff has made every effort to transcribe the statutory material accurately, this
compendium is intended only as a convenience for the public and not a substitute
for the text in the U.S. Code.
This version of the FCRA includes the amendments to the FCRA set forth
in the Consumer Credit Reporting Reform Act of 1996 (Public Law 104-208, the
Omnibus Consolidated Appropriations Act for Fiscal Year 1997, Title II, Subtitle
D, Chapter 1), Section 311 of the Intelligence Authorization for Fiscal Year 1998
(Public Law 105-107), the Consumer Reporting Employment Clarification Act of
1998 (Public Law 105-347), Section 506 of the Gramm-Leach-Bliley Act (Public
Law 106-102), Sections 358(g) and 505(c) of the Uniting and Strengthening
America by Providing Appropriate Tools Required to Intercept and Obstruct
Terrorism Act of 2001 (USA PATRIOT Act) (Public Law 107-56), the Fair and
Accurate Credit Transactions Act of 2003 (FACT Act) (Public Law 108-159),
Section 719 of the Financial Services Regulatory Relief Act of 2006 (Public Law
109-351), Section 743 (Div. D, Title VII) of the Consolidated Appropriations Act
of 2008 (Public Law 110-161), the Credit and Debit Card Receipt Clarification
Act of 2007 (Public Law 110-241), and Sections 205 and 302 of the Credit Card
Accountability Responsibility and Disclosure (CARD) Act of 2009 (Public Law
111-24), the Consumer Financial Protection Act of 2010 (CFPA) (Title X of the
Dodd-Frank Wall Street Reform and Consumer Protection Act, Public Law 111203), and the Red Flag Program Clarification Act of 2010 (Public Law 111-203),
and Sections 301, 302, and 602 of the Economic Growth, Regulatory Relief,
and Consumer Protection Act (Public Law 115-174), the William M. (Mac)
Thornberry National Defense Authorization Act for Fiscal Year 2021 (Public Law
116-283), the National Defense Authorization Act for Fiscal Year 2022 (Public
Law 117-81), and the Homebuyers Privacy Protection Act (Public Law 119-36).
The Commission website posted this document on March 4, 2026.
The provisions added to the FCRA by the FACT Act became effective
at different times. In some cases, the provision includes its own effective date.
In other cases, the FACT Act provides that the effective dates be prescribed by
the FTC and Federal Reserve Board. See 16 CFR Part 602 (69 Fed. Reg. 6526;
February 11, 2004) (69 Fed. Reg. 29061; May 20, 2004).
The provisions added to the FCRA by the CFPA became effective on
July 21, 2011, the “designated transfer date” on which the Bureau of Consumer
Financial Protection assumed certain duties specified by the CFPA. See 75 Fed.
Reg. 57252 (Sept. 20, 2010).

Contents
§ 601.
§ 602.
§ 603.
§ 604.
§ 605.

Short title . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Congressional findings and statement of purpose [15 U.S.C. § 1681] . . . . . . 1
Definitions; rules of construction [15 U.S.C. § 1681a] . . . . . . . . . . . . . . . 1
Permissible purposes of consumer reports [15 U.S.C. § 1681b] . . . . . . . . . 10
Requirements relating to information contained in consumer reports
[15 U.S.C. § 1681c] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
§ 605A. Identity theft prevention; fraud alerts and active duty alerts
[15 U.S.C. § 1681c-1] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
§ 605B. Block of information resulting from identity theft [15 U.S.C. § 1681c-2] . . . 40
§ 605C. Adverse information in cases of trafficking [15 U.S.C. § 1681c-3] . . . . . . . 42
§ 606. Disclosure of investigative consumer reports [15 U.S.C. § 1681d] . . . . . . . 43
§ 607. Compliance procedures [15 U.S.C. § 1681e] . . . . . . . . . . . . . . . . . . . . . 45
§ 608. Disclosures to governmental agencies [15 U.S.C. § 1681f] . . . . . . . . . . . . 47
§ 609. Disclosures to consumers [15 U.S.C. § 1681g] . . . . . . . . . . . . . . . . . . . 47
§ 610. Conditions and form of disclosure to consumers [15 U.S.C. § 1681h] . . . . . 58
§ 611. Procedure in case of disputed accuracy [15 U.S.C. § 1681i] . . . . . . . . . . . 59
§ 612. Charges for certain disclosures [15 U.S.C. § 1681j] . . . . . . . . . . . . . . . . 67
§ 613. Public record information for employment purposes [15 U.S.C. § 1681k] . . 70
§ 614. Restrictions on investigative consumer reports [15 U.S.C. § 1681l] . . . . . . 71
§ 615. Requirements on users of consumer reports [15 U.S.C. § 1681m] . . . . . . 71
§ 616. Civil liability for willful noncompliance [15 U.S.C. § 1681n] . . . . . . . . . . 80
§ 617. Civil liability for negligent noncompliance [15 U.S.C. § 1681o] . . . . . . . . 81
§ 618.
§ 619.
§ 620.
§ 621.
§ 622.
§ 623.

Jurisdiction of courts; limitation of actions [15 U.S.C. § 1681p] . . . . . . . . 81
Obtaining information under false pretenses [15 U.S.C. § 1681q] . . . . . . . 81
Unauthorized disclosures by officers or employees [15 U.S.C. § 1681r] . . . 81
Administrative enforcement [15 U.S.C. § 1681s] . . . . . . . . . . . . . . . . . . 82
Information on overdue child support obligations [15 U.S.C. § 1681s-1] . . 87
Responsibilities of furnishers of information to consumer reporting
agencies [15 U.S.C. § 1681s-2] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
§ 624. Affiliate sharing [15 U.S.C. § 1681s-3] . . . . . . . . . . . . . . . . . . . . . . . . 99
§ 625. Relation to State laws [15 U.S.C. § 1681t] . . . . . . . . . . . . . . . . . . . . . 102
§ 626. Disclosures to FBI for counterintelligence purposes [15 U.S.C. § 1681u] . 105
§ 627. Disclosures to governmental agencies for counterterrorism purposes
[15 U.S.C. § 1681v] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
§ 628. Disposal of records [15 U.S.C. § 1681w] . . . . . . . . . . . . . . . . . . . . . 112
§ 629. Corporate and technological circumvention prohibited [15 U.S.C. § 1681x] 113
Legislative History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

§ 603 - 15 U.S.C. § 1681a

§ 601. Short title
This title may be cited as the “Fair Credit Reporting Act.”

§ 602. Congressional findings and statement of purpose
[15 U.S.C. § 1681]
(a)

Accuracy and fairness of credit reporting. The Congress makes the
following findings:
(1) The banking system is dependent upon fair and accurate credit
reporting. Inaccurate credit reports directly impair the efficiency of
the banking system, and unfair credit reporting methods undermine
the public confidence which is essential to the continued functioning
of the banking system.
(2) An elaborate mechanism has been developed for investigating and
evaluating the credit worthiness, credit standing, credit capacity,
character, and general reputation of consumers.
(3) Consumer reporting agencies have assumed a vital role in assembling
and evaluating consumer credit and other information on consumers.
(4) There is a need to insure that consumer reporting agencies exercise
their grave responsibilities with fairness, impartiality, and a respect
for the consumer’s right to privacy.

(b)

Reasonable procedures. It is the purpose of this title to require that
consumer reporting agencies adopt reasonable procedures for meeting the
needs of commerce for consumer credit, personnel, insurance, and other
information in a manner which is fair and equitable to the consumer, with
regard to the confidentiality, accuracy, relevancy, and proper utilization of
such information in accordance with the requirements of this title.

§ 603. Definitions; rules of construction [15 U.S.C. § 1681a]
(a)

Definitions and rules of construction set forth in this section are applicable
for the purposes of this title.

(b)

The term “person” means any individual, partnership, corporation, trust,
estate, cooperative, association, government or governmental subdivision
or agency, or other entity.

(c)

The term “consumer” means an individual.

(d)

Consumer Report
(1) In general. The term “consumer report” means any written, oral,
or other communication of any information by a consumer reporting
agency bearing on a consumer’s credit worthiness, credit standing,
1

§ 603 - 15 U.S.C. § 1681a

credit capacity, character, general reputation, personal characteristics,
or mode of living which is used or expected to be used or collected in
whole or in part for the purpose of serving as a factor in establishing
the consumer’s eligibility for
(A) credit or insurance to be used primarily for personal, family, or
household purposes;
(B) employment purposes; or
(C) any other purpose authorized under section 604 [§ 1681b].
(2) Exclusions. Except as provided in paragraph (3), the term “consumer
report” does not include
(A) subject to section 624, any
(i) report containing information solely as to transactions or
experiences between the consumer and the person making
the report;
(ii) communication of that information among persons related
by common ownership or affiliated by corporate control; or
(iii) communication of other information among persons
related by common ownership or affiliated by corporate
control, if it is clearly and conspicuously disclosed to
the consumer that the information may be communicated
among such persons and the consumer is given the
opportunity, before the time that the information is initially
communicated, to direct that such information not be
communicated among such persons;
(B) any authorization or approval of a specific extension of credit
directly or indirectly by the issuer of a credit card or similar device;
(C) any report in which a person who has been requested by a third
party to make a specific extension of credit directly or indirectly
to a consumer conveys his or her decision with respect to such
request, if the third party advises the consumer of the name and
address of the person to whom the request was made, and such
person makes the disclosures to the consumer required under
section 615 [§ 1681m]; or
(D) a communication described in subsection (o) or (x).1
(3) Restriction on sharing of medical information. Except for information
or any communication of information disclosed as provided in section
604(g)(3), the exclusions in paragraph (2) shall not apply with respect
1 Should be read as “(o) or (y)” because section 603(x) was re-designated as 603(y) in 2010 by the CFPA.
2

§ 603 - 15 U.S.C. § 1681a

to information disclosed to any person related by common ownership
or affiliated by corporate control, if the information is –

(e)

(A) medical information;
(B) an individualized list or description based on the payment
transactions of the consumer for medical products or services; or
(C) an aggregate list of identified consumers based on payment
transactions for medical products or services.
The term “investigative consumer report” means a consumer report or
portion thereof in which information on a consumer’s character, general
reputation, personal characteristics, or mode of living is obtained through
personal interviews with neighbors, friends, or associates of the consumer
reported on or with others with whom he is acquainted or who may have
knowledge concerning any such items of information. However, such
information shall not include specific factual information on a consumer’s
credit record obtained directly from a creditor of the consumer or from a
consumer reporting agency when such information was obtained directly
from a creditor of the consumer or from the consumer.

(f)

The term “consumer reporting agency” means any person which, for
monetary fees, dues, or on a cooperative nonprofit basis, regularly engages
in whole or in part in the practice of assembling or evaluating consumer
credit information or other information on consumers for the purpose of
furnishing consumer reports to third parties, and which uses any means or
facility of interstate commerce for the purpose of preparing or furnishing
consumer reports.

(g)

The term “file,” when used in connection with information on any
consumer, means all of the information on that consumer recorded and
retained by a consumer reporting agency regardless of how the information
is stored.

(h)

The term “employment purposes” when used in connection with a
consumer report means a report used for the purpose of evaluating a
consumer for employment, promotion, reassignment or retention as
an employee.

(i)

The term “medical information” –
(1) means information or data, whether oral or recorded, in any form
or medium, created by or derived from a health care provider or the
consumer, that relates to –
(A) the past, present, or future physical, mental, or behavioral
health or condition of an individual;
3

§ 603 - 15 U.S.C. § 1681a

(B) the provision of health care to an individual; or
(C) the payment for the provision of health care to an individual.
(2) does not include the age or gender of a consumer, demographic
information about the consumer, including a consumer’s residence
address or e-mail address, or any other information about a consumer
that does not relate to the physical, mental, or behavioral health or
condition of a consumer, including the existence or value of any
insurance policy.
(j)

Definitions Relating to Child Support Obligations
(1) The “overdue support” has the meaning given to such term in section
666(e) of title 42 [Social Security Act, 42 U.S.C. § 666(e)].
(2) The term “State or local child support enforcement agency” means a
State or local agency which administers a State or local program for
establishing and enforcing child support obligations.

