consumer reports from the major bureaus and resell them); 62 as well as cases addressing a number of other FCRA issues.63

The Commission's enforcement efforts since 1996 have focused on the new requirements added by the amendments. For example, the amendments added a requirement that the nationwide credit bureaus have "personnel accessible" at tollfree numbers printed on a consumer's credit report.64 The Commission settled cases against the three major repositories charging that they failed to have adequate personnel available to answer FCRA-mandated toll-free telephone numbers. The orders required the repositories to (1) maintain adequate personnel; (2) establish auditing requirements to ensure future compliance, and (3) pay a total $2.5 million in civil penalties.65 The Commission also has settled cases against furnishers of information to consumer reporting agencies alleging that they reported inaccurate dates for when consumers' delinquencies had begun, with the result that adverse information remained on the consumers' reports past the 7-year limit provided by the FCRA.66 Recently, the Commission settled an action against an Internet mortgage lender that failed to give adverse action notices to consumers who did not qualify for online preapproval because of information in their credit reports. 67

The Commission staff recently conducted an investigation of fifteen landlords in five cities across the United States. The staff found a high level of compliance with the adverse action requirements of the FCRA.68 To a significant degree, landlords do notify applicants when they turn them down for rentals based on information from a consumer report. The Commission will continue this type of compliance_review in other industries, and bring law enforcement actions as appropriate. The Commission will continue to use this combination of education initiatives and vigorous enforcement to foster compliance with the FCRA.

Current Issues: The FCRA and the Expanded Use of Consumer Reports

Based on the Commission's experience interpreting and enforcing the FCRA, we see several ongoing developments in the consumer reporting marketplace that may have significant impact on consumers. First, more types of businesses are using credit reports to make decisions in consumer transactions. For example, telephone service providers routinely use consumer reports to make decisions on whether to provide service and what deposit requirements (if any) to impose. Insurance companies have long considered consumer reports when underwriting homeowners and auto insurance policies. While insurers once looked primarily at consumers' claims history to determine risk of loss, it appears that they are increasingly using information from consumers' credit histories to make underwriting decisions.69

62 See I.R.S.C., 116 F.T.C. 266 (1993); CDB Infotek, 116 F.T.C. 280 (1993); Inter-Fact, Inc., 116 F.T.C. 294 (1993); W.D.I.A., 117 F.T.Č. (1994) (consents against resellers settling allegations of failure to adequately ensure that users had permissible purposes to obtain the reports). See also First American Real Estate Solutions, LLC, C-3849, January 27, 1999, 1999 FTC LEXIS 137 (consent with a reseller concerning the dispute obligations of consumer reporting agencies).

63 Howard Enterprises 93 F.T.C. 909 (1979)(bad check lists); Equifax, Inc. (formerly Retail Credit Company), 96 F.T.C. 844 (1980)(investigative consumer reports);. MIB, Inc., d/b/a Medical Information Bureau, 101 F.T.C. 415 (1983)(prohibits a nonprofit medical reporting agency from conditioning the release of information to a consumer on his/her execution of a waiver of claims against the firm; requiring timely reinvestigations of disputed information; contact, when possible, the source(s) of disputed information or other persons identified by the consumer who may possess information relevant to the challenged data and modify its files accordingly).

64 Section 609(c)(1) of the FCRA, 15 U.S.Č. § 1681g(c)(1), requires a consumer reporting agency that compiles and maintains files on consumers on a nationwide basis to establish a toll-free telephone number, at which personnel are accessible to consumers during normal business hours. This telephone number must be provided with each written disclosure of information in the consumer's file, by the consumer reporting agency to the consumer.

65 Equifax, No. 1:00-CV-0087 (N.D. Ĝa. 2000); Experian, No. 3-00CV0056–L (N.D. Tex. 2000); TransUnion, 00C 0235 (N.D. Ill. 2000).

66 DC Credit Services, Inc., No. 02-5115 (C.D. Cal. 2002)(furnishing information to a consumer reporting agency knowing or consciously avoiding knowing that the information is inaccurate, failure to notify consumer reporting agencies when previously reported information is found to be inaccurate and to provide corrections, failure to provide accurate delinquency dates, failure to report accounts as "disputed" to consumer reporting agencies; $300,000 civil penalty); Performance Capital Management, Inc., 2:01cv1047 (C.D. Cal. 2000) (providing inaccurate delinquency dates, failure to properly investigate disputes, failure to report accounts as "disputed" to consumer reporting agencies; $2 million civil penalty).

