Consumer Reporting Issues

Category: Data Security
Author: NXTsoft

Entities that obtain or use consumer reports from consumer reporting companies (CRCs), or that furnish information relating to consumers for inclusion in consumer reports, play a vital role in the consumer reporting process. They are subject to several requirements under the Fair Credit Reporting Act (FCRA) and its implementing regulation, Regulation V. These include the requirement to furnish data subject to the relevant accuracy and dispute handling requirements.

In CFPB SUPERVISORY HIGHLIGHTS, ISSUE 24 – SUMMER 2021, the CFPB discussed where examiners found deficiencies in, among other things, Consumer Reporting compliance with FCRA accuracy requirements, and requirements regarding ID theft block requests. Examiners also found deficiencies in furnisher compliance with FCRA and Regulation V accuracy and dispute investigation requirements

CRCs were directed to revise their accuracy procedures to identify and take corrective action regarding data from furnishers whose dispute response behavior indicates the furnisher is not a source of reliable, verifiable information about consumers.

Gain an Experienced Security Team

The FCRA requires that CRCs must “block the reporting of any information in the file of a consumer that the consumer identifies as information that resulted from an alleged identity theft…” The block must be made “not later than 4 business days after the date of receipt” of a qualifying block request. In reviews of CRCs, examiners found that CRCs failed to place ID theft blocks within four business days of receipt of qualifying block requests. The block requests were delayed due to a backlog that the CRCs subsequently resolved. In response to these issues, the CRCs updated policies and procedures to ensure the timely processing and blocking of information identified in ID theft block requests.

The FCRA requires that persons who regularly, and in the ordinary course of business, furnish information to CRCs about that person’s transactions or experiences with consumers must, upon determining that information furnished to CRCs is not complete or accurate, “promptly notify the consumer reporting agency of that determination.” The furnisher must then provide to the agency any corrections to that information, or any additional information that is necessary to make the information provided by the person to the agency complete and accurate, and shall not thereafter furnish to the agency any of the information that remains not complete or accurate.”

Regulation V requires that, after receiving a direct dispute notice from a consumer, a furnisher must “[c]onduct a reasonable investigation with respect to the disputed information… Further, Regulation V provides that a “furnisher is not required to investigate a direct dispute if the furnisher has reasonably determined that the dispute is frivolous or irrelevant.” However, if a furnisher determines that a dispute is frivolous or irrelevant, the furnisher must “notify the consumer of the determination not later than five business days after making the determination, by mail or, if authorized by the consumer for that purpose, by any other means available to the furnisher.” The notice must “include the reasons for such determination and identify any information required to investigate the disputed information, which notice may consist of a standardized form describing the general nature of such information.”

After identification of these issues, furnishers updated their policies and procedures to define circumstances when disputes should reasonably be deemed frivolous because they appear to have originated from credit repair organizations; furnishers also created templates to send to consumers whose disputes they deemed frivolous. Further, furnishers provided training to agents on the new policies and procedures and the new letter templates.

Financial institutions should review these areas of concern in preparation for upcoming examiner reviews.

August 19, 2021
Back
Share this post on social media