(a) One-call fraud alerts

(1) Initial alerts

Upon the direct request of a consumer, or an individual acting on behalf of or as a personal representative of a consumer, who asserts in good faith a suspicion that the consumer has been or is about to become a victim of fraud or related crime, including identity theft, a consumer reporting agency described in section 1681a(p) of this title that maintains a file on the consumer and has received appropriate proof of the identity of the requester shall—

(A) include a fraud alert in the file of that consumer, and also provide that alert along with any credit score generated in using that file, for a period of not less than 1 year, beginning on the date of such request, unless the consumer or such representative requests that such fraud alert be removed before the end of such period, and the agency has received appropriate proof of the identity of the requester for such purpose; and

(B) refer the information regarding the fraud alert under this paragraph to each of the other consumer reporting agencies described in section 1681a(p) of this title, in accordance with procedures developed under section 1681s(f) of this title.

(2) Access to free reports

In any case in which a consumer reporting agency includes a fraud alert in the file of a consumer pursuant to this subsection, the consumer reporting agency shall—

(A) disclose to the consumer that the consumer may request a free copy of the file of the consumer pursuant to section 1681j(d) of this title; and

(B) provide to the consumer all disclosures required to be made under section 1681g of this title, without charge to the consumer, not later than 3 business days after any request described in subparagraph (A).

(b) Extended alerts

(1) In general

Upon the direct request of a consumer, or an individual acting on behalf of or as a personal representative of a consumer, who submits an identity theft report to a consumer reporting agency described in section 1681a(p) of this title that maintains a file on the consumer, if the agency has received appropriate proof of the identity of the requester, the agency shall—

(A) include a fraud alert in the file of that consumer, and also provide that alert along with any credit score generated in using that file, during the 7-year period beginning on the date of such request, unless the consumer or such representative requests that such fraud alert be removed before the end of such period and the agency has received appropriate proof of the identity of the requester for such purpose;

(B) during the 5-year period beginning on the date of such request, exclude the consumer from any list of consumers prepared by the consumer reporting agency and provided to any third party to offer credit or insurance to the consumer as part of a transaction that was not initiated by the consumer, unless the consumer or such representative requests that such exclusion be rescinded before the end of such period; and

(C) refer the information regarding the extended fraud alert under this paragraph to each of the other consumer reporting agencies described in section 1681a(p) of this title, in accordance with procedures developed under section 1681s(f) of this title.

(2) Access to free reports

In any case in which a consumer reporting agency includes a fraud alert in the file of a consumer pursuant to this subsection, the consumer reporting agency shall—

(A) disclose to the consumer that the consumer may request 2 free copies of the file of the consumer pursuant to section 1681j(d) of this title during the 12-month period beginning on the date on which the fraud alert was included in the file; and

(B) provide to the consumer all disclosures required to be made under section 1681g of this title, without charge to the consumer, not later than 3 business days after any request described in subparagraph (A).

(c) Active duty alerts

Upon the direct request of an active duty military consumer, or an individual acting on behalf of or as a personal representative of an active duty military consumer, a consumer reporting agency described in section 1681a(p) of this title that maintains a file on the active duty military consumer and has received appropriate proof of the identity of the requester shall—

(1) include an active duty alert in the file of that active duty military consumer, and also provide that alert along with any credit score generated in using that file, during a period of not less than 12 months, or such longer period as the Bureau shall determine, by regulation, beginning on the date of the request, unless the active duty military consumer or such representative requests that such fraud alert be removed before the end of such period, and the agency has received appropriate proof of the identity of the requester for such purpose;

(2) during the 2-year period beginning on the date of such request, exclude the active duty military consumer from any list of consumers prepared by the consumer reporting agency and provided to any third party to offer credit or insurance to the consumer as part of a transaction that was not initiated by the consumer, unless the consumer requests that such exclusion be rescinded before the end of such period; and

(3) refer the information regarding the active duty alert to each of the other consumer reporting agencies described in section 1681a(p) of this title, in accordance with procedures developed under section 1681s(f) of this title.

