The Fair and Accurate Credit Transactions Act

The Fair and Accurate Credit Transactions Act ("FACTA") is an amendment to the Fair Credit Reporting Act ("FCRA") that was added in 2003 protect people from the threats of identity theft. FACTA created guidelines that determine the types of information which can be shared. These guidelines also affect privacy and authenticity of the information. This act allows individuals free access to their own credit reports and has created a nationwide alerts system.

Why Is FACTA Important to Your Business?

With the passing of FACTA, people are now allowed to request their credit reports free, once per year, from all three of the major credit reporting agencies (Equifax, Experion and Transunion). Not only were requirements placed to release consumer information regarding credit scores and factors influencing the price of a mortgage loan, but standards also were put into place that require lenders and regulators to be more proactive in spotting identity theft before it occurs by looking for suspicious patterns.

Red Flags

Financial institutions face a mandatory deadline of November 1, 2008, to comply 3 new FACT Act regulations referred to as the Red Flag Rules, section 114 and 315 of the Fair and Accurate Credit Transactions (FACT) Act.

According to a Business Alert issued by the Federal Trade Commission in June 2008, the Red Flag Rules apply to a very broad list of businesses including "financial institutions" and "creditors" with "covered account". A "creditor" is defined to include "lenders such as banks, finance companies, automobile dealers, mortgage brokers, utility companies and telecommunications companies." However, this is not an all-inclusive list.

The regulations apply to all businesses that have "covered accounts". A "covered account" includes any account for which there is a foreseeable risk of identity theft. For example, credit cards, monthly billed accounts like utility bills or cell phone bills, social security numbers, drivers license numbers, medical insurance accounts, and many others. This significantly expands the definition to include all companies, regardless of size that maintain, or otherwise possess, consumer information for a business purpose. Because of the broad definitions in these regulations, few businesses will be able to escape these requirements.

There are three new regulations

One that requires financial institutions or creditors to develop and implement an Identity Theft Prevention Program in connection with both new and existing accounts. The Program must include reasonable policies and procedures for detecting, preventing, and mitigating identity theft;

Another that requires users of consumer reports to respond to Notices of Address Discrepancies that they receive;

A third that places special requirements on issuers of debit or credit cards to assess the validity of a change of address if they receive notification of a change of address for a consumer's debit or credit card account and, within a short period of time afterward they receive a request for an additional or replacement card for the same account.