There’s been a lot of discussion lately about identity theft. Maybe you’ve even heard of customers who have been affected by it. Your help can make a big difference. In fact, did you know that your business is required to provide identity theft victims with copies of records related to the theft?
Section 609(e) of the Fair Credit Reporting Act (FCRA) requires that you provide victims of identity theft (or provide law enforcement at the victim’s request) copies of records related to the theft. Upon a written request from an identity theft victim, you must provide the records within 30 days, free of charge and without a subpoena. This is sometimes referred to as the “business records turnover rule.”
Identity theft victims may need these records to document a crime or clear their name. You want to help them and know you need to follow the law. Therefore, make sure you have a policy in place for responding to victim records requests.
Based on what we’ve heard, here are a few things to keep in mind when responding to business records turnover requests:
- Take the stock. Know what types of records you have. Consider transaction-related applications, account statements, receipts, customer service notes, and records showing where the item was purchased or shipped.If you know what you have, you can better ensure that all types of identity theft-related records are provided to victims
- Think broadly. The FCRA’s business records turnover provisions apply to all different types of identity theft, including the opening of new accounts as well as purchases made under existing accounts. That’s why it’s important to regularly evaluate your policy to make sure it covers emerging new types of identity theft.
- Don’t be afraid of repetition. Under the FCRA, you must provide records even if the victim has received them before. Here’s an example: Let’s say a victim sends a records request after receiving a late notification on a bill. what should you do? Provide all records related to unauthorized charges, including copies of bills, even if the victim may have already received them. Why? Victims may not have retained copies they previously received, especially if the identity theft occurred not too long ago. Denying a victim’s request because the victim has prior access to the records is inconsistent with section 609(e).
You may wonder if you can refuse to provide records at any time in response to a 609(e) request. If you are unsure of a victim’s identity, FCRA allows you to request proof of identity, such as a copy of a government-issued ID. You may also request evidence of your identity theft claim, such as an identity theft report issued by the FTC or a police report. If the information is false, an FTC identity theft report can subject the person filing the report to criminal penalties, and the business can treat it as a police report. After receiving these documents, you may refuse to provide the records if you are unable in good faith to verify the victim’s identity or believe the records request is based on a misrepresentation.
For more information on complying with 609(e), please read Businesses must provide identity theft-related transaction records to victims and law enforcement.