(k)

Adverse Action
(1) Actions included. The term “adverse action” –

(A) has the same meaning as in section 701(d)(6) of the Equal
(B)

Credit Opportunity Act; and
means
(i) a denial or cancellation of, an increase in any charge for,
or a reduction or other adverse or unfavorable change in
the terms of coverage or amount of, any insurance,
existing or applied for, in connection with the
underwriting of insurance;
(ii) a denial of employment or any other decision for
employment purposes that adversely affects any current or
prospective employee;
(iii) a denial or cancellation of, an increase in any charge for,
or any other adverse or unfavorable change in the terms
of, any license or benefit described in section 604(a)(3)(D)
[§ 1681b]; and
(iv) an action taken or determination that is
(I) made in connection with an application that was made
by, or a transaction that was initiated by, any
consumer, or in connection with a review of an
account under section 604(a)(3)(F)(ii)[§ 1681b]; and
(II) adverse to the interests of the consumer.
4

§ 603 - 15 U.S.C. § 1681a

(2) Applicable findings, decisions, commentary, and orders. For purposes
of any determination of whether an action is an adverse action
under paragraph (1)(A), all appropriate final findings, decisions,
commentary, and orders issued under section 701(d)(6) of the Equal
Credit Opportunity Act by the Bureau or any court shall apply.
(l)

The term “firm offer of credit or insurance” means any offer of credit or
insurance to a consumer that will be honored if the consumer is determined,
based on information in a consumer report on the consumer, to meet the
specific criteria used to select the consumer for the offer, except that the
offer may be further conditioned on one or more of the following:
(1) The consumer being determined, based on information in the
consumer’s application for the credit or insurance, to meet specific
criteria bearing on credit worthiness or insurability, as applicable,
that are established
(A) before selection of the consumer for the offer; and
(B) for the purpose of determining whether to extend credit or
insurance pursuant to the offer.
(2) Verification
(A) that the consumer continues to meet the specific criteria used
to select the consumer for the offer, by using information
in a consumer report on the consumer, information in the
consumer’s application for the credit or insurance, or other
information bearing on the credit worthiness or insurability of
the consumer; or
(B) of the information in the consumer’s application for the credit
or insurance, to determine that the consumer meets the specific
criteria bearing on credit worthiness or insurability.
(3) The consumer furnishing any collateral that is a requirement for the
extension of the credit or insurance that was

(A) established before selection of the consumer for the offer of
credit or insurance; and
(B) disclosed to the consumer in the offer of credit or insurance.
(m) The term “credit or insurance transaction that is not initiated by the
consumer” does not include the use of a consumer report by a person with
which the consumer has an account or insurance policy, for purposes of
(1) reviewing the account or insurance policy; or
(2) collecting the account.
5

§ 603 - 15 U.S.C. § 1681a

(n)

The term “State” means any State, the Commonwealth of Puerto Rico, the
District of Columbia, and any territory or possession of the United States.

(o)

Excluded communications. A communication is described in this
subsection if it is a communication
(1) that, but for subsection (d)(2)(D), would be an investigative
consumer report;
(2) that is made to a prospective employer for the purpose of
(A) procuring an employee for the employer; or
(B) procuring an opportunity for a natural person to work for the
employer;
(3) that is made by a person who regularly performs such procurement;
(4) that is not used by any person for any purpose other than a purpose
described in subparagraph (A) or (B) of paragraph (2); and
(5) with respect to which
(A) the consumer who is the subject of the communication
(i) consents orally or in writing to the nature and scope of the
communication, before the collection of any information
for the purpose of making the communication;
(ii) consents orally or in writing to the making of the
communication to a prospective employer, before the
making of the communication; and
(iii) in the case of consent under clause (i) or (ii) given orally, is
provided written confirmation of that consent by the person
making the communication, not later than 3 business days
after the receipt of the consent by that person;
(B) the person who makes the communication does not, for the
purpose of making the communication, make any inquiry that
if made by a prospective employer of the consumer who is the
subject of the communication would violate any applicable
Federal or State equal employment opportunity law or
regulation; and
(C) the person who makes the communication
(i) discloses in writing to the consumer who is the subject of
the communication, not later than 5 business days after
receiving any request from the consumer for such
disclosure, the nature and substance of all information in
the consumer’s file at the time of the request, except that
6

§ 603 - 15 U.S.C. § 1681a

(p)

the sources of any information that is acquired solely for
use in making the communication and is actually used for
no other purpose, need not be disclosed other than under
appropriate discovery procedures in any court of competent
jurisdiction in which an action is brought; and
(ii) notifies the consumer who is the subject of the
communication, in writing, of the consumer’s right to
request the information described in clause (i).
The term “consumer reporting agency that compiles and maintains files
on consumers on a nationwide basis” means a consumer reporting agency
that regularly engages in the practice of assembling or evaluating, and
maintaining, for the purpose of furnishing consumer reports to third
parties bearing on a consumer’s credit worthiness, credit standing, or
credit capacity, each of the following regarding consumers residing
nationwide:
(1) Public record information.
(2) Credit account information from persons who furnish that
information regularly and in the ordinary course of business.

(q)

Definitions relating to fraud alerts.
(1) The term “active duty military consumer” means a consumer in
military service who –
(A) is on active duty (as defined in section 101(d)(1) of title 10,
United States Code) or is a reservist performing duty under a
call or order to active duty under a provision of law referred to
in section 101(a)(13) of title 10, United States Code; and
(B) is assigned to service away from the usual duty station of the
consumer.
(2) The terms “fraud alert” and “active duty alert” mean a statement in
the file of a consumer that –
(A) notifies all prospective users of a consumer report relating to
the consumer that the consumer may be a victim of fraud,
including identity theft, or is an active duty military consumer,
as applicable; and
(B) is presented in a manner that facilitates a clear and conspicuous
view of the statement described in subparagraph (A) by any
person requesting such consumer report.

7

§ 603 - 15 U.S.C. § 1681a

(3) The term “identity theft” means a fraud committed using the
identifying information of another person, subject to such further
definition as the Bureau may prescribe, by regulation.
See also 12 CFR Part 1022.3(h)

(4) The term “identity theft report” has the meaning given that term by
rule of the Bureau, and means, at a minimum, a report –
See also 12 CFR Part 1022.3(i)

(A) that alleges an identity theft;
(B) that is a copy of an official, valid report filed by a consumer
with an appropriate Federal, State, or local law enforcement
agency, including the United States Postal Inspection Service,
or such other government agency deemed appropriate by the
Bureau; and
(C) the filing of which subjects the person filing the report to
criminal penalties relating to the filing of false information if,
in fact, the information in the report is false.
(5) The term “new credit plan” means a new account under an open end
credit plan (as defined in section 103(i) of the Truth in Lending Act)
or a new credit transaction not under an open end credit plan.
(r)

Credit and Debit Related Terms
(1) The term “card issuer” means –
(A) a credit card issuer, in the case of a credit card; and
(B) a debit card issuer, in the case of a debit card.
(2) The term “credit card” has the same meaning as in section 103 of the
Truth in Lending Act.
(3) The term “debit card” means any card issued by a financial
institution to a consumer for use in initiating an electronic fund
transfer from the account of the consumer at such financial
institution, for the purpose of transferring money between accounts
or obtaining money, property, labor, or services.
(4) The terms “account” and “electronic fund transfer” have the same
meanings as in section 903 of the Electronic Fund Transfer Act.
(5) The terms “credit” and “creditor” have the same meanings as in
section 702 of the Equal Credit Opportunity Act.

(s)

The term “Federal banking agency” has the same meaning as in section 3
of the Federal Deposit Insurance Act.
8

§ 603 - 15 U.S.C. § 1681a

(t)

The term “financial institution” means a State or National bank, a State
or Federal savings and loan association, a mutual savings bank, a State or
Federal credit union, or any other person that, directly or indirectly, holds
a transaction account (as defined in section 19(b) of the Federal Reserve
Act) belonging to a consumer.

(u)

The term “reseller” means a consumer reporting agency that –
(1) assembles and merges information contained in the database of
another consumer reporting agency or multiple consumer reporting
agencies concerning any consumer for purposes of furnishing such
information to any third party, to the extent of such activities; and
(2) does not maintain a database of the assembled or merged information
from which new consumer reports are produced.

(v)

The term “Commission” means the Federal Trade Commission.

(w) The term “Bureau” means the Bureau of Consumer Financial Protection.
(x)

The term “nationwide specialty consumer reporting agency” means a
consumer reporting agency that compiles and maintains files on consumers
on a nationwide basis relating to –
(1) medical records or payments;
(2) residential or tenant history;
(3) check writing history;
(4) employment history; or
(5) insurance claims.

(y)

Exclusion of Certain Communications for Employee Investigations
(1) A communication is described in this subsection if –
(A) but for subsection (d)(2)(D), the communication would be a
consumer report;
(B) the communication is made to an employer in connection with
an investigation of –
(i) suspected misconduct relating to employment; or
(ii) compliance with Federal, State, or local laws and
regulations, the rules of a self-regulatory organization,
or any preexisting written policies of the employer;
(C) the communication is not made for the purpose of investigating
a consumer’s credit worthiness, credit standing, or credit
capacity; and
(D) the communication is not provided to any person except –
(i) to the employer or an agent of the employer;
9

604 - 15 U.S.C. § 1681b

(ii) to any Federal or State officer, agency, or department,
or any officer, agency, or department of a unit of general
local government;
(iii) to any self-regulatory organization with regulatory
authority over the activities of the employer or employee;
(iv) as otherwise required by law; or
(v) pursuant to section 608.
(2) Subsequent disclosure. After taking any adverse action based in
whole or in part on a communication described in paragraph (1), the
employer shall disclose to the consumer a summary containing the
nature and substance of the communication upon which the adverse
action is based, except that the sources of information acquired solely
for use in preparing what would be but for subsection (d)(2)(D) an
investigative consumer report need not be disclosed.
(3) For purposes of this subsection, the term “self-regulatory organization”
includes any self-regulatory organization (as defined in section 3(a)
(26) of the Securities Exchange Act of 1934), any entity established
under title I of the Sarbanes-Oxley Act of 2002, any board of trade
designated by the Commodity Futures Trading Commission, and any
futures association registered with such Commission.
(z)

Veteran. The term ‘veteran’ has the meaning given the term in section 101
of title 38, United States Code.

(aa) Veteran’s medical debt. The term ‘veteran’s medical debt’
(1) means a medical collection debt of a veteran owed to a non-Department
of Veterans Affairs health care provider that was submitted to the
Department for payment for health care authorized by the
Department of Veterans Affairs; and
(2) includes medical collection debt that the Department of Veterans
Affairs has wrongfully charged a veteran.

