In May 2018, Congress passed the Economic Growth, Regulatory Relief, and Consumer Protection Act, which requires nationwide consumer reporting agencies to provide “national security freezes” free of charge to consumers. The “national security freeze” restricts prospective lenders from obtaining access to a consumer’s credit report, which makes it harder for identity thieves to open accounts in the consumer’s name.
The Economic Growth, Regulatory Relief, and Consumer Protection Act mandates that whenever the FCRA requires a consumer to receive either the Summary of Consumer Rights or the Summary of Consumer Identity Theft Rights, a notice regarding the new security freeze right also must be included. The Summary of Consumer Rights is a summary of rights to obtain and dispute information in consumer reports and to obtain credit scores. The Summary of Consumer Identity Theft Rights is a summary of rights of identity theft victims. The FCRA requires the Bureau to write model forms of these documents. Consumer reporting agencies and other entities can use the Bureau’s model forms or their own substantially similar forms.
The May 2018 legislation also extends from 90 days to one year the minimum time that nationwide consumer reporting agencies must include an initial fraud alert in a consumer’s file. A fraud alert informs a prospective lender that a consumer may have been a victim of identity theft and requires that the lender take steps to verify the identity of anyone seeking credit in the consumer’s name. Congress set an effective date of Sept. 21, 2018 for the security freeze right, the notice requirement, and the change in duration for initial fraud alerts.
To assist businesses in coming into compliance with the new law, the interim final rule issued updates the Bureau’s model forms, incorporating the new required notice and the change to the minimum duration of initial fraud alerts. The interim final rule also takes steps to mitigate the impact of these changes on users of the model forms published by the Bureau in November 2012 by permitting various compliance alternatives.