S 2328 IS, Identity Theft Prevention Act of 2000.
Sponsor: Sen. Dianne Feinstein (D-CA).
Date introduced: March 30, 2000.
Source: Library of Congress.

To prevent identity fraud in consumer credit transactions and credit reports, and for other purposes.

IN THE SENATE OF THE UNITED STATES

March 30, 2000

Mrs. FEINSTEIN (for herself, Mr. KYL, and Mr. GRASSLEY) introduced the following bill; which was read twice and referred to the Committee on Banking, Housing, and Urban Affairs

A BILL

To prevent identity fraud in consumer credit transactions and credit reports, and for other purposes.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the `Identity Theft Prevention Act of 2000'.

SEC. 2. FINDINGS.

Congress finds that--

(1) the crime of identity theft has become one of the major law enforcement challenges of the new economy, as vast quantities of sensitive, personal information are now vulnerable to criminal interception and misuse;

(2) the United States Postal Inspection Service estimates that 50,000 people a year have become victims of identity theft since the mid-1990's;

(3) the United States Secret Service investigated identity theft losses to individuals and institutions of $745,000,000 in 1997, a 75 percent increase over the $442,000,000 lost in 1995;

(4) according to TransUnion Corporation, a national credit bureau, the total number of identity theft inquiries to its Fraud Victim Assistance Department grew from 35,235 in 1992 to 522,922 in 1997;

(5) an integral part of many identity crimes is the fraudulent acquisition of the social security number of an individual;

(6) credit issuers, credit reporting agencies, and other organizations with access to sensitive personal data have an obligation to handle such information responsibly, and should take affirmative steps to prevent identity criminals from intercepting such information;

(7) identity theft causes extraordinary damage to its victims, jeopardizing their access to needed credit and forcing many to spend years trying to restore their good name;

(8) the resources available to identity theft victims are inadequate, and both the private sector and Federal agencies should provide better and more sympathetic assistance to such victims;

(9) credit reporting agencies and credit issuers should have uniform reporting requirements and effective fraud alerts to assist identity theft victims in repairing and protecting their credit; and

(10) consumers need greater access to information that is collected about them so they can quickly identify fraudulent activity.

SEC. 3. CHANGES OF ADDRESS.

(a) DUTY OF ISSUERS OF CREDIT- Section 132 of the Truth in Lending Act (15 U.S.C. 1642) is amended--

(1) by inserting `(a) IN GENERAL- ' before `No credit'; and

(2) by adding at the end the following:

`(b) CONFIRMATION OF CHANGES OF ADDRESS-

`(1) IN GENERAL- Not later than 10 days after receiving notification from a cardholder of a change of address, a card issuer shall send to the cardholder, both to the new address and to the former address thereof, written confirmation of that change of address.

`(2) NOTIFICATION OF REQUEST FOR ADDITIONAL CARDS- If a card issuer receives a request for an additional credit card with respect to an existing credit account not later than 30 days after receiving notification of a change of address for that account, the card issuer shall notify the cardholder of the request at both the new address and the former address.'.

(b) DUTY OF CONSUMER REPORTING AGENCIES- Section 605 of the Fair Credit Reporting Act (15 U.S.C. 1681c) is amended by adding at the end the following:

`(g) NOTICE OF POTENTIAL FRAUD- A consumer reporting agency shall notify each user of a consumer report that is a creditor (as defined in section 103 of the Truth in Lending Act) if the agency becomes aware that an application to the card issuer to open a new credit card account bears an address for the consumer that is different from the address in the file of the consumer.'.

(c) ENFORCEMENT-

(1) FEDERAL TRADE COMMISSION- Except as provided in paragraph (2), compliance with section 132(b) of the Truth in Lending Act (as added by this section) shall be enforced by the Federal Trade Commission in the same manner and with the same power and authority as the Commission has under the Fair Debt Collection Practices Act to enforce compliance with that Act.

(2) OTHER AGENCIES IN CERTAIN CASES-

(A) IN GENERAL- Compliance with section 132(b) of the Truth in Lending Act (as added by this section) shall be enforced under--

(i) section 8 of the Federal Deposit Insurance Act, in the case of a card issuer that is--

(I) a national bank or a Federal branch or Federal agency of a foreign bank, by the Office of the Comptroller of the Currency;

(II) a member bank of the Federal Reserve System (other than a national bank), a branch or agency of a foreign bank (other than a Federal branch, Federal agency, or insured State branch of a foreign bank), a commercial lending company owned or controlled by a foreign bank, or an organization operating under section 25 or 25A of the Federal Reserve Act, by the Board of Governors of the Federal Reserve System;

(III) a bank insured by the Federal Deposit Insurance Corporation (other than a member of the Federal Reserve System or a national nonmember bank) or an insured State branch of a foreign bank, by the Board of Directors of the Federal Deposit Insurance Corporation; and

(IV) a savings association, the deposits of which are insured by the Federal Deposit Insurance Corporation, by the Director of the Office of Thrift Supervision; and

(ii) the Federal Credit Union Act, by the Administrator of the National Credit Union Administration in the case of a card issuer that is a Federal credit union, as defined in that Act.