(d) Procedures

Each consumer reporting agency described in section 1681a(p) of this title shall establish policies and procedures to comply with this section, including procedures that inform consumers of the availability of initial, extended, and active duty alerts and procedures that allow consumers and active duty military consumers to request initial, extended, or active duty alerts (as applicable) in a simple and easy manner, including by telephone.

(e) Referrals of alerts

Each consumer reporting agency described in section 1681a(p) of this title that receives a referral of a fraud alert or active duty alert from another consumer reporting agency pursuant to this section shall, as though the agency received the request from the consumer directly, follow the procedures required under—

(1) paragraphs (1)(A) and (2) of subsection (a), in the case of a referral under subsection (a)(1)(B);

(2) paragraphs (1)(A), (1)(B), and (2) of subsection (b), in the case of a referral under subsection (b)(1)(C); and

(3) paragraphs (1) and (2) of subsection (c), in the case of a referral under subsection (c)(3).

(f) Duty of reseller to reconvey alert

A reseller shall include in its report any fraud alert or active duty alert placed in the file of a consumer pursuant to this section by another consumer reporting agency.

(g) Duty of other consumer reporting agencies to provide contact information

If a consumer contacts any consumer reporting agency that is not described in section 1681a(p) of this title to communicate a suspicion that the consumer has been or is about to become a victim of fraud or related crime, including identity theft, the agency shall provide information to the consumer on how to contact the Bureau and the consumer reporting agencies described in section 1681a(p) of this title to obtain more detailed information and request alerts under this section.

(h) Limitations on use of information for credit extensions

(1) Requirements for initial and active duty alerts

(A) Notification

Each initial fraud alert and active duty alert under this section shall include information that notifies all prospective users of a consumer report on the consumer to which the alert relates that the consumer does not authorize the establishment of any new credit plan or extension of credit, other than under an open-end credit plan (as defined in section 1602(i) ¹ of this title), in the name of the consumer, or issuance of an additional card on an existing credit account requested by a consumer, or any increase in credit limit on an existing credit account requested by a consumer, except in accordance with subparagraph (B).

(B) Limitation on users

(i) In general

No prospective user of a consumer report that includes an initial fraud alert or an active duty alert in accordance with this section may establish a new credit plan or extension of credit, other than under an open-end credit plan (as defined in section 1602(i) ¹ of this title), in the name of the consumer, or issue an additional card on an existing credit account requested by a consumer, or grant any increase in credit limit on an existing credit account requested by a consumer, unless the user utilizes reasonable policies and procedures to form a reasonable belief that the user knows the identity of the person making the request.

(ii) Verification

If a consumer requesting the alert has specified a telephone number to be used for identity verification purposes, before authorizing any new credit plan or extension described in clause (i) in the name of such consumer, a user of such consumer report shall contact the consumer using that telephone number or take reasonable steps to verify the consumer’s identity and confirm that the application for a new credit plan is not the result of identity theft.

(2) Requirements for extended alerts

(A) Notification

Each extended alert under this section shall include information that provides all prospective users of a consumer report relating to a consumer with—

(i) notification that the consumer does not authorize the establishment of any new credit plan or extension of credit described in clause (i), other than under an open-end credit plan (as defined in section 1602(i) ¹ of this title), in the name of the consumer, or issuance of an additional card on an existing credit account requested by a consumer, or any increase in credit limit on an existing credit account requested by a consumer, except in accordance with subparagraph (B); and

(ii) a telephone number or other reasonable contact method designated by the consumer.

(B) Limitation on users

No prospective user of a consumer report or of a credit score generated using the information in the file of a consumer that includes an extended fraud alert in accordance with this section may establish a new credit plan or extension of credit, other than under an open-end credit plan (as defined in section 1602(i) ¹ of this title), in the name of the consumer, or issue an additional card on an existing credit account requested by a consumer, or any increase in credit limit on an existing credit account requested by a consumer, unless the user contacts the consumer in person or using the contact method described in subparagraph (A)(ii) to confirm that the application for a new credit plan or increase in credit limit, or request for an additional card is not the result of identity theft.