§ 604. Permissible purposes of consumer reports
[15 U.S.C. § 1681b]
(a)

In general. Subject to subsection (c), any consumer reporting agency may
furnish a consumer report under the following circumstances and no other:
(1) In response to the order of a court having jurisdiction to issue such
an order, a subpoena issued in connection with proceedings before
a Federal grand jury, or a subpoena issued in accordance with
section 5318 of title 31 or section 3486 of title 18.
10

604 - 15 U.S.C. § 1681b

(2) In accordance with the written instructions of the consumer to whom
it relates.
(3) To a person which it has reason to believe
(A) intends to use the information in connection with a credit
transaction involving the consumer on whom the information
is to be furnished and involving the extension of credit to, or
review or collection of an account of, the consumer; or
(B) intends to use the information for employment purposes; or
(C) intends to use the information in connection with the
underwriting of insurance involving the consumer; or
(D) intends to use the information in connection with a determination
of the consumer’s eligibility for a license or other benefit
granted by a governmental instrumentality required by law to
consider an applicant’s financial responsibility or status; or
(E) intends to use the information, as a potential investor or
servicer, or current insurer, in connection with a valuation of,
or an assessment of the credit or prepayment risks associated
with, an existing credit obligation; or
(F) otherwise has a legitimate business need for the information
(i) in connection with a business transaction that is initiated
by the consumer; or
(ii) to review an account to determine whether the consumer
continues to meet the terms of the account.2
(G) executive departments and agencies in connection with the
issuance of government-sponsored individually-billed travel
charge cards.2
(4) In response to a request by the head of a State or local child support
enforcement agency (or a State or local government official
authorized by the head of such an agency), if the person making the
request certifies to the consumer reporting agency that –
(A) the consumer report is needed for the purpose of establishing
an individual’s capacity to make child support payments,
determining the appropriate level of such payments, or enforcing
a child support order, award, agreement, or judgment;

2 As written in the 2007 amendment that added section 604(a)(3)(G). Subsection F(ii) should end with
“; or” instead of a period, and the text of subsection (g) should conform to the style of the rest of section
605(a)(3).
11

604 - 15 U.S.C. § 1681b

(B)

the parentage of the consumer for the child to which the
obligation relates has been established or acknowledged by the
consumer in accordance with State laws under which the
obligation arises (if required by those laws); and
(C) the consumer report will be kept confidential, will be used
solely for a purpose described in subparagraph (A), and will
not be used in connection with any other civil, administrative,
or criminal proceeding, or for any other purpose.
(5) To an agency administering a State plan under section 654 of title 42
for use to set an initial or modified child support award.
(6) To the Federal Deposit Insurance Corporation or the National Credit
Union Administration as part of its preparation for its appointment or
as part of its exercise of powers, as conservator, receiver, or
liquidating agent for an insured depository institution or insured
credit union under the Federal Deposit Insurance Act or the Federal
Credit Union Act, or other applicable Federal or State law, or in
connection with the resolution or liquidation of a failed or failing
insured depository institution or insured credit union, as applicable.
(b)

Conditions for furnishing and using consumer reports for
employment purposes.
(1) Certification from user. A consumer reporting agency may furnish a
consumer report for employment purposes only if
(A) the person who obtains such report from the agency certifies to
the agency that
(i) the person has complied with paragraph (2) with respect
to the consumer report, and the person will comply with
paragraph (3) with respect to the consumer report if
paragraph (3) becomes applicable; and
(ii) information from the consumer report will not be used
in violation of any applicable Federal or State equal
employment opportunity law or regulation; and
(B) the consumer reporting agency provides with the report, or
has previously provided, a summary of the consumer’s rights
under this title, as prescribed by the Bureau under section
609(c)(3) [§ 1681g].
(2) Disclosure to Consumer.
(A) In general. Except as provided in subparagraph (B), a person
may not procure a consumer report, or cause a consumer report
12

604 - 15 U.S.C. § 1681b

to be procured, for employment purposes with respect to any
consumer, unless –
(i) a clear and conspicuous disclosure has been made in
writing to the consumer at any time before the report is
procured or caused to be procured, in a document that
consists solely of the disclosure, that a consumer report
may be obtained for employment purposes; and
(ii) the consumer has authorized in writing (which authorization
may be made on the document referred to in clause (i)) the
procurement of the report by that person.
(B) Application by mail, telephone, computer, or other similar
means. If a consumer described in subparagraph (C) applies
for employment by mail, telephone, computer, or other similar
means, at any time before a consumer report is procured or
caused to be procured in connection with that application –
(i) the person who procures the consumer report on the
consumer for employment purposes shall provide to the
consumer, by oral, written, or electronic means, notice
that a consumer report may be obtained for employment
purposes, and a summary of the consumer’s rights under
section 615(a)(3); and
(ii) the consumer shall have consented, orally, in writing, or
electronically to the procurement of the report by that person.
(C) Scope. Subparagraph (B) shall apply to a person procuring a
consumer report on a consumer in connection with the
consumer’s application for employment only if –
(i) the consumer is applying for a position over which the
Secretary of Transportation has the power to establish
qualifications and maximum hours of service pursuant to
the provisions of section 31502 of title 49, or a
position subject to safety regulation by a State
transportation agency; and
(ii) as of the time at which the person procures the report
or causes the report to be procured the only interaction
between the consumer and the person in connection with
that employment application has been by mail, telephone,
computer, or other similar means.
(3) Conditions on use for adverse actions.

13

604 - 15 U.S.C. § 1681b

(A) In general. Except as provided in subparagraph (B), in using
a consumer report for employment purposes, before taking
any adverse action based in whole or in part on the report, the
person intending to take such adverse action shall provide to the
consumer to whom the report relates –
(i) a copy of the report; and
(ii) a description in writing of the rights of the consumer
under this title, as prescribed by the Bureau under section
609(c)(3).3
(B) Application by mail, telephone, computer, or other similar means.
(i) If a consumer described in subparagraph (C) applies for
employment by mail, telephone, computer, or other
similar means, and if a person who has procured a
consumer report on the consumer for employment
purposes takes adverse action on the employment
application based in whole or in part on the report,
then the person must provide to the consumer to whom
the report relates, in lieu of the notices required under
subparagraph (A) of this section and under section 615(a),
within 3 business days of taking such action, an oral,
written or electronic notification –
(I) that adverse action has been taken based in whole
or in part on a consumer report received from a
consumer reporting agency;
(II) of the name, address and telephone number of
the consumer reporting agency that furnished the
consumer report (including a toll-free telephone
number established by the agency if the agency
compiles and maintains files on consumers on a
nationwide basis);
(III) that the consumer reporting agency did not make the
decision to take the adverse action and is unable to
provide to the consumer the specific reasons why the
adverse action was taken; and
(IV) that the consumer may, upon providing proper
identification, request a free copy of a report and may
dispute with the consumer reporting agency the
accuracy or completeness of any information in a report.
3 The references in Sections 604(b)(3)(A) and 604(b)(3)(B) should be to Section 609(c)(1), not (c)(3) that no
longer exists as the result of Congress’ re-organization of Section 609(c) in 2003 (FACT Act).
14

604 - 15 U.S.C. § 1681b

(ii) If, under clause (B)(i)(IV), the consumer requests a copy
of a consumer report from the person who procured the
report, then, within 3 business days of receiving the
consumer’s request, together with proper identification,
the person must send or provide to the consumer a copy of
a report and a copy of the consumer’s rights as prescribed
by the Bureau under section 609(c)(3).3
(C) Scope. Subparagraph (B) shall apply to a person procuring a
consumer report on a consumer in connection with the
consumer’s application for employment only if –
(i) the consumer is applying for a position over which the
Secretary of Transportation has the power to establish
qualifications and maximum hours of service pursuant to
the provisions of section 31502 of title 49, or a
position subject to safety regulation by a State
transportation agency; and
(ii) as of the time at which the person procures the report
or causes the report to be procured the only interaction
between the consumer and the person in connection with
that employment application has been by mail, telephone,
computer, or other similar means.
(4) Exception for national security investigations.
(A) In general. In the case of an agency or department of the
United States Government which seeks to obtain and use a
consumer report for employment purposes, paragraph (3) shall
not apply to any adverse action by such agency or department
which is based in part on such consumer report, if the head of
such agency or department makes a written finding that –
(i) the consumer report is relevant to a national security
investigation of such agency or department;
(ii) the investigation is within the jurisdiction of such agency
or department;
(iii) there is reason to believe that compliance with paragraph (3)
will –
(I) endanger the life or physical safety of any person;
(II) result in flight from prosecution;
(III) result in the destruction of, or tampering with,
evidence relevant to the investigation;
15

604 - 15 U.S.C. § 1681b

(IV) result in the intimidation of a potential witness
relevant to the investigation;
(V) result in the compromise of classified information; or
(VI) otherwise seriously jeopardize or unduly delay the
investigation or another official proceeding.
(B) Notification of consumer upon conclusion of investigation.
Upon the conclusion of a national security investigation
described in subparagraph (A), or upon the determination that
the exception under subparagraph (A) is no longer required for
the reasons set forth in such subparagraph, the official exercising
the authority in such subparagraph shall provide to the consumer
who is the subject of the consumer report with regard to which
such finding was made –
(i) a copy of such consumer report with any classified
information redacted as necessary;
(ii) notice of any adverse action which is based, in part, on
the consumer report; and
(iii) the identification with reasonable specificity of the nature of
the investigation for which the consumer report was sought.
(C) Delegation by head of agency or department. For purposes of
subparagraphs (A)and (B), the head of any agency or department
of the United States Government may delegate his or her
authorities under this paragraph to an official of such agency or
department who has personnel security responsibilities and is a
member of the Senior Executive Service or equivalent civilian
or military rank.
(D) Definitions. For purposes of this paragraph, the following
definitions shall apply:
(i) Classified information. The term “classified information”
means information that is protected from unauthorized
disclosure under Executive Order No. 12958 or successor
orders.
(ii) National security investigation. The term “national security
investigation” means any official inquiry by an agency or
department of the United States Government to determine
the eligibility of a consumer to receive access or continued
access to classified information or to determine whether
classified information has been lost or compromised.
16

604 - 15 U.S.C. § 1681b

(c)

Furnishing reports in connection with credit or insurance transactions that
are not initiated by the consumer.
(1) In general. A consumer reporting agency may furnish a consumer
report relating to any consumer pursuant to subparagraph (A) or (C)
of subsection (a)(3) in connection with any credit or insurance
transaction that is not initiated by the consumer only if
(A) the consumer authorizes the agency to provide such report to
such person; or
(B) (i) the transaction consists of a firm offer of credit or insurance;
(ii) the consumer reporting agency has complied with
subsection (e);
(iii) there is not in effect an election by the consumer, made
in accordance with subsection (e), to have the consumer’s
name and address excluded from lists of names provided
by the agency pursuant to this paragraph; and
(iv) the consumer report does not contain a date of birth that
shows that the consumer has not attained the age of 21,
or, if the date of birth on the consumer report shows that
the consumer has not attained the age of 21, such
consumer consents to the consumer reporting agency to
such furnishing.
(2) Limits on information received under paragraph (1)(B). A person
may receive pursuant to paragraph (1)(B) only
(A) the name and address of a consumer;
(B) an identifier that is not unique to the consumer and that is used
by the person solely for the purpose of verifying the identity of
the consumer; and
(C) other information pertaining to a consumer that does not identify
the relationship or experience of the consumer with respect to a
particular creditor or other entity.
(3) Information regarding inquiries. Except as provided in section 609(a)
(5) [§ 1681g], a consumer reporting agency shall not furnish to any
person a record of inquiries in connection with a credit or
insurance transaction that is not initiated by a consumer.
(4)

Treatment of prescreening report requests
(A) Definitions. In this paragraph:

17

604 - 15 U.S.C. § 1681b

(i)

(B)

Credit union. The term “credit union” means a Federal
credit union or a State credit union, as those terms are
defined, respectively, in section 101 of the Federal Credit
Union Act (12 U.S.C. 1752).
(ii) Insured depository institution. The term “insured depository
institution” has the meaning given the term in section 3 of
the Federal Deposit Insurance Act (12 U.S.C. 1813(c)).
(iii) Residential mortgage loan. The term “residential mortgage
loan” has the meaning given the term in section 5102 of
title 12.
(iv) Servicer. The term “servicer” has the meaning given the
term in section 2605(i) of title 12.
Limitation. If a person requests a consumer report from
a consumer reporting agency in connection with a credit
transaction involving a residential mortgage loan, that agency
may not, based in whole or in part on that request, furnish a
consumer report to another person under this subsection unless(i) the transaction consists of a firm offer of credit or
insurance; and
(ii) that other person(I) has submitted documentation to that agency
certifying that such other person has, pursuant to
paragraph (1)(A), the authorization of the consumer
to whom the consumer report relates; or
(II) (aa) has originated a current residential mortgage
loan of the consumer to whom the consumer report
relates;
(bb) is the servicer of a current residential mortgage
loan of the consumer to whom the consumer report
relates; or
(cc) (AA) is an insured depository institution or
credit union; and
(BB) holds a current account for the consumer
to whom the consumer report relates.

(d)

Reserved.

