1. Fair Credit Reporting Act You must be told if information in your file has been used against you You can find out what is in your file You can dispute inaccurate information with the Credit Reporting Agency Inaccurate information must be corrected or deleted. – However, the CRA is not required to remove accurate data from your file unless it is outdated (as described below) or cannot be verified. You can dispute inaccurate items with the source of the information Outdated information may not be reported (7 years for derogatory information, 10 years for bankruptcy)

2. Access to your file is limited – Only to people with a need recognized by the FCRA usually to consider an application with a creditor, insurer, employer, landlord or other business Your consent is required for reports that are provided to employers, or reports that contain medical information You may choose to exclude your name from CRA lists for unsolicited credit and insurance offers. You may seek damages from violators

3. Changes to the FCRA made in 2003 One Call Fraud Alerts (credit bureau called has to alert the other bureaus) – Any consumer can request a fraud alert for 90 days or an extended alert for 7 years Alert must be included with a credit report and with the delivery of the credit score Users of reports and scores cannot issue new credit line or extension of credit or higher credit limit unless call the consumer to verify. Trade Line Blockingblock trade lines when consumer provides an identity theft report that has been filed with law enforcement Business records disclosureif have police report, ID theft victim can get copies of reports from businesses where a thief opened an account to help clear their names Red Flag Guidelines for new accounts and change of address verification Credit card number truncation on consumer reports

4. Social security number truncation Prohibits sale or collection of ID theft debts Debt collector notice requirement – third party debt collectors Prevention of repollutioncreditors must have policies to prevent refurnishing information arising from ID theft Annual free credit reports within 15 days of request ReinvestigationsCRA have 45 days to reinvestigate disputed items resulting from free credit report request Credit Bureaus must provide credit scores Mortgage lenders must provide credit scores Notification of address discrepancy One-time written notification by financial institution to consumer that negative information will be sent to credit bureau

5. Disposal of consumer information and records containing consumer information Medical information in a consumer report must be coded to obscure specific health care provider and the nature of medical services provided Statute of limitations extendedcan sue up to two years following discovery or five years following date of violation, whichever is earlier Requires that users of credit reports have a permissible purpose to obtain them and CRAs should maintain security and integrity of consumer files and allows consumers to limit certain uses of their reports

6. Stronger opt-out for prescreening based on credit report information –prescreened offers must have phone number to opt out of such offers in easy to understand format Established a financial literacy education commission

7. Red Flag Rules Delayed several times; most recent delay expired Jan 2011 Anti-fraud regulation requiring creditors and financial institutions to identify, detect and respond to warning signs that could indicate ID theft Process to detect – Discrepancies in address history – Fraud alerts on credit reports – Suspicious use of SSNs – Inactive accounts that suddenly become active – Credit-freeze notifications – Credit reports with suspicious activity patterns – Notices from ID theft victims or law enforcement

8. Red Flag Program Clarification Act Effective December 2010 Specified that the rules would apply to institutions that are involved in credit transactions as a part of their business; this eliminated such entities as health care providers, etc. who provide service and then are paid later.