(3) VIOLATIONS TREATED AS VIOLATIONS OF OTHER LAWS- For the purpose of the exercise by any agency referred to in this subsection of its powers under any Act referred to in this subsection, a violation of section 132(b) of the Truth in Lending Act (as added by this section) shall be deemed to be a violation of a requirement imposed under that Act. In addition to its powers under any provision of law specifically referred to in paragraph (1) or (2), each of the agencies referred to in those paragraphs may exercise, for the purpose of enforcing compliance with section 132(b) of the Truth in Lending Act (as added by this section), any other authority conferred on such agency by law.

SEC. 4. FRAUD ALERTS.

Section 605 of the Fair Credit Reporting Act (15 U.S.C. 1681c) is amended by adding at the end the following:

`(h) FRAUD ALERTS-

`(1) IN GENERAL- Upon the request of a consumer, a consumer reporting agency shall include a fraud alert in the file of that consumer.

`(2) NOTICE TO USERS- A consumer reporting agency shall notify each person procuring consumer credit information with respect to a consumer of the existence of a fraud alert in the file of that consumer, regardless of whether a full credit report, credit score, or summary report is requested.

`(3) PENALTIES- Any consumer reporting agency that fails to comply with this subsection, and any user of a consumer report that fails to comply with preauthorization procedures contained in a fraud alert and issues or extends credit in the name of the consumer to a person other than the consumer, shall be in violation of this section.

`(4) DEFINITION- In this subsection, the term `fraud alert' means a clear and conspicuous statement in the file of a consumer that notifies all prospective users of a consumer report made with respect to that consumer that the consumer does not authorize the issuance or extension of credit in the name of the consumer unless--

`(A) the issuer of such credit first obtains verbal authorization from the consumer at a telephone number designated by the consumer; or

`(B) the issuer complies with such other method of preauthorization by the consumer as is mutually agreed upon by the consumer and the consumer reporting agency.'.

SEC. 5. REGULATIONS ON DUTY TO INVESTIGATE.

Not later than 6 months after the date of enactment of this Act, the Federal Trade Commission shall promulgate regulations to require each consumer reporting agency (as defined in section 603 of the Fair Credit Reporting Act) to investigate discrepancies between personal or identifying information contained in the file maintained by the agency with respect to a consumer and in the personal and identifying information supplied to the agency by the user of the consumer report.

SEC. 6. FREE REPORTS ANNUALLY.

Section 612(c) of the Fair Credit Reporting Act (15 U.S.C. 1681j(c)) is amended to read as follows:

`(c) FREE ANNUAL DISCLOSURE- Upon the request of the consumer, a consumer reporting agency shall make all disclosures pursuant to section 609 once during any 12-month period without charge to the consumer.'.

SEC. 7. IDENTIFYING INFORMATION.

(a) LIMITATION- The Fair Credit Reporting Act (15 U.S.C. 1601 et seq.) is amended--

(1) by redesignating section 624 (15 U.S.C. 1681t, as so designated by Public Law 104-208) as section 626 and moving that section to the end of the Act;

(2) by redesignating section 624 (15 U.S.C. 1681u, as added by Public Law 104-93) as section 625; and

(3) by inserting after section 623 the following:

`SEC. 624. OTHER IDENTIFYING INFORMATION.

`Except as provided in section 608, a consumer reporting agency may furnish consumer identifying information, other than the name, generational designation, and current address of the consumer, only in a consumer report.'.

(b) DISCLOSURES TO GOVERNMENTAL AGENCIES- Section 608 of the Fair Credit Reporting Act (15 U.S.C. 1681f) is amended by striking `section 604' and inserting `sections 604 and 623'.

(c) PERMISSIBLE PURPOSES- Section 604(a) of the Fair Credit Reporting Act (15 U.S.C. 1681b(a)) is amended in the matter preceding paragraph (1) by inserting `or any identifying information (other than the name, generational designation, or current address of the consumer)' after `a consumer report'.

SEC. 8. INDIVIDUAL REFERENCE SERVICES.