(e)

Election of consumer to be excluded from lists.
(1) In general. A consumer may elect to have the consumer’s name and
address excluded from any list provided by a consumer reporting
18

604 - 15 U.S.C. § 1681b

agency under subsection (c)(1)(B) in connection with a credit or
insurance transaction that is not initiated by the consumer, by
notifying the agency in accordance with paragraph (2) that the
consumer does not consent to any use of a consumer report relating
to the consumer in connection with any credit or insurance
transaction that is not initiated by the consumer.
(2) Manner of notification. A consumer shall notify a consumer
reporting agency under paragraph (1)
(A) through the notification system maintained by the agency under
paragraph (5); or
(B) by submitting to the agency a signed notice of election form
issued by the agency for purposes of this subparagraph.
(3) Response of agency after notification through system. Upon receipt
of notification of the election of a consumer under paragraph (1)
through the notification system maintained by the agency under
paragraph (5), a consumer reporting agency shall
(A) inform the consumer that the election is effective only for the
5-year period following the election if the consumer does not
submit to the agency a signed notice of election form issued by
the agency for purposes of paragraph (2)(B); and
(B) provide to the consumer a notice of election form, if requested
by the consumer, not later than 5 business days after receipt of
the notification of the election through the system established
under paragraph (5), in the case of a request made at the time
the consumer provides notification through the system.
(4) Effectiveness of election. An election of a consumer under
paragraph (1)
(A) shall be effective with respect to a consumer reporting agency
beginning 5 business days after the date on which the consumer
notifies the agency in accordance with paragraph (2);
(B) shall be effective with respect to a consumer reporting agency
(i) subject to subparagraph (C), during the 5-year period
beginning 5 business days after the date on which the
consumer notifies the agency of the election, in the case of
an election for which a consumer notifies the agency only
in accordance with paragraph (2)(A); or
(ii) until the consumer notifies the agency under subparagraph
(C), in the case of an election for which a consumer
notifies the agency in accordance with paragraph (2)(B);
19

604 - 15 U.S.C. § 1681b

(C)

shall not be effective after the date on which the consumer
notifies the agency, through the notification system established
by the agency under paragraph (5), that the election is no
longer effective; and
(D) shall be effective with respect to each affiliate of the agency.
(5) Notification System
(A) In general. Each consumer reporting agency that, under
subsection (c)(1)(B), furnishes a consumer report in connection
with a credit or insurance transaction that is not initiated by a
consumer, shall
(i) establish and maintain a notification system, including a
toll-free telephone number, which permits any consumer
whose consumer report is maintained by the agency to
notify the agency, with appropriate identification, of the
consumer’s election to have the consumer’s name and
address excluded from any such list of names and addresses
provided by the agency for such a transaction; and
(ii) publish by not later than 365 days after the date of enactment
of the Consumer Credit Reporting Reform Act of 1996,
and not less than annually thereafter, in a publication of
general circulation in the area served by the agency
(I) a notification that information in consumer files
maintained by the agency may be used in connection
with such transactions; and
(II) the address and toll-free telephone number for
consumers to use to notify the agency of the
consumer’s election under clause (I).
(B) Establishment and maintenance as compliance. Establishment
and maintenance of a notification system (including a toll-free
telephone number) and publication by a consumer reporting
agency on the agency’s own behalf and on behalf of any of its
affiliates in accordance with this paragraph is deemed to be
compliance with this paragraph by each of those affiliates.
(6) Notification system by agencies that operate nationwide. Each
consumer reporting agency that compiles and maintains files on
consumers on a nationwide basis shall establish and maintain a
notification system for purposes of paragraph (5) jointly with other
such consumer reporting agencies.
20

604 - 15 U.S.C. § 1681b

(f)

Certain use or obtaining of information prohibited. A person shall not use
or obtain a consumer report for any purpose unless
(1) the consumer report is obtained for a purpose for which the consumer
report is authorized to be furnished under this section; and
(2) the purpose is certified in accordance with section 607 [§ 1681e]
by a prospective user of the report through a general or specific
certification.

(g)

Protection of Medical Information
(1) Limitation on consumer reporting agencies. A consumer reporting
agency shall not furnish for employment purposes, or in connection
with a credit or insurance transaction, a consumer report that contains
medical information (other than medical contact information treated
in the manner required under section 605(a)(6)) about a consumer,
unless –
(A) if furnished in connection with an insurance transaction, the
consumer affirmatively consents to the furnishing of the report;
(B) if furnished for employment purposes or in connection with a
credit transaction –
(i) the information to be furnished is relevant to process or
effect the employment or credit transaction; and
(ii) the consumer provides specific written consent for the
furnishing of the report that describes in clear and
conspicuous language the use for which the information
will be furnished; or
(C) the information to be furnished pertains solely to transactions,
accounts, or balances relating to debts arising from the receipt
of medical services, products, or devises, where such
information, other than account status or amounts, is restricted
or reported using codes that do not identify, or do not provide
information sufficient to infer, the specific provider or the
nature of such services, products, or devices, as provided in
section 605(a)(6).
(2) Limitation on creditors. Except as permitted pursuant to paragraph
(3)(C) or regulations prescribed under paragraph (5)(A), a creditor
shall not obtain or use medical information (other than medical
information treated in the manner required under section 605(a)(6))
pertaining to a consumer in connection with any determination of the
consumer’s eligibility, or continued eligibility, for credit.
21

604 - 15 U.S.C. § 1681b

(3) Actions authorized by federal law, insurance activities and regulatory
determinations. Section 603(d)(3) shall not be construed so as to treat
information or any communication of information as a consumer
report if the information or communication is disclosed –
(A) in connection with the business of insurance or annuities,
including the activities described in section 18B of the model
Privacy of Consumer Financial and Health Information
Regulation issued by the National Association of Insurance
Commissioners (as in effect on January 1, 2003);
(B) for any purpose permitted without authorization under the
Standards for Individually Identifiable Health Information
promulgated by the Department of Health and Human Services
pursuant to the Health Insurance Portability and Accountability
Act of 1996, or referred to under section 1179 of such Act, or
described in section 502(e) of Public Law 106-102; or
(C) as otherwise determined to be necessary and appropriate, by
regulation or order, by the Bureau or the applicable State
insurance authority (with respect to any person engaged in
providing insurance or annuities).
(4) Limitation on redisclosure of medical information. Any person that
receives medical information pursuant to paragraph (1) or (3) shall
not disclose such information to any other person, except as necessary
to carry out the purpose for which the information was initially
disclosed, or as otherwise permitted by statute, regulation, or order.
(5) Regulations and Effective Date for Paragraph (2)
(A)4 Regulations required. The Bureau may, after notice and
opportunity for comment, prescribe regulations that permit
transactions under paragraph (2) that are determined to be
necessary and appropriate to protect legitimate operational,
transactional, risk, consumer, and other needs (and which shall
include permitting actions necessary for administrative verification
purposes), consistent with the intent of paragraph (2) to restrict the
use of medical information for inappropriate purposes.
See also 12 CFR Parts 41/222/232/334/571/717, 70 Fed. Reg. 70664 (11/22/05)
4 As written in section 1088(a)(4)(B) of the CFPA in 2010. The previous version of section 604(b)(5),
added in 2003 by the FACT Act, contained two subsections (A) and (B). The latter stated that the rules
required to be prescribed by the Federal financial agencies (not including the Commission) be finalized
by June 4, 2004.

22

§ 605 - 15 U.S.C. § 1681c

(6) Coordination with other laws. No provision of this subsection shall
be construed as altering, affecting, or superseding the applicability of
any other provision of Federal law relating to medical confidentiality.

§ 605. Requirements relating to information contained in
consumer reports [15 U.S.C. § 1681c]
(a)

Information excluded from consumer reports. Except as authorized under
subsection (b) of this section, no consumer reporting agency may make
any consumer report containing any of the following items of information:
(1) Cases under title 11 [United States Code] or under the Bankruptcy
Act that, from the date of entry of the order for relief or the date
of adjudication, as the case may be, antedate the report by more
than 10 years.
(2) Civil suits, civil judgments, and records of arrest that from date of entry,
antedate the report by more than seven years or until the governing
statute of limitations has expired, whichever is the longer period.
(3) Paid tax liens which, from date of payment, antedate the report by
more than seven years.
(4) Accounts placed for collection or charged to profit and loss which
antedate the report by more than seven years.5
(5) Any other adverse item of information, other than records of
convictions of crimes which antedates the report by more than
seven years.5
(6) The name, address, and telephone number of any medical information
furnisher that has notified the agency of its status, unless –
(A) such name, address, and telephone number are restricted or
reported using codes that do not identify, or provide information
sufficient to infer, the specific provider or the nature of such
services, products, or devices to a person other than the
consumer; or
(B) the report is being provided to an insurance company for a
purpose relating to engaging in the business of insurance other
than property and casualty insurance.

5 The reporting periods have been lengthened for certain adverse information pertaining to U.S. Government
insured or guaranteed student loans, or pertaining to national direct student loans. See sections 430A(f) and
463(c)(3) of the Higher Education Act of 1965, 20 U.S.C. 1080a(f) and 20 U.S.C. 1087cc(c)(3), respectively.

23

§ 605 - 15 U.S.C. § 1681c

(7) With respect to a consumer reporting agency described in section
603(p), any information related to a veteran’s medical debt if the
date on which the hospital care, medical services, or extended care
services was rendered relating to the debt antedates the report by less
than 1 year if the consumer reporting agency has actual knowledge
that the information is related to a veteran’s medical debt and the
consumer reporting agency is in compliance with its obligation under
section 302(c)(5) of the Economic Growth, Regulatory Relief, and
Consumer Protection Act.
(8) With respect to a consumer reporting agency described in section
603(p), any information related to a fully paid or settled veteran’s
medical debt that had been characterized as delinquent, charged
off, or in collection if the consumer reporting agency has actual
knowledge that the information is related to a veteran’s medical
debt and the consumer reporting agency is in compliance with
its obligation under section 302(c)(5) of the Economic Growth,
Regulatory Relief, and Consumer Protection Act.
(b)

Exempted cases. The provisions of paragraphs (1) through (5) of
subsection (a) of this section are not applicable in the case of any
consumer credit report to be used in connection with
(1) a credit transaction involving, or which may reasonably be expected
to involve, a principal amount of $150,000 or more;
(2) the underwriting of life insurance involving, or which may
reasonably be expected to involve, a face amount of $150,000 or
more; or
(3) the employment of any individual at an annual salary which equals,
or which may reasonably be expected to equal $75,000, or more.

(c)

Running of Reporting Period
(1) In general. The 7-year period referred to in paragraphs (4) and (6)6
of subsection (a) shall begin, with respect to any delinquent account
that is placed for collection (internally or by referral to a third party,
whichever is earlier), charged to profit and loss, or subjected to any
similar action, upon the expiration of the 180-day period beginning
on the date of the commencement of the delinquency which
immediately preceded the collection activity, charge to profit and
loss, or similar action.

6 This provision, added in September 1996, should read “paragraphs (4) and (5)....” Prior Section 605(a)
(6) was amended and re-designated as Section 605(a)(5) in November 1998. The current Section 605(a)(6),
added in December 2003 and now containing no reference to any 7-year period, is obviously inapplicable.
24

§ 605 - 15 U.S.C. § 1681c

(2) Effective date. Paragraph (1) shall apply only to items of information
added to the file of a consumer on or after the date that is 455 days
after the date of enactment of the Consumer Credit Reporting Reform
Act of 1996.
(d)

Information Required to be Disclosed
(1) Title 11 information. Any consumer reporting agency that furnishes a
consumer report that contains information regarding any case
involving the consumer that arises under title 11, United States Code,
shall include in the report an identification of the chapter of such title
11 under which such case arises if provided by the source of the
information. If any case arising or filed under title 11, United States
Code, is withdrawn by the consumer before a final judgment, the
consumer reporting agency shall include in the report that such case
or filing was withdrawn upon receipt of documentation certifying
such withdrawal.
(2) Key factor in credit score information. Any consumer reporting
agency that furnishes a consumer report that contains any credit score
or any other risk score or predictor on any consumer shall include
in the report a clear and conspicuous statement that a key factor
(as defined in section 609(f)(2)(B)) that adversely affected such score
or predictor was the number of enquiries, if such a predictor was in
fact a key factor that adversely affected such score. This paragraph
shall not apply to a check services company, acting as such, which
issues authorizations for the purpose of approving or processing
negotiable instruments, electronic fund transfers, or similar methods
of payments, but only to the extent that such company is engaged in
such activities.

