August 2006 Legal Briefs

New Law Provides for Credit Report Freezes

1. Legislative Background
2. Security Freeze Request
3. Authorizing a Temporary Release
4. Is a “Freeze” a Good Idea?
5. Assistance with Temporary Releases
6. Assistance with Security Freezes
7. Lender Exceptions to Security Freeze
8. Other Exceptions to Security Freeze
9. Excluded Entities
10. Notice of Changes
11. Security Freeze Notice Required
12. Fines & Penalties

New Law Provides for Credit Report Freezes

The “Oklahoma Consumer Report Security Freeze Act,” effective January 1, 2007, allows a consumer to freeze access to his credit report. These provisions, in Senate Bill 1748, are codified at Title 24, Oklahoma Statutes, Sections 149 through 159.  

The act has various exceptions, and should not cause many problems for banks. Even if a consumer places a “security freeze” on his credit report, an existing creditor still can obtain credit reports on an ongoing basis to review any outstanding loans.  

If a consumer with a security freeze applies for a loan, but does not take action to allow his credit report to be temporarily released, the lender can treat the application as incomplete.  (A lender is never required to make or renew a loan based on blocked credit history.)

When a security freeze is in place, there could be a delay of several days before a lender obtains a credit report in connection with a loan application.  (The credit bureau must receive a proper request from the consumer, and will have three business days to process the request.)  After a short delay, the lender should be able to process an application normally.  

(To obtain a credit report faster, a lender may want to help the consumer in obtaining a temporary release of the security freeze.  The customer must provide a PIN or password issued to him by the credit bureau at the time of the security freeze, must indicate for how long the freeze should be lifted, must pay a fee (if required in the circumstances), and must contact the credit bureau by a permitted method.  A consumer’s failure to understand and follow these steps can cause delay in approving a loan.)

The new act will force consumers to choose between “maximum protection” and “instant credit approval.”  Someone with a security freeze in place cannot go to a car dealer, obtain “on-the-spot” financing, and drive away with a new car.  (The consumer’s “frozen” credit report cannot be released that quickly.)

The act primarily benefits two categories of consumers, who are also the ones most likely to take advantage of it: (1) seniors and (2) identity theft victims.  For these two groups, a security freeze is free.  For everyone else, a security freeze is still available, but the consumer will have to pay for it.  A credit bureau can charge the average consumer (not in the first two categories) a transaction fee of up to $10, either to place a security freeze on a credit report, or to temporarily lift a security freeze (for example, to allow processing of a loan application), or to permanently remove a freeze.  

Lenders in Oklahoma will probably not have to deal with a very large number of loan applications by consumers who have a security freeze.  There are several reasons for this:

First, the average consumer will have to pay for a security freeze, but probably won’t want to pay, and so won’t obtain one.  

Second, seniors (age 65 or older) can obtain one free file freeze, and one free (temporary or permanent) release.  After that, they will have to pay the credit bureau’s regular freeze-related fees (up to $10 per transaction).  Any senior who regularly makes loan applications (for example, someone who remains active in business) will probably not request a security freeze, to avoid paying for a temporary release every time he applies for a loan.  

A large group of seniors are very conservative in financial matters, and want the “peace of mind” that a security freeze can provide; however, they almost never borrow.  They will make up only a very small percentage of a bank’s total loan applications.  

Third, legitimate identity theft victims will be highly motivated to obtain a file freeze.  They may or may not be frequent borrowers. The act allows them to obtain unlimited temporary releases of their credit report, without cost.  However, they will not make up a very large percentage of total loan customers.  

After commenting on the background of this legislation, I will review the new act’s provisions in detail.

1. Legislative Background

This year, the Legislature introduced six or seven security freeze bills, all allowing a consumer to block access to his credit report.  Some of these bills also contained provisions considerably more controversial than security freezes.

Generally, the authors of this session’s security freeze bills did not understand the impact that certain provisions could have on the financial industry and on credit bureaus.  For example, some of the bills would have allowed anyone to freeze his own credit report without cost.  

Credit bureaus would have to bear an almost punitive financial burden in providing security freezes for everyone, if they were required to do so for free.  In that situation, credit bureaus would almost certainly have to raise the cost of credit reports for all borrowers and lenders.  

It’s legitimate to ask, “What persons should obtain a file freeze without cost, and why?”  S.B. 1748 limits who can obtain a free security freeze—and when.  Its provisions are fair to consumers with a legitimate need, but it places some limits on how much the credit bureaus are required to give away in free services.  Anyone can obtain a security freeze, but some people will have to pay for it.  

From a standpoint of fees, S.B. 1748 gives a completely “free ride” only to identity theft victims.  Seniors (65 and older) will have “limited” freedom from fees.  Seniors can obtain one free security freeze, and one free release.  After that, seniors must pay the credit bureau up to $10 per transaction for any temporary release, permanent removal, or re-establishment of a security freeze.

