Identity theft and the case for a national credit report freeze law

North Carolina Banking Institute, March, 2008 by Kristan T. Cheng

I. INTRODUCTION

The statistics tell the story. (1) The personal data of over forty-five million consumers was compromised in 2005 alone. (2) From mid-2006 to 2007, approximately fifteen million Americans fell victim to identity theft due to the misuse of compromised data, a fifty percent increase since 2003. (3) The final chapter of the story is not yet written, but the statistics suggest an unhappy ending for many consumers. (4) Awareness of the threat of identity theft is one aspect of the problem. (5) Only about eleven percent of identity theft victims were aware that their personal information had been compromised prior to their information being used to commit identity theft. (6) Another aspect of the problem is that injured credit due to identity theft is difficult to remedy and extremely costly to consumers and industry. (7) Annually, consumers lose $5 billion to identity theft while businesses and financial institutions lose $48 billion. (8)

Federal legislation such as the Fair Credit Reporting Act (FCRA) and the Fair and Accurate Credit Transaction Act (FACTA) fail to provide adequate defensive protection for consumers. (9) A national credit freeze law, in conjunction with stricter security breach notification requirements, would offer superior consumer protection. (10) Although notification of a data breach is helpful in preventing identity theft, credit freeze legislation provides consumers with greater security. (11) When a consumer chooses to have her credit frozen, consumer reporting agencies are blocked from issuing copies of a consumer's credit report. (12) Freezing one's credit prevents one of the most onerous and pervasive forms of identity theft: new account fraud. (13) Criminals use stolen personal data to open new credit accounts and apply for home and auto loans. (14) A credit freeze would thwart these thieves because few lenders will issue credit without viewing an individual's credit score first. (15)

Although credit freezes would provide consumers with preventative protection from identity theft, credit freezes also can be problematic. (16) One issue is the process of unfreezing or "thawing" the credit freeze, more specifically, the speed with which it occurs when consumers wish to apply for new lines of credit for large purchases such as automobiles or special mortgage rates. (17) A thaw is necessary in these situations because in order for a new line of credit to be issued the creditor requires a copy of the consumer's credit report; if a credit freeze was placed on the consumer's report, the creditor would be unable to access the consumer's credit report. (18) State statutes range from requiring credit bureaus to allow consumers to thaw their credit histories within fifteen minutes to allowing credit bureaus as long as three days to unfreeze a consumer's credit report. (19) A waiting period can prove problematic if the consumer needs credit before the freeze can be lifted.

National credit freeze legislation is needed to provide uniform, consistent law with which to prevent identity theft and protect consumers. (20) Part II provides background on consumer reports, consumer reporting agencies, data breaches and credit freezes. (21) Part III discusses current federal law, which does not address credit freezes, and how it falls short of providing adequate consumer protection. (22) Part IV describes current state law and why it is insufficient in protecting consumers. (23) Part V explains why one federal standard for credit freezes, in conjunction with stricter data breach notification requirements, would be preferable to the current protection. (24) Part VI discusses previously proposed federal credit freeze legislation and what the content of federal legislation should be. (25) Finally, Part VII will briefly conclude. (26)

II. BACKGROUND

A. Credit Reports and Consumer Reporting Agencies (CRAs)

A credit report, or a consumer report, is any form of communication of any information, by a CRA, that discusses the consumer's credit history, general reputation, character, manner of living, or personal characteristics in anticipation that the data will be used in order to determine the consumer's eligibility for credit, insurance, employment, or other legitimate business purposes. (27) CRAs include credit bureaus, such as Equifax, Experian, and TransUnion, as well as other specialized agencies that collect and compile information about a consumer's creditworthiness from financial institutions, public records, or other available sources. (28) National CRAs compile consumer data and then sell it to creditors, insurers, employers, and other businesses that evaluate the information to determine whether credit or insurance should be granted, the individual should be hired, or property should be rented to the individual. (29)

B. Data Breaches and Credit Freezes

Data breaches occur when a consumer's personal data is lost, stolen by, or mistakenly sold to a third party which plans to use that information to commit identity theft. (30) Identity thieves are able to access consumers' Social Security numbers, home addresses, mother's maiden names, and other pertinent information. (31) They are also able to use this information to apply for new lines of credit. (32) Plans to use stolen information, however, are usually thwarted because most creditors request and examine the consumer's report before extending credit. (33)