(e)

Indication of closure of account by consumer. If a consumer reporting
agency is notified pursuant to section 623(a)(4) [§ 1681s-2] that a credit
account of a consumer was voluntarily closed by the consumer, the agency
shall indicate that fact in any consumer report that includes information
related to the account.

(f)

Indication of dispute by consumer. If a consumer reporting agency is
notified pursuant to section 623(a)(3) [§ 1681s-2] that information
regarding a consumer who was furnished to the agency is disputed by the
consumer, the agency shall indicate that fact in each consumer report that
includes the disputed information.

(g)

Truncation of Credit Card and Debit Card Numbers

25

§ 605 - 15 U.S.C. § 1681c

(1) In general. Except as otherwise provided in this subsection, no
person that accepts credit cards or debit cards for the transaction of
business shall print more than the last 5 digits of the card number or
the expiration date upon any receipt provided to the cardholder at the
point of the sale or transaction.
(2) Limitation. This subsection shall apply only to receipts that are
electronically printed, and shall not apply to transactions in which the
sole means of recording a credit card or debit card account number is
by handwriting or by an imprint or copy of the card.
(3) Effective date. This subsection shall become effective –
(A) 3 years after the date of enactment of this subsection, with
respect to any cash register or other machine or device that
electronically prints receipts for credit card or debit card
transactions that is in use before January 1, 2005; and
(B)

(h)

1 year after the date of enactment of this subsection, with respect
to any cash register or other machine or device that electronically
prints receipts for credit card or debit card transactions that is
first put into use on or after January 1, 2005.
Notice of Discrepancy in Address
(1) In general. If a person has requested a consumer report relating to
a consumer from a consumer reporting agency described in section
603(p), the request includes an address for the consumer that
substantially differs from the addresses in the file of the consumer,
and the agency provides a consumer report in response to the request,
the consumer reporting agency shall notify the requester of the
existence of the discrepancy.
See also 12 CFR Part 1022.82, 16 CFR Part 641,
72 Fed. Reg. 63771-72 (11/09/07),
74 Fed. Reg. 22640-41 (05/14/09),
86 Fed. Reg. 51817-19 (09/17/21)

(2) Regulations
(A) Regulations required. The Bureau shall, in consultation with
the Federal banking agencies, the National Credit Union
Administration, and the Federal Trade Commission, prescribe
regulations providing guidance regarding reasonable policies
and procedures that a user of a consumer report should employ
when such user has received a notice of discrepancy under
paragraph (1).
26

§ 605A - 15 U.S.C. § 1681c-1

(B)

Policies and procedures to be included. The regulations
prescribed under subparagraph (A) shall describe reasonable
policies and procedures for use by a user of a consumer report –
(i) to form a reasonable belief that the user knows the identity
of the person to whom the consumer report pertains; and
(ii) if the user establishes a continuing relationship with the
consumer, and the user regularly and in the ordinary course
of business furnishes information to the consumer reporting
agency from which the notice of discrepancy pertaining to
the consumer was obtained, to reconcile the address of the
consumer with the consumer reporting agency by furnishing
such address to such consumer reporting agency as part of
information regularly furnished by the user for the period in
which the relationship is established.

§ 605A. Identity theft prevention; fraud alerts and active duty
alerts [15 U.S.C. § 1681c-1]
(a)

One-call Fraud Alerts
(1) Initial alerts. Upon the direct request of a consumer, or an individual
acting on behalf of or as a personal representative of a consumer,
who asserts in good faith a suspicion that the consumer has been or is
about to become a victim of fraud or related crime, including identity
theft, a consumer reporting agency described in section 603(p) that
maintains a file on the consumer and has received appropriate proof
of the identity of the requester shall –
(A) include a fraud alert in the file of that consumer, and also
provide that alert along with any credit score generated in using
that file, for a period of not less than 1 year, beginning on the
date of such request, unless the consumer or such representative
requests that such fraud alert be removed before the end of such
period, and the agency has received appropriate proof of the
identity of the requester for such purpose; and
(B) refer the information regarding the fraud alert under this
paragraph to each of the other consumer reporting agencies
described in section 603(p), in accordance with procedures
developed under section 621(f).
(2) Access to free reports. In any case in which a consumer reporting
agency includes a fraud alert in the file of a consumer pursuant to this
subsection, the consumer reporting agency shall –
27

§ 605A - 15 U.S.C. § 1681c-1

(b)

(A) disclose to the consumer that the consumer may request a free
copy of the file of the consumer pursuant to section 612(d); and
(B) provide to the consumer all disclosures required to be made
under section 609, without charge to the consumer, not later
than 3 business days after any request described in
subparagraph (A).
Extended Alerts
(1) In general. Upon the direct request of a consumer, or an individual
acting on behalf of or as a personal representative of a consumer,
who submits an identity theft report to a consumer reporting agency
described in section 603(p) that maintains a file on the consumer,
if the agency has received appropriate proof of the identity of the
requester, the agency shall –
(A) include a fraud alert in the file of that consumer, and also
provide that alert along with any credit score generated in using
that file, during the 7-year period beginning on the date of such
request, unless the consumer or such representative requests
that such fraud alert be removed before the end of such period
and the agency has received appropriate proof of the identity of
the requester for such purpose;
(B) during the 5-year period beginning on the date of such request,
exclude the consumer from any list of consumers prepared by
the consumer reporting agency and provided to any third party
to offer credit or insurance to the consumer as part of a
transaction that was not initiated by the consumer, unless the
consumer or such representative requests that such exclusion be
rescinded before the end of such period; and
(C) refer the information regarding the extended fraud alert under
this paragraph to each of the other consumer reporting agencies
described in section 603(p), in accordance with procedures
developed under section 621(f).
(2) Access to free reports. In any case in which a consumer reporting
agency includes a fraud alert in the file of a consumer pursuant to this
subsection, the consumer reporting agency shall –
(A) disclose to the consumer that the consumer may request 2 free
copies of the file of the consumer pursuant to section 612(d)
during the 12-month period beginning on the date on which the
fraud alert was included in the file; and
28

§ 605A - 15 U.S.C. § 1681c-1

(B)

(c)

provide to the consumer all disclosures required to be made
under section 609, without charge to the consumer, not later
than 3 business days after any request described in
subparagraph (A).
Active duty alerts. Upon the direct request of an active duty military
consumer, or an individual acting on behalf of or as a personal
representative of an active duty military consumer, a consumer reporting
agency described in section 603(p) that maintains a file on the active duty
military consumer and has received appropriate proof of the identity of the
requester shall –
(1) include an active duty alert in the file of that active duty military
consumer, and also provide that alert along with any credit score
generated in using that file, during a period of not less than 12
months, or such longer period as the Bureau shall determine, by
regulation, beginning on the date of the request, unless the active
duty military consumer or such representative requests that such
fraud alert be removed before the end of such period, and the agency
has received appropriate proof of the identity of the requester for
such purpose;
(2) during the 2-year period beginning on the date of such request,
exclude the active duty military consumer from any list of consumers
prepared by the consumer reporting agency and provided to any third
party to offer credit or insurance to the consumer as part of a
transaction that was not initiated by the consumer, unless the
consumer requests that such exclusion be rescinded before the end of
such period; and
(3) refer the information regarding the active duty alert to each of the
other consumer reporting agencies described in section 603(p), in
accordance with procedures developed under section 621(f).
See also 12 CFR Part 1022.121

(d)

Procedures. Each consumer reporting agency described in section 603(p)
shall establish policies and procedures to comply with this section, including
procedures that inform consumers of the availability of initial, extended,
and active duty alerts and procedures that allow consumers and active duty
military consumers to request initial, extended, or active duty alerts (as
applicable) in a simple and easy manner, including by telephone.

(e)

Referrals of alerts. Each consumer reporting agency described in section
603(p) that receives a referral of a fraud alert or active duty alert from
another consumer reporting agency pursuant to this section shall, as
29

§ 605A - 15 U.S.C. § 1681c-1

though the agency received the request from the consumer directly, follow
the procedures required under –
(1) paragraphs (1)(A) and (2) of subsection (a), in the case of a referral
under subsection (a)(1)(B);
(2) paragraphs (1)(A), (1)(B), and (2) of subsection (b), in the case of a
referral under subsection (b)(1)(C); and
(3) paragraphs (1) and (2) of subsection (c), in the case of a referral
under subsection (c)(3).
(f)

Duty of reseller to reconvey alert. A reseller shall include in its report any
fraud alert or active duty alert placed in the file of a consumer
pursuant to this section by another consumer reporting agency.

(g)

Duty of other consumer reporting agencies to provide contact information.
If a consumer contacts any consumer reporting agency that is not
described in section 603(p) to communicate a suspicion that the consumer
has been or is about to become a victim of fraud or related crime,
including identity theft, the agency shall provide information to the
consumer on how to contact the Bureau and the consumer reporting
agencies described in section 603(p) to obtain more detailed information
and request alerts under this section.

(h)

Limitations on Use of Information for Credit Extensions
(1) Requirements for initial and active duty alerts
(A) Notification. Each initial fraud alert and active duty alert
under this section shall include information that notifies all
prospective users of a consumer report on the consumer to
which the alert relates that the consumer does not authorize
the establishment of any new credit plan or extension of
credit, other than under an open-end credit plan (as defined in
section 103(i)), in the name of the consumer, or issuance of
an additional card on an existing credit account requested by a
consumer, or any
increase in credit limit on an existing credit account requested
by a consumer, except in accordance with subparagraph (B).
(B) Limitation on Users
(i) In general. No prospective user of a consumer report that
includes an initial fraud alert or an active duty alert in
accordance with this section may establish a new credit
plan or extension of credit, other than under an open-end
credit plan (as defined in section 103(i)), in the name of
the consumer, or issue an additional card on an existing
30

§ 605A - 15 U.S.C. § 1681c-1

credit account requested by a consumer, or grant any
increase in credit limit on an existing credit account
requested by a consumer, unless the user utilizes reasonable
policies and procedures to form a reasonable belief that
the user knows the identity of the person making the request.
(ii) Verification. If a consumer requesting the alert has
specified a telephone number to be used for identity
verification purposes, before authorizing any new credit
plan or extension described in clause (i) in the name of
such consumer, a user of such consumer report shall
contact the consumer using that telephone number or take
reasonable steps to verify the consumer’s identity and
confirm that the application for a new credit plan is not
the result of identity theft.
(2) Requirements for Extended Alerts
(A) Notification. Each extended alert under this section shall
include information that provides all prospective users of a
consumer report relating to a consumer with –
(i) notification that the consumer does not authorize the
establishment of any new credit plan or extension of credit
described in clause (i), other than under an open-end
credit plan (as defined in section 103(i)), in the name of
the consumer, or issuance of an additional card on an
existing credit account requested by a consumer, or any
increase in credit limit on an existing credit account
requested by a consumer, except in accordance with
subparagraph (B); and
(ii) a telephone number or other reasonable contact method
designated by the consumer.
(B) Limitation on users. No prospective user of a consumer report
or of a credit score generated using the information in the file
of a consumer that includes an extended fraud alert in
accordance with this section may establish a new credit plan or
extension of credit, other than under an open-end credit plan
(as defined in section 103(i)), in the name of the consumer, or
issue an additional card on an existing credit account requested
by a consumer, or any increase in credit limit on an existing
credit account requested by a consumer, unless the user
contacts the consumer in person or using the contact method
described in subparagraph (A)(ii) to confirm that the application
31

