15 U.S.C. §1681c-1 — Identity theft prevention; fraud alerts and active duty alerts
Establishes the consumer's right to place initial, extended, and active-duty fraud alerts (and security freezes) on their file at a nationwide CRA, and imposes downstream verification duties on prospective users of a consumer report (including [LENDER]) when such an alert appears.
Verbatim regulatory text
Verbatim provisions from 15 U.S.C. §1681c-1 — Identity theft prevention; fraud alerts and active duty alerts — each quote is a verified substring of the regulator-published source snapshot, not retyped. Quoted for reference; this is not legal advice. The operational layer (P&P updates, prompts) lives in the regulation update kits.
15 U.S.C. §1681c-1(h)(1)(B)(i) — Initial/active-duty alert: user reasonable identity belief required
No prospective user of a consumer report that includes an initial fraud alert or an active duty alert in accordance with this section may establish a new credit plan or extension of credit, other than under an open-end credit plan (as defined in section 1602(i) 1 of this title), in the name of the consumer, or issue an additional card on an existing credit account requested by a consumer, or grant any increase in credit limit on an existing credit account requested by a consumer, unless the user utilizes reasonable policies and procedures to form a reasonable belief that the user knows the identity of the person making the request.
15 U.S.C. §1681c-1(h)(2)(B) — Extended alert: user must contact consumer
No prospective user of a consumer report or of a credit score generated using the information in the file of a consumer that includes an extended fraud alert in accordance with this section may establish a new credit plan or extension of credit, other than under an open-end credit plan (as defined in section 1602(i) 1 of this title), in the name of the consumer, or issue an additional card on an existing credit account requested by a consumer, or any increase in credit limit on an existing credit account requested by a consumer, unless the user contacts the consumer in person or using the contact method described in subparagraph (A)(ii) to confirm that the application for a new credit plan or increase in credit limit, or request for an additional card is not the result of identity theft.
15 U.S.C. §1681c-1(i)(3)(D) — Security freeze: incomplete-application treatment
If a third party requests access to a consumer report of a consumer with respect to which a security freeze is in effect, where such request is in connection with an application for credit, and the consumer does not allow such consumer report to be accessed, the third party may treat the application as incomplete.