Federal Credit Reporting Act
Red Flags Policy
The new FCRA Red Flags legislation deadline for compliance has been moved to May 1, 2009, for most areas covered by the Act. However, PSU is required to comply with portions of the Act starting in November 2008. The two areas are the rule regarding address discrepancies applicable to users of consumer reports (16 CFR 681.1) and the rule regarding changes of address applicable to card issuers (16 CFR 681.3). The purpose of the new legislation is to combat identity theft.
Following is the policy adopted by PSU to comply with the November 1 deadline.
1. Address discrepancies applicable to users of consumer reports.
PSU uses Validity Screening Solutions to perform consumer reports. The new legislation requires PSU to “develop and implement reasonable policies and procedures designed to enable the user to form a reasonable belief that a consumer report relates to the consumer about whom it has requested the report, when the user receives notice of address discrepancy.”
When PSU requests consumer reports (background checks) it does so with addresses given directly from the applicant, thus already verifying the address. However, should a background check reveal a substantial discrepancy in address, PSU shall review its own records to verify the address of the consumer and may verify the address with the consumer about whom it has requested the report.
In addition, when PSU is going to take action based on the background check, including, but not limited to, a potential disqualifying event revealed regarding an individual with the same name as the applicant but with a different address than provided, PSU must initiate the pre-adverse and adverse action process. At that point the applicant will have an opportunity to dispute any incorrect information on the report with the credit agency. If the applicant does dispute the information, Validity will verify the information or obtain corrected information if necessary. The new regulations primarily address non-employment credit check scenarios where the pre-adverse and adverse action processes are not required.
2. Changes of address applicable to card issuers.
The Regulation provides in part, “a card issuer must establish and implement reasonable policies and procedures to assess the validity of a change of address if it receives notification of a change of address for a consumer's debit or credit card account and, within a short period of time afterwards, the card issuer receives a request for an additional or replacement card for the same account. Under these circumstances, the card issuer may not issue an additional or replacement card, until, in accordance with its reasonable policies and procedures and for the purpose of assessing the validity of the change of address, the card issuer notifies the cardholder of the request.”
PSU issues Banana Bucks cards. They are also identification cards with a photograph of the card holder on the card. In order to be issued a card, the students must go to the Ticket Office with a current driver’s license, state issued photo identification card or passport. The student is required to show their identification to the office staff to verify their identity. No cards are issued through the mail. When the card holder wishes to change their address, they do so through a separate office, the registrar’s office, and it has no bearing on the issuance of the Banana Bucks card.
These regulations primarily address scenarios where an identity thief changes the card holder’s address in order to falsely receive a new card through the mail. Because PSU does not send cards through the mail, and PSU already requires photo identification, no further action is required. However, as part of a global effort on PSU’s campus to increase data security, the Ticket Office will, in addition to checking the card applicant’s photo identification, will also compare the signature of the applicant to the signature on the photo identification. Should any discrepancy arise, the Ticket Office will contact the General Counsel’s office for further investigation.
Approved by President’s Council on November 10, 2008.
[d1]Where does the “ end?