FTC says Kohl’s doesn’t respect rights of identity theft victims

The FTC’s complaint against Kohl’s Department Stores alleges that the retailer violated the Fair Credit Reporting Act by refusing to provide identity theft victims with complete records of suspicious transactions—a right guaranteed to victimized consumers by the FCRA. The $220,000 settlement is a reminder to other companies to reconsider their approach to the legal provision.

The FTC’s charges begin with the plain language of Section 609(e) of the Fair Credit Reporting Act, but it boils down to this. Suppose a consumer discovers an unauthorized charge or credit, indicating they are a victim of identity theft. To put the puzzle pieces together, they need copies of documents from the businesses where these transactions took place. Once a consumer requests these documents, Section 609(e) gives businesses 30 days to provide the records. The law allows businesses to require proof of identity (such as a driver’s license) and proof of identity theft (such as police reports and affidavits), but the whole idea behind the rule is to avoid re-victimizing consumers by tying them in the red. tape.

Cole’s initial approach was to provide the victim with records within 30 days, with appropriate verification. But in February 2017, Kohl’s changed its policy to share information identifying identity thieves only with law enforcement or victims’ attorneys, not with victimized consumers, according to the FTC.

In August 2018, Kohl’s changed its policy again to provide customers with a Kohl’s premium account a broader list of business and transaction records, such as statements, receipts and application forms. But Cole still refused to provide them with information identifying the alleged thieves, including the address and phone number listed on the fraudulent application or the shipping address used for the fraudulent order. Cole also stopped providing the information to the victims’ attorneys. This leaves victims with only one recourse: a direct request from law enforcement.

According to the complaint, the company’s revised policy prevents consumers from obtaining the documentation they need to prove charges are not theirs. What’s more, people whose lives have been turned upside down by identity thieves now find themselves on a collision course with Kohl’s. Even though consumers complained to Kohl’s and sent the company a copy of FCRA Section 609(e) and the accompanying FTC guidance document, the complaint alleged that Kohl’s stonewalled them.

It wasn’t until April 2019 that Kohl’s finally revised its policy and provided victims with the credit applications and transaction records they requested. The complaint alleges that Kohl’s violated the FCRA by failing to provide consumers with records they were entitled to under the law. The FTC also said the company violated Section 609(e)’s 30-day requirement. In addition to a $220,000 civil penalty, the settlement requires Kohl’s to provide identity theft victims with business transaction records related to the theft within 30 days. The company must also post a notice on its website letting victims know how to obtain the records, and it must demonstrate that it has contacted victims who have been unlawfully denied access to the records in the past.

Of course, take a closer look at the FCRA when reconsidering your own company’s compliance. But also look at your procedures from the perspective of the millions of identity theft victims, including your friends, family, and employees.what do you want them How will they be treated when they take on the difficult task of restoring their reputation after identity theft? Implementing a consumer-focused approach to Section 609(e) compliance has two benefits for your business in the long run. First, it keeps you off law enforcement radar screens. Second, by treating victims of identity theft with sensitivity and respect, you may gain lifelong loyal customers.

Visit the FTC’s Credit Reporting page for compliance resources, including Businesses must provide identity theft-related transaction records to victims and law enforcement.