§ 605A - 15 U.S.C. § 1681c-1

(i)

for a new credit plan or increase in credit limit, or request for
an additional card is not the result of identity theft.
National security freeze.
(1) Definitions. For purposes of this subsection:
(A) The term “consumer reporting agency” means a consumer
reporting agency described in section 603(p).
(B) The term “proper identification” has the meaning of such term
as used under section 610.
(C) The term “security freeze” means a restriction that prohibits
a consumer reporting agency from disclosing the contents of a
consumer report that is subject to such security freeze to any
person requesting the consumer report.
(2) Placement of security freeze.
(A) In general. Upon receiving a direct request from a consumer
that a consumer reporting agency place a security freeze, and
upon receiving proper identification from the consumer, the
consumer reporting agency shall, free of charge, place the
security freeze not later than –
(i) in the case of a request that is by toll-free telephone or
secure electronic means, 1 business day after receiving the
request directly from the consumer; or
(ii) in the case of a request that is by mail, 3 business days
after receiving the request directly from the consumer.
(B) Confirmation and additional information.
Not later than 5 business days after placing a security freeze
under subparagraph (A), a consumer reporting agency shall –
(i) send confirmation of the placement to the consumer; and
(ii) inform the consumer of –
(I) the process by which the consumer may remove the
security freeze, including a mechanism to authenticate
the consumer; and
(II) the consumer’s right described in section 615(d)(1)(D).
(C) Notice to third parties. A consumer reporting agency may
advise a third party that a security freeze has been placed with
respect to a consumer under subparagraph (A).
(3) Removal of security freeze.
32

§ 605A - 15 U.S.C. § 1681c-1

(A) In general. A consumer reporting agency shall remove a
security freeze placed on the consumer report of a consumer
only in the following cases:
(i) Upon the direct request of the consumer.
(ii) The security freeze was placed due to a material
misrepresentation of fact by the consumer.
(B) Notice if removal not by request. If a consumer reporting
agency removes a security freeze under subparagraph (A)(ii),
the consumer reporting agency shall notify the consumer in
writing prior to removing the security freeze.
(C) Removal of security freeze by consumer request. Except as
provided in subparagraph (A)(ii), a security freeze shall remain
in place until the consumer directly requests that the security
freeze be removed. Upon receiving a direct request from a
consumer that a consumer reporting agency remove a security
freeze, and upon receiving proper identification from the
consumer, the consumer reporting agency shall, free of charge,
remove the security freeze not later than –
(i) in the case of a request that is by toll-free telephone or
secure electronic means, 1 hour after receiving the request
for removal; or
(ii) in the case of a request that is by mail, 3 business days
after receiving the request for removal.
(D) Third-party requests. If a third party requests access to a
consumer report of a consumer with respect to which a security
freeze is in effect, where such request is in connection with an
application for credit, and the consumer does not allow such
consumer report to be accessed, the third party may treat the
application as incomplete.
(E) Temporary removal of security freeze. Upon receiving a direct
request from a consumer under subparagraph (A)(i), if the
consumer requests a temporary removal of a security freeze,
the consumer reporting agency shall, in accordance with
subparagraph (C), remove the security freeze for the period of
time specified by the consumer.
(4) Exceptions. A security freeze shall not apply to the making of a
consumer report for use of the following:
(A) A person or entity, or a subsidiary, affiliate, or agent of that
person or entity, or an assignee of a financial obligation owed
33

§ 605A - 15 U.S.C. § 1681c-1

by the consumer to that person or entity, or a prospective
assignee of a financial obligation owed by the consumer to that
person or entity in conjunction with the proposed purchase of
the financial obligation, with which the consumer has or had
prior to assignment an account or contract including a demand
deposit account, or to whom the consumer issued a negotiable
instrument, for the purposes of reviewing the account or
collecting the financial obligation owed for the account,
contract, or negotiable instrument. For purposes of this
subparagraph, ‘reviewing the account’ includes activities related
to account maintenance, monitoring, credit line increases, and
account upgrades and enhancements.
(B) Any Federal, State, or local agency, law enforcement agency,
trial court, or private collection agency acting pursuant to a
court order, warrant, or subpoena.
(C) A child support agency acting pursuant to part D of title IV of
the Social Security Act (42 U.S.C. 651 et seq.).
(D) A Federal agency or a State or its agents or assigns acting to
investigate fraud or acting to investigate or collect delinquent
taxes or unpaid court orders or to fulfill any of its other
statutory responsibilities, provided such responsibilities are
consistent with a permissible purpose under section 604.
(E) By a person using credit information for the purposes described
under section 604(c).
(F) Any person or entity administering a credit file monitoring
subscription or similar service to which the consumer has
subscribed.
(G) Any person or entity for the purpose of providing a consumer
with a copy of the consumer’s consumer report or credit score,
upon the request of the consumer.
(H) Any person using the information in connection with the
underwriting of insurance.
(I) Any person using the information for employment, tenant, or
background screening purposes.
(J) Any person using the information for assessing, verifying, or
authenticating a consumer’s identity for purposes other than the
granting of credit, or for investigating or preventing actual or
potential fraud.

34

§ 605A - 15 U.S.C. § 1681c-1

(5) Notice of rights. At any time a consumer is required to receive a
summary of rights required under section 609, the following notice
shall be included:
“Consumers Have The Right To Obtain A Security Freeze
“You have a right to place a ‘security freeze’ on your credit report,
which will prohibit a consumer reporting agency from releasing
information in your credit report without your express authorization.
The security freeze is designed to prevent credit, loans, and services
from being approved in your name without your consent. However,
you should be aware that using a security freeze to take control over
who gets access to the personal and financial information in your
credit report may delay, interfere with, or prohibit the timely
approval of any subsequent request or application you make
regarding a new loan, credit, mortgage, or any other account
involving the extension of credit.
“As an alternative to a security freeze, you have the right to place an
initial or extended fraud alert on your credit file at no cost. An initial
fraud alert is a 1-year alert that is placed on a consumer’s credit file.
Upon seeing a fraud alert display on a consumer’s credit file, a business
is required to take steps to verify the consumer’s identity before
extending new credit. If you are a victim of identity theft, you are
entitled to an extended fraud alert, which is a fraud alert lasting 7 years.
“A security freeze does not apply to a person or entity, or its
affiliates, or collection agencies acting on behalf of the person or
entity, with which you have an existing account that requests
information in your credit report for the purposes of reviewing or
collecting the account. Reviewing the account includes activities
related to account maintenance, monitoring, credit line increases,
and account upgrades and enhancements.”
(6) Webpage.
(A) Consumer reporting agencies. A consumer reporting agency
shall establish a webpage that –
(i) allows a consumer to request a security freeze;
(ii) allows a consumer to request an initial fraud alert;
(iii) allows a consumer to request an extended fraud alert;
(iv) allows a consumer to request an active duty fraud alert;

35

§ 605A - 15 U.S.C. § 1681c-1

(v)

(j)

allows a consumer to opt-out of the use of information in
a consumer report to send the consumer a solicitation of
credit or insurance, in accordance with section 615(d); and
(vi) shall not be the only mechanism by which a consumer
may request a security freeze.
(B) FTC. The Federal Trade Commission shall establish a single
webpage that includes a link to each webpage established under
subparagraph (A) within the Federal Trade Commission’s
website www.IdentityTheft.gov, or a successor website.
National protection for files and credit records of protected consumers.
(1) Definitions. As used in this subsection:
(A) The term “consumer reporting agency” means a consumer
reporting agency described in section 603(p).
(B) The term “protected consumer” means an individual who is –
(i) under the age of 16 years at the time a request for the
placement of a security freeze is made; or
(ii) an incapacitated person or a protected person for whom a
guardian or conservator has been appointed.
(C) The term “protected consumer’s representative” means a
person who provides to a consumer reporting agency sufficient
proof of authority to act on behalf of a protected consumer.
(D) The term “record” means a compilation of information that –
(i) identifies a protected consumer;
(ii) is created by a consumer reporting agency solely for the
purpose of complying with this subsection; and
(iii) may not be created or used to consider the protected
consumer’s credit worthiness, credit standing, credit
capacity, character, general reputation, personal
characteristics, or mode of living.
(E) The term “security freeze” means a restriction that prohibits
a consumer reporting agency from disclosing the contents of a
consumer report that is the subject of such security freeze or,
in the case of a protected consumer for whom the consumer
reporting agency does not have a file, a record that is subject
to such security freeze to any person requesting the consumer
report for the purpose of opening a new account involving the
extension of credit.
36

§ 605A - 15 U.S.C. § 1681c-1

(F)

The term “sufficient proof of authority” means documentation
that shows a protected consumer’s representative has authority
to act on behalf of a protected consumer and includes –
(i) an order issued by a court of law;
(ii) a lawfully executed and valid power of attorney;
(iii) a document issued by a Federal, State, or local
government agency in the United States showing proof of
parentage, including a birth certificate; or
(iv) with respect to a protected consumer who has been placed
in a foster care setting, a written communication from a
county welfare department or its agent or designee, or
a county probation department or its agent or designee,
certifying that the protected consumer is in a foster care
setting under its jurisdiction.
(G) The term “sufficient proof of identification”- means information
or documentation that identifies a protected consumer and a
protected consumer’s representative and includes –
(i) a social security number or a copy of a social security
card issued by the Social Security Administration;
(ii) a certified or official copy of a birth certificate issued by
the entity authorized to issue the birth certificate; or
(iii) a copy of a driver’s license, an identification card issued
by the motor vehicle administration, or any other
government issued identification.
(2) Placement of security freeze for a protected consumer.
(A) In general. Upon receiving a direct request from a protected
consumer’s representative that a consumer reporting agency
place a security freeze, and upon receiving sufficient proof of
identification and sufficient proof of authority, the consumer
reporting agency shall, free of charge, place the security freeze
not later than –
(i) in the case of a request that is by toll-free telephone or
secure electronic means, 1 business day after receiving
the request directly from the protected consumer’s
representative; or
(ii) in the case of a request that is by mail, 3 business days
after receiving the request directly from the protected
consumer’s representative.
(B) Confirmation and additional information.
37

§ 605A - 15 U.S.C. § 1681c-1

Not later than 5 business days after placing a security freeze
under subparagraph (A), a consumer reporting agency shall –
(i) send confirmation of the placement to the protected
consumer’s representative; and
(ii) inform the protected consumer’s representative of the
process by which the protected consumer may remove the
security freeze, including a mechanism to authenticate the
protected consumer’s representative.
(C) Creation of file. If a consumer reporting agency does not have
a file pertaining to a protected consumer when the consumer
reporting agency receives a direct request under subparagraph
(A), the consumer reporting agency shall create a record for the
protected consumer.
(3) Prohibition on release of record or file of protected consumer. After
a security freeze has been placed under paragraph (2)(A), and unless
the security freeze is removed in accordance with this subsection, a
consumer reporting agency may not release the protected consumer’s
consumer report, any information derived from the protected consumer’s
consumer report, or any record created for the protected consumer.
(4) Removal of a protected consumer security freeze.
(A) In general. A consumer reporting agency shall remove a
security freeze placed on the consumer report of a protected
consumer only in the following cases:
(i) Upon the direct request of the protected consumer’s
representative.
(ii) Upon the direct request of the protected consumer, if the
protected consumer is not under the age of 16 years at the
time of the request.
(iii) The security freeze was placed due to a material
misrepresentation of fact by the protected consumer’s
representative.
(B) Notice if removal not by request. If a consumer reporting
agency removes a security freeze under subparagraph (A)(iii),
the consumer reporting agency shall notify the protected
consumer’s representative in writing prior to removing the
security freeze.
(C) Removal of freeze by request. Except as provided in
subparagraph (A)(iii), a security freeze shall remain in place
until a protected consumer’s representative or protected
38

§ 605B - 15 U.S.C. § 1681c-2

(k)

consumer described in subparagraph (A)(ii) directly requests
that the security freeze be removed. Upon receiving a direct
request from the protected consumer’s representative or
protected consumer described in subparagraph (A)(ii) that a
consumer reporting agency remove a security freeze, and upon
receiving sufficient proof of identification and sufficient proof
of authority, the consumer reporting agency shall, free of
charge, remove the security freeze not later than –
(i) in the case of a request that is by toll-free telephone or
secure electronic means, 1 hour after receiving the request
for removal; or
(ii) in the case of a request that is by mail, 3 business days
after receiving the request for removal.
(D) Temporary removal of security freeze. Upon receiving a direct
request from a protected consumer or a protected consumer’s
representative under subparagraph (A)(i), if the protected
consumer or protected consumer’s representative requests a
temporary removal of a security freeze, the consumer reporting
agency shall, in accordance with subparagraph (C), remove the
security freeze for the period of time specified by the protected
consumer or protected consumer’s representative.
Credit monitoring.
(1) Definitions. In this subsection:
(A) The term “active duty military consumer” includes a member
of the National Guard.
(B) The term “National Guard” has the meaning given the term in
section 101(c) of title 10, United States Code.
(2) Credit monitoring. A consumer reporting agency described in section
603(p) shall provide a free electronic credit monitoring service
that, at a minimum, notifies a consumer of material additions or
modifications to the file of the consumer at the consumer reporting
agency to any consumer who provides to the consumer reporting
agency –
(A) appropriate proof that the consumer is an active duty military
consumer; and
(B) contact information of the consumer.
(3) Rulemaking. Not later than 1 year after the date of enactment of this
subsection, the Federal Trade Commission shall promulgate
39

§ 605B - 15 U.S.C. § 1681c-2

regulations regarding the requirements of this subsection, which
shall at a minimum include –
(A) a definition of an electronic credit monitoring service and
material additions or modifications to the file of a consumer; and
(B) what constitutes appropriate proof.
(4) Applicability.
(A) Sections 616 and 617 shall not apply to any violation of this
subsection.
(B) This subsection shall be enforced exclusively under section
621 by the Federal agencies and Federal and State officials
identified in that section.