67

Quicken Loans Inc., Docket No. D-9304 (April 8, 2003); see also http://www.ftc.gov/opa/ 2002/12/quicken.htm.

68 The Commission's January 15, 2002 press release on the investigation and resulting business education brochure can be found at http://www.ftc.gov/opa/2002/01/fcraguide.htm. 69 See, e.g., Sabrina Jones and Sandra Fleishman, "One Claim Too Many? Insurance's New Policy: Use It and Lose It," The Washington Post, November 10, 2002, at H01; Dan Oldenburg,

Second, we are seeing new types of consumer credit providers and products in the marketplace. For example, the growing use of prescreened offers for marketing credit cards has led to the development of credit card banks that rely almost entirely on prescreened offers to market their cards.70 Prescreening, in combination with other direct marketing and advertising, has led to the widespread availability of credit cards with no annual fee and other attractive benefits, and has enhanced competition.71 Of course, some consumers may object to what may seem like a flood of prescreened offers in their mail boxes, or have concerns about the increased risk of identity theft that may occur in the same context. The 1996 Amendments to the FCRA allow these consumers to opt out of future offers.

Third, businesses increasingly are using consumer report data to undertake riskbased pricing of products or services.72 In many areas, the decisionmaking of creditors and other businesses has moved away from a simple approval or denial model, and toward using consumer report data in a more finely calibrated evaluation of what terms to offer.73 Consumers whose credit histories warrant more favorable treatment benefit from access to products and terms that are more tailored by risk evaluations based on their actual performance. Consumers with poorer credit histories who in the past might have been turned down, may now qualify for credit, but on less favorable terms commensurate with the risk. Consumers benefit from a more efficient and competitive consumer credit market.74

Credit report scoring products are used in a variety of other contexts, including on-going monitoring and servicing of consumer accounts that can result in adjustments in terms, such as credit limits and finance changes. Rapid access to credit scores also permits retailers and others to offer "instant credit" to consumers.

Overall, developments in the consumer credit marketplace have increased consumer choice and provided financial benefits to consumers. 75 The Commission believes that the growth of the consumer credit market has also increased public awareness and interest in credit reports and credit scores, and that the FCRA made this information more timely, accurate, and accessible. The consumer reporting system, and the obligations and protections of the FCRA, make it possible for creditors and other businesses to have access to timely, accurate consumer data.

Any reference to the consumer reporting system should also recognize the increasing problem of identity theft. The range, accuracy, and timeliness of information in consumer reporting databases make them unique resources. They are therefore simultaneously a target for identity thieves and a valuable resource for combating identity theft. Identity theft threatens the fair and efficient functioning of consumer credit markets by undermining the accuracy and credibility of the information flow that supports the markets.

As I detailed recently before the House Financial Services Committee, the Commission is working actively to combat identity theft in a number of areas. 76 As awareness of the FTC's role in identity theft has grown, businesses and organizations who have suffered compromises of personal information have begun to contact

"Car Insurers Take Credit Into Account," The Washington Post, October 15, 2002, at C10; Albert Crenshaw, "Bad Credit, Big Premiums; Insurers Using Bill-Payment History to Help Set Rates," The Washington Post, June 18, 2002, at E01.

70 See Fred H. Cate, Robert E. Litan, Michael Staten, and Peter Wallison, "Financial Privacy, Consumer Prosperity, and the Public Good: Maintaining the Balance," AEI-Brookings Joint Center for Regulatory Studies, March 2003, at 11.

71 See "An Overview of Consumer Data and Credit Reporting," Federal Reserve Bulletin, February 2003, at 72-73. See also Note 8 supra, and text accompanying.

72 Id. See also Fred H. Cate, Robert E. Litan, Michael Staten, and Peter Wallison, "Financial Privacy, Consumer Prosperity, and the Public Good: Maintaining the Balance," AEI-Brookings Joint Center for Regulatory Studies, March 2003, at 12.

73 See, e.g., "An Overview of Consumer Data and Credit Reporting," Federal Reserve Bulletin, February 2003, at 70 ("[consumer report] data and the credit-scoring models derived from them have substantially improved the overall quality of credit decisions and have reduced the costs of such decisionmaking"), citing Gates, Perry and Zorn, "Automated Underwriting in Mortgage Lending: Good News for the Underserved?" Housing Policy Debate, vol. 13, issue 2, 2002, pp. 369-91; and Barron and Staten, "The Value of Comprehensive Credit Reports: Lessons from the U.S. Experience," Credit Research Center, Georgetown University, 2002.

