No Charge for Credit Freezes and Fraud Alerts
Consumer reporting agencies are prohibited from charging consumers a fee to place or remove a security freeze on the consumer’s credit file or to place a fraud alert. The change is part of Title III of the recently passed Economic Growth, Regulatory Relief, and Consumer Protection Act, and became effective September 21, 2018.
The Act requires that a CRA, upon receipt of a direct request from a consumer, must place a security freeze on the consumer’s credit file, free of charge, not later than: (i) 1 business day in the case of a request by toll-free telephone or secure electronic means; or (ii) 3 business days in the case of a request by mail. Within 5 days after placing the freeze, the CRA must also send confirmation of the placement to the consumer and information regarding: (i) the process by which the consumer can remove the freeze; and (ii) the consumer’s right under FCRA to opt out of the use of information contained in a consumer report to send the consumer a solicitation of credit or insurance.
The Act permits a CRA to remove a security freeze only if: (i) the consumer requests such removal; or (ii) the security freeze was placed due to a material misrepresentation of fact by the consumer. If acting upon a consumer’s request the CRA must, free of charge, remove the freeze not later than: (i) 1 hour in the case of a request by toll-free telephone or secure electronic means; or (ii) 3 business days in the case of a request by mail. If a freeze is removed due to a material misrepresentation, the CRA must notify the consumer in writing prior to removal. Upon receiving a consumer’s request for a temporary removal of a freeze, the CRA must remove the freeze for the period specified. The Act also provides parents with the right to place a security freeze, without cost, on the credit files of their children who are under 16, and allows guardians, conservators, and persons with a valid power of attorney to place free security freezes on the credit files of their dependents.
In addition, the Act requires CRAs to establish a webpage that allows a consumer to: (i) request an extended fraud alert; (ii) request an active duty fraud alert; and (iii) opt out of the use of information in a consumer report to send the consumer a solicitation of credit or insurance, in accordance with FCRA. The Act also requires that the FTC establish a single webpage within the website www.identitytheft.gov, which is maintained by the FTC, that includes a link to each such webpage established by a CRA. The Act also amends FCRA to increase the length of time a CRA must include a fraud alert in a consumer’s file from 90 days to one year, and to require that whenever a consumer is entitled to receive a Summary of Consumer Identity Theft Rights model form or a Summary of Consumer Rights model form, a notice regarding the new security freeze rights must also be included.
A copy of the Act is available here.