(a) IN GENERAL- An individual reference services provider shall, upon request and proper identification of a consumer--

(1) clearly and accurately disclose to the consumer the nature, content, and substance of all information in the file maintained by the provider with respect to the consumer at the time of the request that is obtainable based upon the identifying information supplied by the consumer when making such request; and

(2) if the consumer has made a written request, deliver a written copy or photocopy of all information described in paragraph (1), together with a clear, simple, and plain meaning explanation of the information provided under this subsection, in a readable format and type, which shall in no case be smaller than 10 point type.

(b) INDIVIDUAL REFERENCE SERVICES PROVIDER DEFINED-

(1) IN GENERAL- In this section, the term `individual reference services provider'--

(A) means any person that, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in the practice of creating, assembling, evaluating, or providing information, either directly or as a supplier to others, with respect to any person regarding any 2 or more items of information described in paragraph (2); and

(B) does not include the Federal Government or any State government or political subdivision thereof.

(2) TYPES OF INFORMATION- The items of information described in this paragraph are--

(A) social security number or other social security information;

(B) mother's maiden name;

(C) prior address;

(D) birth date;

(E) criminal history;

(F) history of civil actions;

(G) driving records;

(H) vehicle information;

(I) past employment history;

(J) income level;

(K) tax records;

(L) history of voter registration; and

(M) other similar information, as determined by the Federal Trade Commission.

SEC. 9. EXTENSION OF THE CIVIL MONETARY PENALTY AUTHORITY.

(a) IN GENERAL- Section 1129(a) of the Social Security Act (42 U.S.C. 1320a-8(a)) is amended--

(1) by striking `(A)', `(B)', and `(C)' and inserting `(i)', `(ii)', and `(iii)', respectively;

(2) by striking `(a)(1)' and inserting `(a)(1)(A)';

(3) by striking `(2)' and inserting `(B)'; and

(4) by adding at the end the following new paragraph:

`(2) Any person (including an organization, agency, or other entity) who--

`(A) having received, while acting in the capacity as representative payee pursuant to section 205(j) or section 1631(a)(2), a payment under title II or title XVI for the use and benefit of another individual, converts such payment, or any part thereof, to a use that such person knows or should know is other than for the use and benefit of such other individual; or

`(B) uses a social security account number that such person knows or should know has been assigned by the Commissioner of Social Security (pursuant to an exercise of authority under section 205(c)(2) to establish and maintain records) on the basis of false information furnished to the Commissioner of Social Security by any individual; or

`(C) falsely represents a number to be the social security account number assigned by the Commissioner of Social Security to any individual, when such person knows or should know that such number is not the social security account number assigned by the Commissioner of Social Security to such individual; or

`(D) knowingly alters a social security card issued by the Commissioner of Social Security, or possesses such a card with intent to alter it; or

`(E) knowingly buys or sells a card that is, or purports to be, a card issued by the Commissioner of Social Security, or possesses such a card with intent to buy or sell it; or

`(f) counterfeits a social security card, or possesses a counterfeit card with intent to buy or sell it; or

`(G) discloses, uses, or compels the disclosure of the social security account number of any person in violation of the laws of the United States

shall be subject to, in addition to any other penalties that may be prescribed by law, a civil money penalty of not more than $5,000 for each such violation.'.

(b) CONFORMING AMENDMENTS-

(1) Section 1129(b)(3)(A) of the Social Security Act (42 U.S.C. 1320a-8(b)(3)(A)) is amended by striking `charging fraud or false statements'.

(2) Section 1129(c)(1) of such Act (42 U.S.C. 1320a-8(c)(1)) is amended by striking `and representations' and inserting `, representations, or actions'.

(3) Section 1129(e)(1)(A) of such Act (42 U.S.C. 1320a-8(e)(1)(A)) is amended by striking `statement or representation referred to in subsection (a) was made' and inserting `violation occurred'.

(4) Section 1129(l) of such Act (42 U.S.C. 1320a-8(l)) is amended by inserting `assignment of a social security account number or' after `application of an individual for'.

(c) EFFECTIVE DATE- The amendments made by this section shall be effective with respect to violations committed after the date of enactment of this Act.

SEC. 10. MODEL FORMS.

(a) IN GENERAL- Six months after the date of enactment of this Act, the Federal Trade Commission shall develop a model form and standard procedures to be used by consumers that are victims of identity fraud in contacting and informing creditors and credit reporting agencies of such fraud, if the Commission determines, at that time, that issuers of credit and credit reporting agencies have failed to jointly develop such a model form and standard procedures.

(b) CONTENTS- A model form developed under subsection (a) (by the Commission or the issuers and agencies referred to therein) shall require information necessary to demonstrate the fraudulent activity done in the name of the consumer to whom the form relates, including, if applicable--

(1) a notarized affidavit or police report relating to the activity;

(2) a notarized handwriting sample; and

(3) any other relevant documentation.