74 Some commentators suggest that using credit score cards built with data supplied by credit bureaus results in delinquency rates 20-30 percent lower than lending decisions based solely on judgmental evaluation of applications for credit. See Peter McCorkell, "The Impact of Credit Scoring and Automated Underwriting on Credit Availability," in Thomas A. Durkin and Michael E. Staten, eds., The Impact of Public Policy on Consumer Credit (2002).

75 See, e.g., "An Overview of Consumer Data and Credit Reporting," Federal Reserve Bulletin, February 2003, at 70; Fred H. Cate, Robert E. Litan, Michael Staten, and Peter Wallison, “Financial Privacy, Consumer Prosperity, and the Public Good: Maintaining the Balance," AEIBrookings Joint Center for Regulatory Studies, March 2003, passim.

76 See

http://financialservices.house.gov/media/pdf/040303hb.pdf.

the FTC for assistance. For example, in the cases of TriWest 77 and Ford/Experian,78 in which massive numbers of individuals' personal information was taken, the Commission provided advice on notifying those individuals and what steps they should take to protect themselves. From these experiences, the FTC developed a business record theft response kit that will be posted shortly on the identity theft website. The kit includes the steps to take in responding to an information compromise and a form letter for notifying the individuals whose information was taken. The kit provides advice on the type of law enforcement agency to contact, depending on the type of compromise, business contact information for the three major credit reporting agencies, suggestions for setting up an internal communication protocol, information about contacting the FTC for assistance, and a detailed explanation of what information individuals need to know. Organizations are encouraged to print and include copies of Identity Theft: When Bad Things Happen to Your Good Name with the letter to individuals.

Conclusion

In 1970, Congress recognized that "consumer reporting agencies have assumed a vital role in assembling and evaluating consumer credit and other information on consumers." 79 While Congress in 1970 may not have envisioned the specific ways in which consumer report information would facilitate the development of products and services that ultimately benefit the American consumer, the 33 years since passage of the Act have fully demonstrated the wisdom of Congress in enacting the FCRA.

The FCRA helps make possible the vitality of modern consumer credit markets. The consumer reporting industry, furnishers, and users can all rely on the uniform framework of the FCRA in what has become a complex, nationwide business of making consumer credit available to a diverse, mobile American public.

The 1970 Act, along with the 1996 Amendments, provide a carefully balanced framework, making possible the benefits that result from the free, fair, and accurate flow of consumer data. All of these benefits depend on the consumer reporting system functioning as intended. That is why the Federal Trade Commission continues to emphasize the importance of educating consumers and businesses, and of enforcing the law to ensure compliance by all who have a role in making the system work.

77 Adam Clymer, Officials Say Troops Risk Identity Theft After Burglary, The New York Times, Jan. 12, 2003, § 1 (Late Edition), at 12.

78 Kathy M. Kristof and John J. Goldman, 3 Charged in Identity Theft Case, The Los Angeles Times, Nov. 6, 2002, Main News, Part 1 (Home Edition), at 1.

79 Section 602(a)(3) of the FCRA.

RESPONSE TO WRITTEN QUESTIONS OF SENATOR CRAPO FROM J. HOWARD BEALES, III

Q.1. Can you please describe whether prescreening increases consumers choice and lowers the cost of credit in traditionally underserved markets, such as rural areas that may have only one or two banks with a physical presence?

A.1. Although I am aware of no hard data with respect specifically to benefits of prescreening for rural areas, there is evidence that greater competition in consumer credit (which includes the competitive benefits attributable to prescreening) has benefitted other underserved markets. For example, the percentage of minority families with bank-type credit cards has more than doubled over the past 20 years, growing from 26 percent in 1983 to more than 54 percent in 2001.1 Certainly, given the overall increases in availability of consumer credit and competitiveness in the market, it stands to reason that consumers who have more limited access to competing credit sources, whether it be in rural areas or even thinly served urban and suburban areas, would benefit from prescreened offers and other marketing innovations (such as Internet applications) that reduce the importance of convenient physical access in establishing a credit relationship.