§ 605B. Block of information resulting from identity theft
[15 U.S.C. § 1681c-2]
(a)

Block. Except as otherwise provided in this section, a consumer reporting
agency shall block the reporting of any information in the file of a
consumer that the consumer identifies as information that resulted from
an alleged identity theft, not later than 4 business days after the date of
receipt by such agency of –
(1) appropriate proof of the identity of the consumer;
(2) a copy of an identity theft report;
(3) the identification of such information by the consumer; and
(4) a statement by the consumer that the information is not information
relating to any transaction by the consumer.

(b)

Notification. A consumer reporting agency shall promptly notify the
furnisher of information identified by the consumer under subsection (a) –
(1) that the information may be a result of identity theft;
(2) that an identity theft report has been filed;
(3) that a block has been requested under this section; and
(4) of the effective dates of the block.

(c)

Authority to Decline or Rescind
(1) In general. A consumer reporting agency may decline to block, or may
rescind any block, of information relating to a consumer under this
section, if the consumer reporting agency reasonably determines that –
(A) the information was blocked in error or a block was requested
by the consumer in error;
40

§ 605B - 15 U.S.C. § 1681c-2

(B)

the information was blocked, or a block was requested by the
consumer, on the basis of a material misrepresentation of fact
by the consumer relevant to the request to block; or
(C) the consumer obtained possession of goods, services, or money
as a result of the blocked transaction or transactions.
(2) Notification to consumer. If a block of information is declined or
rescinded under this subsection, the affected consumer shall be
notified promptly, in the same manner as consumers are notified of
the reinsertion of information under section 611(a)(5)(B).
(3) Significance of block. For purposes of this subsection, if a consumer
reporting agency rescinds a block, the presence of information in the
file of a consumer prior to the blocking of such information is not
evidence of whether the consumer knew or should have known that
the consumer obtained possession of any goods, services, or money
as a result of the block.
(d)

Exception for Resellers
(1) No reseller file. This section shall not apply to a consumer reporting
agency, if the consumer reporting agency –
(A) is a reseller;
(B) is not, at the time of the request of the consumer under subsection (a), otherwise furnishing or reselling a consumer report
concerning the information identified by the consumer; and
(C) informs the consumer, by any means, that the consumer may
report the identity theft to the Bureau to obtain consumer
information regarding identity theft.
(2) Reseller with file. The sole obligation of the consumer reporting
agency under this section, with regard to any request of a consumer
under this section, shall be to block the consumer report maintained
by the consumer reporting agency from any subsequent use, if –
(A) the consumer, in accordance with the provisions of subsection (a),
identifies, to a consumer reporting agency, information in the file
of the consumer that resulted from identity theft; and
(B) the consumer reporting agency is a reseller of the identified
information.
(3) Notice. In carrying out its obligation under paragraph (2), the
reseller shall promptly provide a notice to the consumer of the
decision to block the file. Such notice shall contain the name,
41

§ 605C - 15 U.S.C. § 1681c-3

address, and telephone number of each consumer reporting agency
from which the consumer information was obtained for resale.
(e)

Exception for verification companies. The provisions of this section do not
apply to a check services company, acting as such, which issues
authorizations for the purpose of approving or processing negotiable
instruments, electronic fund transfers, or similar methods of payments,
except that, beginning 4 business days after receipt of information
described in paragraphs (1) through (3) of subsection (a), a check services
company shall not report to a national consumer reporting agency
described in section 603(p), any information identified in the subject
identity theft report as resulting from identity theft.

(f)

Access to blocked information by law enforcement agencies. No provision
of this section shall be construed as requiring a consumer reporting agency
to prevent a Federal, State, or local law enforcement agency from
accessing blocked information in a consumer file to which the agency
could otherwise obtain access under this title.

§ 605C. Adverse information in cases of trafficking
[15 U.S.C. § 1681c-3]
(a)

Definitions. In this section:
(1) Trafficking documentation. The term “trafficking documentation”
means(A) documentation of(i) a determination that a consumer is a victim of trafficking
made by a Federal, State, or Tribal governmental entity;
or
(ii) by a court of competent jurisdiction; and
(B) documentation that identifies items of adverse information
that should not be furnished by a consumer reporting agency
because the items resulted from a severe form of trafficking in
persons or sex trafficking of which the consumer is a victim.
(2) Trafficking Victims Protection Act of 2000 definitions. The terms
“severe forms of trafficking in persons” and “sex trafficking” have
the meanings given, respectively, in section 103 of the Trafficking
Victims Protection Act of 2000 (22 U.S.C. 7102).
(3) Victim of trafficking. The term “victim of trafficking” means
a person who is a victim of a severe form of trafficking in persons
or sex trafficking.
42

§ 606 - 15 U.S.C. § 1681d

(b)

Adverse information. A consumer reporting agency may not furnish a
consumer report containing any adverse item of information about a
consumer that resulted from a severe form of trafficking in persons or sex
trafficking if the consumer has provided trafficking documentation to the
consumer reporting agency.

(c)

Rulemaking.
(1)

In general. Not later than 180 days after December 27, 2021, the
Director shall issue rules to implement subsection (a).

(2)

Contents. The rules issued pursuant to paragraph (1) shall establish a
method by which consumers shall submit trafficking documentation
to consumer reporting agencies.

§ 606. Disclosure of investigative consumer reports
[15 U.S.C. § 1681d]
(a)

Disclosure of fact of preparation. A person may not procure or cause to
be prepared an investigative consumer report on any consumer unless
(1) it is clearly and accurately disclosed to the consumer that an
investigative consumer report including information as to his
character, general reputation, personal characteristics and mode of
living, whichever are applicable, may be made, and such disclosure
(A)

is made in a writing mailed, or otherwise delivered, to the
consumer, not later than three days after the date on which the
report was first requested, and
(B) includes a statement informing the consumer of his right to request
the additional disclosures provided for under subsection (b) of this
section and the written summary of the rights of the consumer
prepared pursuant to section 609(c) [§ 1681g]; and
(2) the person certifies or has certified to the consumer reporting agency that
(A)

(b)

the person has made the disclosures to the consumer required
by paragraph (1); and
(B) the person will comply with subsection (b).
Disclosure on request of nature and scope of investigation. Any person
who procures or causes to be prepared an investigative consumer report on
any consumer shall, upon written request made by the consumer within a
reasonable period of time after the receipt by him of the disclosure required
by subsection (a)(1) of this section, make a complete and accurate disclosure
of the nature and scope of the investigation requested. This disclosure shall
be made in a writing mailed, or otherwise delivered, to the consumer not
43

§ 606 - 15 U.S.C. § 1681d

later than five days after the date on which the request for such disclosure
was received from the consumer or such report was first requested,
whichever is the later.
(c)

Limitation on liability upon showing of reasonable procedures for
compliance with provisions. No person may be held liable for any violation
of subsection (a) or (b) of this section if he shows by a preponderance
of the evidence that at the time of the violation he maintained reasonable
procedures to assure compliance with subsection (a) or (b) of this section.

(d)

Prohibitions
(1) Certification. A consumer reporting agency shall not prepare or
furnish investigative consumer report unless the agency has received
a certification under subsection (a)(2) from the person who requested
the report.
(2) Inquiries. A consumer reporting agency shall not make an inquiry for
the purpose of preparing an investigative consumer report on a consumer
for employment purposes if the making of the inquiry by an employer
or prospective employer of the consumer would violate any applicable
Federal or State equal employment opportunity law or regulation.
(3) Certain public record information. Except as otherwise provided in
section 613 [§ 1681k], a consumer reporting agency shall not furnish
an investigative consumer report that includes information that is a
matter of public record and that relates to an arrest, indictment,
conviction, civil judicial action, tax lien, or outstanding judgment,
unless the agency has verified the accuracy of the information during
the 30-day period ending on the date on which the report is furnished.
(4) Certain adverse information. A consumer reporting agency shall not
prepare or furnish an investigative consumer report on a consumer
that contains information that is adverse to the interest of the
consumer and that is obtained through a personal interview with a
neighbor, friend, or associate of the consumer or with another person
with whom the consumer is acquainted or who has knowledge of such
item of information, unless
(A) the agency has followed reasonable procedures to obtain
confirmation of the information, from an additional source that
has independent and direct knowledge of the information; or
(B) the person interviewed is the best possible source of the
information.

44

§ 607 - 15 U.S.C. § 1681e

§ 607. Compliance procedures [15 U.S.C. § 1681e]
(a)

Identity and purposes of credit users. Every consumer reporting agency
shall maintain reasonable procedures designed to avoid violations of
section 605 [§ 1681c] and to limit the furnishing of consumer reports to
the purposes listed under section 604 [§ 1681b] of this title. These
procedures shall require that prospective users of the information identify
themselves, certify the purposes for which the information is sought,
and certify that the information will be used for no other purpose. Every
consumer reporting agency shall make a reasonable effort to verify the
identity of a new prospective user and the uses certified by such
prospective user prior to furnishing such user a consumer report. No
consumer reporting agency may furnish a consumer report to any person
if it has reasonable grounds for believing that the consumer report will not
be used for a purpose listed in section 604 [§ 1681b] of this title.

(b)

Accuracy of report. Whenever a consumer reporting agency prepares a
consumer report it shall follow reasonable procedures to assure maximum
possible accuracy of the information concerning the individual about
whom the report relates.

(c)

Disclosure of consumer reports by users allowed. A consumer reporting
agency may not prohibit a user of a consumer report furnished by the
agency on a consumer from disclosing the contents of the report to the
consumer, if adverse action against the consumer has been taken by the
user based in whole or in part on the report.