(i) National security freeze

(1) Definitions

For purposes of this subsection:

(A) The term “consumer reporting agency” means a consumer reporting agency described in section 1681a(p) of this title.

(B) The term “proper identification” has the meaning of such term as used under section 1681h of this title.

(C) The term “security freeze” means a restriction that prohibits a consumer reporting agency from disclosing the contents of a consumer report that is subject to such security freeze to any person requesting the consumer report.

(2) Placement of security freeze

(A) In general

Upon receiving a direct request from a consumer that a consumer reporting agency place a security freeze, and upon receiving proper identification from the consumer, the consumer reporting agency shall, free of charge, place the security freeze not later than—

(i) in the case of a request that is by toll-free telephone or secure electronic means, 1 business day after receiving the request directly from the consumer; or

(ii) in the case of a request that is by mail, 3 business days after receiving the request directly from the consumer.

(B) Confirmation and additional information

Not later than 5 business days after placing a security freeze under subparagraph (A), a consumer reporting agency shall—

(i) send confirmation of the placement to the consumer; and

(ii) inform the consumer of—

(I) the process by which the consumer may remove the security freeze, including a mechanism to authenticate the consumer; and

(II) the consumer’s right described in section 1681m(d)(1)(D) of this title.

(C) Notice to third parties

A consumer reporting agency may advise a third party that a security freeze has been placed with respect to a consumer under subparagraph (A).

(3) Removal of security freeze

(A) In general

A consumer reporting agency shall remove a security freeze placed on the consumer report of a consumer only in the following cases:

(i) Upon the direct request of the consumer.

(ii) The security freeze was placed due to a material misrepresentation of fact by the consumer.

(B) Notice if removal not by request

If a consumer reporting agency removes a security freeze under subparagraph (A)(ii), the consumer reporting agency shall notify the consumer in writing prior to removing the security freeze.

(C) Removal of security freeze by consumer request

Except as provided in subparagraph (A)(ii), a security freeze shall remain in place until the consumer directly requests that the security freeze be removed. Upon receiving a direct request from a consumer that a consumer reporting agency remove a security freeze, and upon receiving proper identification from the consumer, the consumer reporting agency shall, free of charge, remove the security freeze not later than—

(i) in the case of a request that is by toll-free telephone or secure electronic means, 1 hour after receiving the request for removal; or

(ii) in the case of a request that is by mail, 3 business days after receiving the request for removal.

(D) Third-party requests

If a third party requests access to a consumer report of a consumer with respect to which a security freeze is in effect, where such request is in connection with an application for credit, and the consumer does not allow such consumer report to be accessed, the third party may treat the application as incomplete.

(E) Temporary removal of security freeze

Upon receiving a direct request from a consumer under subparagraph (A)(i), if the consumer requests a temporary removal of a security freeze, the consumer reporting agency shall, in accordance with subparagraph (C), remove the security freeze for the period of time specified by the consumer.

(4) Exceptions

A security freeze shall not apply to the making of a consumer report for use of the following:

(A) A person or entity, or a subsidiary, affiliate, or agent of that person or entity, or an assignee of a financial obligation owed by the consumer to that person or entity, or a prospective assignee of a financial obligation owed by the consumer to that person or entity in conjunction with the proposed purchase of the financial obligation, with which the consumer has or had prior to assignment an account or contract including a demand deposit account, or to whom the consumer issued a negotiable instrument, for the purposes of reviewing the account or collecting the financial obligation owed for the account, contract, or negotiable instrument. For purposes of this subparagraph, “reviewing the account” includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.

(B) Any Federal, State, or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena.

(C) A child support agency acting pursuant to part D of title IV of the Social Security Act (42 U.S.C. 651 et seq.).

(D) A Federal agency or a State or its agents or assigns acting to investigate fraud or acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities, provided such responsibilities are consistent with a permissible purpose under section 1681b of this title.

(E) By a person using credit information for the purposes described under section 1681b(c) of this title.

(F) Any person or entity administering a credit file monitoring subscription or similar service to which the consumer has subscribed.

