Procedures in Response to a "Notice of Address Discrepancy"

Identity theft often results in the victim’s address being changed in the records of consumer reporting agencies. Consequently, when there is a significant difference between the consumer’s address in the records of the consumer reporting agency and the address as it appears in a request for a consumer report on that person, there is a possibility of identity theft.

To protect the consumer, the Fair Credit Reporting Act requires the consumer reporting agency that discovers such a discrepancy to alert the institution requesting the consumer report. [15 USC 1681c(h)(1)] The FCRA also requires that the federal financial institution regulatory agencies require that financial institutions have policies and procedures in place to respond to a notice of address discrepancy from a consumer reporting agency. [15 USC 1681c(h)(2)] The regulations are virtually identical.

The citations to the various regulations are as follows:

These regulations have a mandatory compliance date of November 1, 2008. Here’s a summary of what they say:

The institution must have policies and procedures that enable it to form a reasonable belief that the consumer report it has received relates to the consumer about whom the institution requested the report. For example, if the institution requests a consumer report for Mr. Charles Dalton and then receives a notice of address discrepancy, the institution’s policies and procedures must enable it to form a reasonable belief that the consumer report it received relates to the same Mr. Charles Dalton about whom the institution requested the report.

The regulations provide two examples of policies and procedures that would satisfy this standard. First, the policies and procedures could require the institution to compare the information about the consumer that is in the consumer report with information that the institution obtains (1) from its own “customer identification procedures,” (2) from its own records, or (3) from third-party sources. Second, the institution’s policies and procedures could require the institution to verify the information in the consumer report with the consumer directly.

In some circumstances, institutions must also provide the consumer reporting agency with the consumer’s verified address. If the following are all true, then this requirement applies:

The requirement, if all three of these are true, is that the institution supply to the consumer reporting agency a verified address for the consumer. The institution must supply this address in the same reporting period in which it established the relationship with the consumer.