Consumer Credit Reports and Security Freezes

Protecting Consumer Data – COVID-19 Concerns

Social Media Scams. According to data released in October 2020 from the Federal Trade Commission (FTC), there has been a surge in reports from consumers who say they lost money to a scam that started on social media, including what the FTC calls “a spike of complaints” at the height of the COVID-19 pandemic. The data show the number of complaints about social media-based scams more than tripled in the last year, with reported losses of more than $117 million attributed to this type of scam in the first 6 months of 2020 ($134 million for all of 2019). Additional information about COVID-19 resources, including tips to avoid pandemic-related scams, is available at: https://www.ftc.gov/coronavirus.

Unemployment Benefits Fraud. Another emerging scam during this pandemic features imposters filing claims for unemployment benefits using the names and personal information of persons who have not filed claims. People learn about this fraud when they receive notice from their state unemployment benefits agency or their employer about a supposed application for benefits. In this instance, consumers are advised by the FTC to report this fraud to their employers and the state unemployment benefits agency. In Kansas, individuals may file such reports with the Kansas Department of Labor, filing with this form: https://www.fraudreport.ks.gov/. Individuals will also need to take steps to report the fraud to the FTC and monitor their consumer credit reports. Information about these steps follows.

Identity Theft

Identity theft, including fraudulent claims for unemployment benefits described above, is a fast-growing crime in the United States. Consumers can combat identity theft by placing a security freeze on their credit reports (known as “consumer reports” under Kansas law), making it more difficult for identity thieves to open new accounts in the consumer’s name. In recent years, various states, including Kansas, and the federal government have taken action to allow consumers to place and remove security freezes on their credit reports for free.

Security Freezes

The FTC provides consumer information on security freezes. A consumer may place a security freeze, also known as a credit freeze, on the consumer’s credit report. The security freeze allows a consumer to restrict access to the credit report (the credit report or any consumer information contained in the report cannot be released without authorization from the consumer), which makes it more difficult for identity thieves to open new accounts in the consumer’s name. A security freeze does not affect the consumer’s credit score or prevent the consumer from obtaining a free annual credit report. However, if the consumer wants to open a new account, apply for a job, rent an apartment, or buy insurance, the consumer will need to temporarily lift the freeze.

Consumer Reporting Agencies and Credit Reports

Consumer reporting agencies (CRAs), also known as credit bureaus or credit reporting companies, compile and sell credit reports. According to the Consumer Financial Protection Bureau (CFPB), CRAs collect credit account information about consumer borrowing and repayment history, including the original amount of a loan; the credit limit on a credit card; the balance on a credit card or other loan; the payment status of the account, including whether the consumer has repaid loans on time; items sent for collection; and public records, such as judgments and bankruptcies. Credit reports also contain personal information, including the consumer’s name and any name used in the past in connection with a credit account, including nicknames; current and former addresses; birth date; Social Security number; and phone numbers.

CRAs sell the information in a consumer’s report to creditors, insurers, employers, and other businesses. Lenders use these reports to help determine whether they will loan a consumer money, what interest rates to offer, and whether the consumer will meet the terms of a credit account. Other businesses might use these credit reports to determine whether to offer the consumer insurance; rent a home to a consumer; or provide the consumer with cable television, Internet, utilities, or cellphone service.

The FTC specifies CRAs may not provide information about the consumer to the employer or a prospective employer without the consumer’s written consent. (Note: Kansas law contains provisions governing release of consumer report information to employers; see KSA 50-705 and 50-712.)

The FTC’s role is to protect consumers and promote competition. The FTC enforces the Fair Credit Reporting Act (FCRA) with respect to CRAs. The FCRA is a federal law that provides directions and limits on how CRAs disclose credit report information. The FCRA requires each of the nationwide CRAs (Equifax, Experian, and TransUnion) to provide a consumer with a free copy of the consumer’s credit report, at the consumer’s request, every 12 months. A consumer may order reports from each of the three nationwide CRAs at the same time or separately.

Equifax, Experian, and TransUnion have set up a central website, a toll-free telephone number, and a mailing address through which a consumer may obtain a free annual report. Additionally, a consumer is entitled to a free credit report if a company takes adverse action against the consumer, such as denying an application for credit, insurance, or employment, and the consumer asks for the report within 60 days of receiving notice of action. The consumer is also entitled to one free report a year, if the consumer is unemployed and plans to look for a job within 60 days; the consumer is on public assistance; or the report is inaccurate due to fraud or identity theft. Otherwise, a CRA may charge the consumer a reasonable amount for another copy of the report within a 12-month period. Kansas also has a state version of the FCRA, codified at KSA 50-701 et seq.

COVID-19. Each CRA has published resources for consumers:

• Equifax: https://www.equifax.com/personal/education/covid-19/
• Experian: https://www.experian.com/blogs/ask-experian/coronavirus/
• TransUnion: https://www.transunion.com/covid-19

Equifax Data Breach and Subsequent Action by Kansas and the Federal Government

On July 29, 2017, Equifax learned of a cybersecurity incident potentially impacting approximately 147 million U.S. consumers. According to Equifax, criminals exploited a U.S. website application vulnerability to gain access to certain files from May 13, 2017, through July 30, 2017. The information accessed primarily included names, Social Security numbers, addresses, and, in some instances, driver’s license numbers. Criminals also accessed credit card numbers for approximately 209,000 U.S. consumers and certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers. As part of Equifax’s investigation into application vulnerability, Equifax identified unauthorized access to limited personal information for certain residents of the United Kingdom and Canada.

Equifax Settlement

In July 2019, the CFPB, FTC, 48 states (including Kansas), the District of Columbia, and Puerto Rico announced a $425.0 million settlement with Equifax as the result of an investigation into the 2017 data breach. Under the settlement, all U.S. consumers may request up to 6 free copies of their Equifax credit report during any 12-month period, starting in January 2020 and extending for 7 years. These reports are in addition to the free reports consumers are entitled to under current law. For information about filing a claim, consumers should visit https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement.

Kansas Law

In 2018, the Kansas Attorney General requested introduction of a bill that would prohibit CRAs from charging consumers for placing or removing a security freeze in light of the Equifax data breach. The Kansas Legislature passed 2018 HB 2580, which amended the state’s FCRA to clarify that continuing statutes governing security freezes on consumer reports fall within the FCRA. The legislation also amended KSA 2018 Supp. 50-723 to remove a provision allowing a $5 fee to place, temporarily lift, or remove a freeze, and instead prohibited CRAs from charging a fee for these services.

Further, the bill amended KSA 2018 Supp. 50-725 governing security freezes for “protected consumers” (defined under the state’s FCRA as an individual under 16 years of age when the request for a security freeze is made or an individual for whom a guardian or conservator has been appointed) to remove a provision allowing a $10 fee to place or remove a security freeze.

Federal Law

In May 2018, President Trump signed the Economic Growth, Regulatory Relief, and Consumer Protection Act (S. 2155). The bill, among other things, amended the FCRA to require a CRA to provide consumers with free credit freezes and to notify consumers of their availability, established provisions related to placement and removal of these freezes, and created requirements related to the protection of the credit records of minors.

As of September 21, 2018, CRAs may not charge a fee for the placement or removal of a security freeze on consumer credit reports. If a consumer requests a security freeze online or by phone, the CRA must place the freeze within one business day. If the consumer requests a freeze to be lifted, the CRA must lift the freeze within one hour. If the consumer makes the request by mail, the agency must place or lift the freeze within three business days after the CRA receives the request.