12/6/07

Margaret Camp Portfolio Manager/Senior Counsel, Wolters Kluwer Financial Services

Identify theft, data breaches, fraud alerts, security freezes—it’s enough to make anyone’s head spin.  But in this day and age, where identity theft is a real risk, consumers are looking for ways to protect themselves and their future, while at the same time maintaining access to credit. 

This article will focus on security freezes—an issue that has gotten recent attention due to the recent announcement by the three largest credit bureaus, Equifax, TransUnion, and Experian.  Effective November 1, 2007, the big three will offer consumers a security freeze service, for both victims of identity theft and non-victims of identity theft.  Generally, for victims of identify theft, the service is for free.  For consumers who are not victims of identity theft, a fee (generally $10.00) will be charged for the service unless state law provides otherwise.

A security freeze stops anyone from getting access to the consumer’s credit report.  In effect, it stops new credit from being taken out in the consumer’s name because the creditor will not issue credit to a consumer without being able to view the credit report.  It’s a drastic step because not only does a freeze prevent thieves from taking out credit in the consumer’s name, but it also, in effect, prevents the consumer from getting instant credit.  The freeze must be “thawed” or “lifted”  by the consumer before the creditor can gain access to the report.  And, of course, for consumers who are not victims of identity theft, there is generally a fee charged by the credit bureau to “thaw” the report.  Again, the fee is generally $10 unless state law provides otherwise.

But security freezes did not start voluntarily with the credit bureaus—it started with state legislative initiatives. To no surprise, California was the pioneering state, having enacted Senate Bill No. 168,  which allowed a consumer, beginning July 1, 2002, to request the freeze.   According to the Consumers Union Guide to Security Freeze Protection, as of October 30, 2007, thirty-nine states have adopted some form of security freeze law.  Eleven states have not adopted such a law yet.  These states are Alabama, Alaska, Arizona, Georgia, Idaho, Iowa, Michigan, Missouri, Ohio, South Carolina, and Virginia. 

While everyone can agree that thwarting identity theft is a good idea, it posses some extra hurdles for motor vehicle dealers and creditors alike.  What if a consumer fills out a credit application, the dealer runs the report, and the report is frozen?  The consumer then promises to “unthaw” the report by contacting the credit bureaus, but this never happens. What can the dealer or creditor do with the credit application?  In most states, the law allows the dealer or creditor to treat the credit application as “incomplete.”  For example, effective January 1, 2008, Arkansas HB 2215 enacts Ark. Code §4-112-105(b).  New Ark. Code §4-112-105(b) provides that if a third party requests, in connection with an application for credit, access to a consumer credit report on which a security freeze is in effect, and the consumer does not allow his or her credit report to be accessed for that specific party or period of time, the third party may treat the application as incomplete.   This type of provision is typical of the mountain of legislation that has been passed in the last three years.  Indiana SB 403 effective September 1, 2007 and Maryland HB 117 and SB 72 effective January 1, 2008 are other examples.

“Thawing” or “lifting” a freeze, according to TransUnion, generally takes about three business days. Some states dictate the maximum amount of time.  For example, Florida Statute §501.005(6) requires the credit bureau to comply with the request within three business days. A three day delay will obviously prevent buyers from closing a deal the same day at the dealership because the dealer cannot access the consumer’s credit report.   Some states however, have enacted 15 minute thawing provisions. N.J. Rev. Stat.§ 56:11-46  and Del. Code tit. 6 § 2203 are examples.  These types of provisions address these delay issues by allowing virtually instant access to credit while at the same time providing added security.

In the end, consumers need to decide what is right for them. In most cases there is a trade-off between heightened security and convenience. And, as usual, dealers and creditors need to adapt their policies and ways of doing business to this ever changing business environment. 

CompliSource offers an efficient and cost-effective method for managing state law compliance, proactively responding to legislative changes and reducing your risk of litigation.