(G) Any person or entity for the purpose of providing a consumer with a copy of the consumer’s consumer report or credit score, upon the request of the consumer.

(H) Any person using the information in connection with the underwriting of insurance.

(I) Any person using the information for employment, tenant, or background screening purposes.

(J) Any person using the information for assessing, verifying, or authenticating a consumer’s identity for purposes other than the granting of credit, or for investigating or preventing actual or potential fraud.

(5) Notice of rights

At any time a consumer is required to receive a summary of rights required under section 1681g of this title, the following notice shall be included:

“Consumers Have the Right To Obtain a Security Freeze

“You have a right to place a ‘security freeze’ on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit.

“As an alternative to a security freeze, you have the right to place an initial or extended fraud alert on your credit file at no cost. An initial fraud alert is a 1-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting 7 years.

“A security freeze does not apply to a person or entity, or its affiliates, or collection agencies acting on behalf of the person or entity, with which you have an existing account that requests information in your credit report for the purposes of reviewing or collecting the account. Reviewing the account includes activities related to account maintenance, monitoring, credit line increases, and account upgrades and enhancements.”.

(6) Webpage

(A) Consumer reporting agencies

A consumer reporting agency shall establish a webpage that—

(i) allows a consumer to request a security freeze;

(ii) allows a consumer to request an initial fraud alert;

(iii) allows a consumer to request an extended fraud alert;

(iv) allows a consumer to request an active duty fraud alert;

(v) allows a consumer to opt-out of the use of information in a consumer report to send the consumer a solicitation of credit or insurance, in accordance with section 1681m(d) of this title; and

(vi) shall not be the only mechanism by which a consumer may request a security freeze.

(B) FTC

The Federal Trade Commission shall establish a single webpage that includes a link to each webpage established under subparagraph (A) within the Federal Trade Commission’s website www.Identitytheft.gov, or a successor website.

(j) National protection for files and credit records of protected consumers

(1) Definitions

As used in this subsection:

(A) The term “consumer reporting agency” means a consumer reporting agency described in section 1681a(p) of this title.

(B) The term “protected consumer” means an individual who is—

(i) under the age of 16 years at the time a request for the placement of a security freeze is made; or

(ii) an incapacitated person or a protected person for whom a guardian or conservator has been appointed.

(C) The term “protected consumer’s representative” means a person who provides to a consumer reporting agency sufficient proof of authority to act on behalf of a protected consumer.

(D) The term “record” means a compilation of information that—

(i) identifies a protected consumer;

(ii) is created by a consumer reporting agency solely for the purpose of complying with this subsection; and

(iii) may not be created or used to consider the protected consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.

(E) The term “security freeze” means a restriction that prohibits a consumer reporting agency from disclosing the contents of a consumer report that is the subject of such security freeze or, in the case of a protected consumer for whom the consumer reporting agency does not have a file, a record that is subject to such security freeze to any person requesting the consumer report for the purpose of opening a new account involving the extension of credit.

(F) The term “sufficient proof of authority” means documentation that shows a protected consumer’s representative has authority to act on behalf of a protected consumer and includes—

(i) an order issued by a court of law;

(ii) a lawfully executed and valid power of attorney;

(iii) a document issued by a Federal, State, or local government agency in the United States showing proof of parentage, including a birth certificate; or

(iv) with respect to a protected consumer who has been placed in a foster care setting, a written communication from a county welfare department or its agent or designee, or a county probation department or its agent or designee, certifying that the protected consumer is in a foster care setting under its jurisdiction.

(G) The term “sufficient proof of identification” means information or documentation that identifies a protected consumer and a protected consumer’s representative and includes—

(i) a social security number or a copy of a social security card issued by the Social Security Administration;

(ii) a certified or official copy of a birth certificate issued by the entity authorized to issue the birth certificate; or

(iii) a copy of a driver’s license, an identification card issued by the motor vehicle administration, or any other government issued identification.