(d)

Notice to Users and Furnishers of Information
(1) Notice requirement. A consumer reporting agency shall provide to
any person
(A) who regularly and in the ordinary course of business furnishes
information to the agency with respect to any consumer; or
(B) to whom a consumer report is provided by the agency; a notice
of such person’s responsibilities under this title.
See also 12 CFR Part 1022, App M-N

(2) Content of notice. The Bureau shall prescribe the content of notices
under paragraph (1), and a consumer reporting agency shall be
in compliance with this subsection if it provides a notice under
paragraph (1) that is substantially similar to the Bureau prescription
under this paragraph.
(e)

Procurement of Consumer Report for Resale
45

§ 607 - 15 U.S.C. § 1681e

(1) Disclosure. A person may not procure a consumer report for
purposes of reselling the report (or any information in the report)
unless the person discloses to the consumer reporting agency that
originally furnishes the report
(A) the identity of the end-user of the report (or information); and
(B) each permissible purpose under section 604 [§ 1681b] for
which the report is furnished to the end-user of the report
(or information).
(2) Responsibilities of procurers for resale. A person who procures a
consumer report for purposes of reselling the report (or any
information in the report) shall
(A) establish and comply with reasonable procedures designed to
ensure that the report (or information) is resold by the person
only for a purpose for which the report may be furnished under
section 604 [§ 1681b], including by requiring that each person
to which the report (or information) is resold and that resells or
provides the report (or information) to any other person
(i) identifies each end user of the resold report
(or information);
(ii) certifies each purpose for which the report
(or information) will be used; and
(iii) certifies that the report (or information) will be used for
no other purpose; and
(B) before reselling the report, make reasonable efforts to verify the
identifications and certifications made under subparagraph (A).
(3) Resale of consumer report to a federal agency or department.
Notwithstanding paragraph (1) or (2), a person who procures
a consumer report for purposes of reselling the report (or any
information in the report) shall not disclose the identity of the
end-user of the report under paragraph (1) or (2) if –
(A) the end user is an agency or department of the United States
Government which procures the report from the person for
purposes of determining the eligibility of the consumer
concerned to receive access or continued access to classified
information (as defined in section 604(b)(4)(E)(i)); and
(B) the agency or department certifies in writing to the person
reselling the report that nondisclosure is necessary to protect
classified information or the safety of persons employed by or
46

§ 609 - 15 U.S.C. § 1681g

contracting with, or undergoing investigation for work or
contracting with the agency or department.

§ 608. Disclosures to governmental agencies [15 U.S.C. § 1681f]
Notwithstanding the provisions of section 604 [§ 1681b] of this title, a
consumer reporting agency may furnish identifying information respecting
any consumer, limited to his name, address, former addresses, places of
employment, or former places of employment, to a governmental agency.

§ 609. Disclosures to consumers [15 U.S.C. § 1681g]
(a)

Information on file; sources; report recipients. Every consumer reporting
agency shall, upon request, and subject to 610(a)(1) [§ 1681h], clearly and
accurately disclose to the consumer:
(1) All information in the consumer’s file at the time of the request
except that –
(A) if the consumer to whom the file relates requests that the first
5 digits of the social security number (or similar identification
number) of the consumer not be included in the disclosure and
the consumer reporting agency has received appropriate proof
of the identity of the requester, the consumer reporting agency
shall so truncate such number in such disclosure; and
(B) nothing in this paragraph shall be construed to require a
consumer reporting agency to disclose to a consumer any
information concerning credit scores or any other risk scores or
predictors relating to the consumer.
(2) The sources of the information; except that the sources of information
acquired solely for use in preparing an investigative consumer report
and actually use for no other purpose need not be disclosed:
Provided, That in the event an action is brought under this title, such
sources shall be available to the plaintiff under appropriate discovery
procedures in the court in which the action is brought.
(3) (A) Identification of each person (including each end-user identified
under section 607(e)(1) [§ 1681e]) that procured a consumer report
(i)

(B)

for employment purposes, during the 2-year period
preceding the date on which the request is made; or
(ii) for any other purpose, during the 1-year period preceding
the date on which the request is made.
An identification of a person under subparagraph (A) shall
include
47

§ 609 - 15 U.S.C. § 1681g

(i)

the name of the person or, if applicable, the trade name
(written in full) under which such person conducts
business; and
(ii) upon request of the consumer, the address and telephone
number of the person.
(C) Subparagraph (A) does not apply if –
(i) the end user is an agency or department of the United
States Government that procures the report from the
person for purposes of determining the eligibility of the
consumer to whom the report relates to receive access or
continued access to classified information (as defined in
section 604(b)(4)(E)(i)); and
(ii) the head of the agency or department makes a written
finding as prescribed under section 604(b)(4)(A).
(4) The dates, original payees, and amounts of any checks upon which is
based any adverse characterization of the consumer, included in the
file at the time of the disclosure.
(5) A record of all inquiries received by the agency during the 1-year
period preceding the request that identified the consumer in
connection with a credit or insurance transaction that was not initiated
by the consumer.
(6) If the consumer requests the credit file and not the credit score, a
statement that the consumer may request and obtain a credit score.
(b)

Exempt information. The requirements of subsection (a) of this section
respecting the disclosure of sources of information and the recipients
of consumer reports do not apply to information received or consumer
reports furnished prior to the effective date of this title except to the extent
that the matter involved is contained in the files of the consumer reporting
agency on that date.

(c)

Summary of Rights to Obtain and Dispute Information in Consumer
Reports and to Obtain Credit Scores
See also 12 CFR Part 1022, App K

(1) Bureau Summary of Rights Required
(A) In general. The Bureau shall prepare a model summary of the
rights of consumers under this title.
(B) Content of summary. The summary of rights prepared under
subparagraph (A) shall include a description of –
48

§ 609 - 15 U.S.C. § 1681g

(i)

the right of a consumer to obtain a copy of a consumer
report under subsection (a) from each consumer reporting
agency;
(ii) the frequency and circumstances under which a consumer
is entitled to receive a consumer report without charge
under section 612;
(iii) the right of a consumer to dispute information in the file
of the consumer under section 611;
(iv) the right of a consumer to obtain a credit score from a
consumer reporting agency, and a description of how to
obtain a credit score;
(v) the method by which a consumer can contact, and obtain a
consumer report from, a consumer reporting agency
without charge, as provided in the regulations of the
Bureau prescribed under section 211(c) of the Fair and
Accurate Credit Transactions Act of 2003; and
(vi) the method by which a consumer can contact, and obtain
a consumer report from, a consumer reporting agency
described in section 603(w), as provided in the regulations
of the Bureau prescribed under section 612(a)(1)(C).
(C) Availability of summary of rights. The Bureau shall –
(i) actively publicize the availability of the summary of rights
prepared under this paragraph;
(ii) conspicuously post on its Internet website the availability
of such summary of rights; and
(iii) promptly make such summary of rights available to
consumers, on request.
(2) Summary of rights required to be included with agency disclosures.
A consumer reporting agency shall provide to a consumer, with each
written disclosure by the agency to the consumer under this section –
(A) the summary of rights prepared by the Bureau under paragraph (1);
(B) in the case of a consumer reporting agency described in section
603(p), a toll-free telephone number established by the agency,
at which personnel are accessible to consumers during normal
business hours;
(C) a list of all Federal agencies responsible for enforcing any
provision of this title, and the address and any appropriate
phone number of each such agency, in a form that will assist
the consumer in selecting the appropriate agency;
49

§ 609 - 15 U.S.C. § 1681g

(d)

(D) a statement that the consumer may have additional rights under
State law, and that the consumer may wish to contact a State or
local consumer protection agency or a State attorney general
(or the equivalent thereof) to learn of those rights; and
(E) a statement that a consumer reporting agency is not required
to remove accurate derogatory information from the file of a
consumer, unless the information is outdated under section 605
or cannot be verified.
Summary of Rights of Identity Theft Victims
See also 12 CFR Part 1022, App I

(1) In general. The Bureau, in consultation with the Federal banking
agencies and the National Credit Union Administration, shall prepare
a model summary of the rights of consumers under this title with
respect to the procedures for remedying the effects of fraud or identity
theft involving credit, an electronic fund transfer, or an account or
transaction at or with a financial institution or other creditor.
(2) Summary of rights and contact information. Beginning 60 days after the
date on which the model summary of rights is prescribed in final form
by the Bureau pursuant to paragraph (1), if any consumer contacts a
consumer reporting agency and expresses a belief that the consumer is
a victim of fraud or identity theft involving credit, an electronic fund
transfer, or an account or transaction at or with a financial institution
or other creditor, the consumer reporting agency shall, in addition to
any other action that the agency may take, provide the consumer with
a summary of rights that contains all of the information required by
the Bureau under paragraph (1), and information on how to contact the
Bureau to obtain more detailed information.
(e)

Information Available to Victims
(1) In general. For the purpose of documenting fraudulent transactions
resulting from identity theft, not later than 30 days after the date of
receipt of a request from a victim in accordance with paragraph (3),
and subject to verification of the identity of the victim and the claim
of identity theft in accordance with paragraph (2), a business entity
that has provided credit to, provided for consideration products,
goods, or services to, accepted payment from, or otherwise entered
into a commercial transaction for consideration with, a person who
has allegedly made unauthorized use of the means of identification of
the victim, shall provide a copy of application and business transaction
records in the control of the business entity, whether maintained by
the business entity or by another person on behalf of the business
50

§ 609 - 15 U.S.C. § 1681g

entity, evidencing any transaction alleged to be a result of identity
theft to –
(A) the victim;
(B) any Federal, State, or local government law enforcement
agency or officer specified by the victim in such a request; or
(C) Any law enforcement agency investigating the identity theft
and authorized by the victim to take receipt of records provided
under this subsection.
(2) Verification of identity and claim. Before a business entity provides
any information under paragraph (1), unless the business entity, at its
discretion, otherwise has a high degree of confidence that it knows
the identity of the victim making a request under paragraph (1), the
victim shall provide to the business entity –
(A) as proof of positive identification of the victim, at the election
of the business entity –
(i) the presentation of a government-issued identification card;
(ii) personally identifying information of the same type as was
provided to the business entity by the unauthorized
person; or
(iii) personally identifying information that the business entity
typically requests from new applicants or for new
transactions, at the time of the victim’s request for
information, including any documentation described in
clauses (i) and (ii); and
(B) as proof of a claim of identity theft, at the election of the
business entity –
(i) a copy of a police report evidencing the claim of the
victim of identity theft; and
(ii) a properly completed –
(I) copy of a standardized affidavit of identity theft
developed and made available by the Bureau; or
(II) an affidavit of fact that is acceptable to the business
entity for that purpose.
(3) Procedures. The request of a victim under paragraph (1) shall –
(A) be in writing;
(B) be mailed to an address specified by the business entity, if any; and

51

§ 609 - 15 U.S.C. § 1681g

(C)

if asked by the business entity, include relevant information
about any transaction alleged to be a result of identity theft to
facilitate compliance with this section including –
(i) if known by the victim (or if readily obtainable by the
victim), the date of the application or transaction; and
(ii) if known by the victim (or if readily obtainable by the
victim), any other identifying information such as an
account or transaction number.
(4) No charge to victim. Information required to be provided under
paragraph (1) shall be so provided without charge.
(5) Authority to decline to provide information. A business entity may
decline to provide information under paragraph (1) if, in the exercise
of good faith, the business entity determines that –
(A) this subsection does not require disclosure of the information;
(B) after reviewing the information provided pursuant to
paragraph (2), the business entity does not have a high degree
of confidence in knowing the true identity of the individual
requesting the information;
(C) the request for the information is based on a misrepresentation
of fact by the individual requesting the information relevant to
the request for information; or
(D) the information requested is Internet navigational data or similar
information about a person’s visit to a website or online service.
(6) Limitation on liability. Except as provided in section 621, sections
616 and 617 do not apply to any violation of this subsection.
(7) Limitation on civil liability. No business entity may be held civilly
liable under any provision of Federal, State, or other law for
disclosure, made in good faith pursuant to this subsection.
(8) No new recordkeeping obligation. Nothing in this subsection creates
an obligation on the part of a business entity to obtain, retain, or
maintain information or records that are not otherwise required to be
obtained, retained, or maintained in the ordinary course of its
business or under other applicable law.
(9) Rule of Construction
(A) In general. No provision of subtitle A of title V of Public Law
106-102, prohibiting the disclosure of financial information by
a business entity to third parties shall be used to deny disclosure
of information to the victim under this subsection.
52

§ 609 - 15 U.S.C. § 1681g

(B)

Limitation. Except as provided in subparagraph (A), nothing
in this subsection permits a business entity to disclose
information, including information to law enforcement under
subparagraphs (B) and (C) of paragraph (1), that the business
entity is otherwise prohibited from disclosing under any other
applicable provision of Federal or State law.
(10) Affirmative defense. In any civil action brought to enforce this
subsection, it is an affirmative defense (which t

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/agency%3Aftc%3A96e51d1dd06d40ba. Public record. Not legal advice.