Q.2. How fair is the current system of consumer credit reporting? Is there evidence to suggest that any demographic segments have been subject to exclusion, predation, excessive costs, or other indicators of bias as a result of the pervasive use of credit scores and automated underwriting by consumer credit lenders?

A.2. In the burgeoning of consumer credit during the mid-20th century, there was persistent evidence that judgmental credit systems—that is, processes that depended upon individuals reviewing and deciding consumer applications for credit-resulted in discrimination against protected classes.2 Credit scoring and automated underwriting work in significant ways to minimize the bias-intentional or incidental-that can be introduced into credit decisions in a judgmental system, because credit scoring models and automated underwriting systems are based on actual performance data, not assumptions about potential risk.3 There are significant market incentives to create risk models that are the most predictive possible using available performance and other data. Because these data are objective and neutral, we believe that the current scoring systems treat consumers more fairly. The significant expansion in credit availability to minorities that has been associated with the growth of credit scoring suggest scoring indeed has reduced bias. Q.3. Is there evidence that explains the major sources and causes of identity theft? Does this evidence point to the consumer credit information system? Do you have any data suggesting that prescreening is a major factor of identity theft: What about the

1 See statement by Michael A. Turner before the House Committee on Financial Services, Subcommittee on Financial Institutions and Consumer Credit, May 8, 2003, http://financial services.house.gov/media/pdf/050803mt.pdf, at 4.

2 See, e.g., U.S. General Accounting Office Report, "Fair Lending" (August 1996); United States v. Shawmut Mortgage Company, Civ. No. 3:93CV-2453 AVC (D. Ct. 1993).

3 Development of scoring models has shown, for example, that criteria often relied upon in judgmental systems-the most frequently cited example is income are not, in fact, predictive of future repayment risk.

point that FCRA and the smooth flow of information-sharing it provides, helps financial institutions prevent and combat identity theft?

A.3. From information provided by law enforcement, victim complaints, and news reports, we know a great deal about how identity theft happens and we can stay current with evolving methods. What we do not have is a statistical breakout showing which methods contribute the most to identity theft. Because consumers' information is accessible in a wide variety of situations, identity thieves can usually obtain it in a way that makes it difficult for victims to make a direct causal link. Thus, we have found that most victims do not know how their information was obtained. Law enforcement agencies, as the investigators of the crimes, are often in a better position to know how the information was stolen in particular instances.

The consumer credit information system has undoubtedly been used as a source of information for identity theft; the Ford/ Experian case appears be the prime example. But, consumers' personal information is also used in universities, the health care system, all employment situations, and in a wide variety of Government programs from the Federal to the local level, and any survey of news articles in the last year can bring up examples of theft in all of these situations. As a result, the FTC places a premium on the importance of information security so that organizations that hold consumer information take appropriate steps to prevent this information from falling into the wrong hands.5

To the extent that information does get into the wrong hands, the next opportunity to thwart identity thieves is at the point of commission of the fraud. Good authentication of credit applicants by credit issuers is the key. To that end, it is important that credit issuers know more about the real consumer than the identity thief. Information sharing is the means of providing credit issuers with this knowledge. However, this use of information only underscores again the importance of information security, to prevent identity thieves from accessing this same information in order to perfect their false identities.

We have little evidence as to any links between prescreening and identity theft. To the extent that hard data exist, they suggest identity theft growing out of prescreened offers is somewhat lower than identity theft associated with conventionally opened accounts.6

Q.4. In explaining the reasoning behind the broad preemptive language ultimately reflected in the 1996 Amendments to the FCRA, the Senate report on the matter states that "[t]his section recognizes the fact that credit reporting and credit granting are, in many respects, national in scope, and that a single set of Federal

4 Kathy M. Kristof and John J. Goldman, 3 Charged in Identity Theft Case, The Los Angeles Times, Nov. 6, 2002, Main News, Part 1 (Home Edition), at 1.

5 For example, last month the Commission's settled charges with Guess?, Inc., and Guess.com, Inc. that the companies exposed consumers' personal information, including credit card numbers, to commonly known attacks by hackers, contrary to the companies' promises. See http:/ /www.ftc.gov/os/2003/06/guessagree.htm.

6 See, e.g., statement by Michael A. Turner before the House Committee on Financial Services, Subcommittee on Financial Institutions and Consumer Credit, May 8, 2003, http://financial services.house.gov/media/pdf/050803mt.pdf, at 9-10.