(2) Placement of security freeze for a protected consumer

(A) In general

Upon receiving a direct request from a protected consumer’s representative that a consumer reporting agency place a security freeze, and upon receiving sufficient proof of identification and sufficient proof of authority, the consumer reporting agency shall, free of charge, place the security freeze not later than—

(i) in the case of a request that is by toll-free telephone or secure electronic means, 1 business day after receiving the request directly from the protected consumer’s representative; or

(ii) in the case of a request that is by mail, 3 business days after receiving the request directly from the protected consumer’s representative.

(B) Confirmation and additional information

Not later than 5 business days after placing a security freeze under subparagraph (A), a consumer reporting agency shall—

(i) send confirmation of the placement to the protected consumer’s representative; and

(ii) inform the protected consumer’s representative of the process by which the protected consumer may remove the security freeze, including a mechanism to authenticate the protected consumer’s representative.

(C) Creation of file

If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a direct request under subparagraph (A), the consumer reporting agency shall create a record for the protected consumer.

(3) Prohibition on release of record or file of protected consumer

After a security freeze has been placed under paragraph (2)(A), and unless the security freeze is removed in accordance with this subsection, a consumer reporting agency may not release the protected consumer’s consumer report, any information derived from the protected consumer’s consumer report, or any record created for the protected consumer.

(4) Removal of a protected consumer security freeze

(A) In general

A consumer reporting agency shall remove a security freeze placed on the consumer report of a protected consumer only in the following cases:

(i) Upon the direct request of the protected consumer’s representative.

(ii) Upon the direct request of the protected consumer, if the protected consumer is not under the age of 16 years at the time of the request.

(iii) The security freeze was placed due to a material misrepresentation of fact by the protected consumer’s representative.

(B) Notice if removal not by request

If a consumer reporting agency removes a security freeze under subparagraph (A)(iii), the consumer reporting agency shall notify the protected consumer’s representative in writing prior to removing the security freeze.

(C) Removal of freeze by request

Except as provided in subparagraph (A)(iii), a security freeze shall remain in place until a protected consumer’s representative or protected consumer described in subparagraph (A)(ii) directly requests that the security freeze be removed. Upon receiving a direct request from the protected consumer’s representative or protected consumer described in subparagraph (A)(ii) that a consumer reporting agency remove a security freeze, and upon receiving sufficient proof of identification and sufficient proof of authority, the consumer reporting agency shall, free of charge, remove the security freeze not later than—

(i) in the case of a request that is by toll-free telephone or secure electronic means, 1 hour after receiving the request for removal; or

(ii) in the case of a request that is by mail, 3 business days after receiving the request for removal.

(D) Temporary removal of security freeze

Upon receiving a direct request from a protected consumer or a protected consumer’s representative under subparagraph (A)(i), if the protected consumer or protected consumer’s representative requests a temporary removal of a security freeze, the consumer reporting agency shall, in accordance with subparagraph (C), remove the security freeze for the period of time specified by the protected consumer or protected consumer’s representative.

(k) Credit monitoring

(1) Definitions

In this subsection:

(A) The term “active duty military consumer” includes a member of the National Guard.

(B) The term “National Guard” has the meaning given the term in section 101(c) of title 10.

(2) Credit monitoring

A consumer reporting agency described in section 1681a(p) of this title shall provide a free electronic credit monitoring service that, at a minimum, notifies a consumer of material additions or modifications to the file of the consumer at the consumer reporting agency to any consumer who provides to the consumer reporting agency—

(A) appropriate proof that the consumer is an active duty military consumer; and

(B) contact information of the consumer.

(3) Rulemaking

Not later than 1 year after May 24, 2018, the Federal Trade Commission shall promulgate regulations regarding the requirements of this subsection, which shall at a minimum include—

(A) a definition of an electronic credit monitoring service and material additions or modifications to the file of a consumer; and

(B) what constitutes appropriate proof.

(4) Applicability

(A) Sections 1681n and 1681o of this title shall not apply to any violation of this subsection.

(B) This subsection shall be enforced exclusively under section 1681s of this title by the Federal agencies and Federal and State officials identified in that section.