Ordinary consumers (not in either of the two categories just mentioned) will be expected to pay for their security-freeze-related transactions; but a number of legislators do not like that outcome.  The security freeze issue will probably be addressed over and over in future legislative bills.

2. Security Freeze Request

Section 151 of Title 24 explains how to request that a security freeze be placed on a credit report. The request must come from the consumer, must be in writing, and must be sent by certified mail to the address the credit bureau designates.

A security freeze request is complete if (1) it is in writing, and sent as required in the previous paragraph, (2) it includes “proper identification” (as explained below), and (3) it includes payment of the required fee, if any.  (A fee will always apply to someone who is neither a “senior” nor an “identify theft” victim).

The act defines “proper identification” like the Fair Credit Reporting Act does, at 15 U.S.C. Section 1681h(a)(1).  As a result, a credit bureau will probably request the same identification to impose a security freeze that the credit bureau would request to give the consumer a copy of his own credit report.  

If the consumer is making a security freeze request without first contacting the credit bureau for instructions, the safest approach will probably be to furnish a photocopy of a driver’s license, as well as a Social Security number, as proper identification to accompany the written request.  If a credit bureau outlines other procedures, those certainly can be followed.

A credit bureau will be required to impose a security freeze within five business days after receiving a completed request from the consumer.  It is difficult to anticipate whether there will be a flood of people wanting to place a security freeze as soon as the law goes into effect, or whether requests will come in more slowly.  During a transition period (until May 1, 2007) a credit bureau will be allowed to take up to ten business days to put a freeze in place if “in good faith [it] is unable to process during normal business hours the quantity of security freezes being received.”  

The five-business-day (or ten-business-day) period will not start running until the credit bureau has received everything required in the statute, including proper identification and the appropriate fee (if any).  When someone wants a security freeze but does not understand what identification and fees are required, the credit bureau must explain this—but the freeze cannot become effective until after the request is complete.   

The credit bureau must send the consumer a written confirmation of the placement of a security freeze within ten business days.  The credit bureau also must provide the consumer with either a PIN or a password, to use in authorizing a temporary release of the credit report.

3.  Authorizing a Temporary Release

Section 152 of Title 24 sets out the procedure for temporarily releasing a security freeze that has been placed on a credit report.  The temporary release as contemplated by the statute is not specific to one lender.  Instead, it will be a “general release” that can be used by everyone who requests the consumer’s credit report during a temporary period that the consumer chooses.  

For example, the statute will not allow a consumer to specify that “only First National Bank can obtain a copy of my credit report.”  Rather, everyone who is a member of the credit bureau and who requests the consumer’s credit report can obtain it while a security freeze has been temporarily released.  If the consumer’s credit file is not frozen at the moment when an apparently valid request for a copy of the consumer’s credit report is received from a credit bureau member, that request will be honored.

In some ways, it’s good that any lender can obtain a copy of the consumer’s credit report during the temporary release period.  If a security freeze is in place, but the consumer wants to shop for a new car, or is looking at refinancing a mortgage, the consumer will start by requesting a temporary release for a stated time period. Then he can shop around at any number of car dealers, banks, mortgage companies, etc., for the best deal.  If he decides to submit his application to one or more lenders, any such lender will be able to obtain a copy of his credit report during the temporary release period.

Several items must be provided by the consumer in order to obtain a temporary release of a security freeze: (1) proper identification; (2) a PIN or password (issued to the consumer when the security freeze went into effect); (3) the required fee for a temporary release (if applicable); and (4) instructions as to how long the temporary release should remain effective.

In any situation where the temporary release request is not accompanied by a fee, there may be a slight delay if the credit bureau decides to verify that the consumer is entitled to a free temporary release.  For example, the credit bureau could check its files to determine that the individual is a verified “identity theft” victim, in which case the temporary release would be free; or it could determine whether a senior has previously requested a temporary release, because only the first temporary release for a senior will be free (unless that individual is also an “identity theft” victim).

Section 152(C) states that a credit bureau must honor a request from the consumer for a temporary release, within three business days after receiving the completed request (which must include proper ID, the PIN number, and the fee, if any).  

Several points should be emphasized:  (1) a temporary release requires the consumer (not the bank) to send information; (2) a temporary release probably cannot take effect immediately, even under the best of circumstances (because the credit bureau will have up to three business days to review and put it into effect); and (3) there will be a longer delay if the consumer does not supply all the required information the first time.   

It will be to a lender’s advantage to coach the consumer through the process of obtaining a temporary release, as soon as the lender becomes aware that a security freeze is in place.  If the lender does not help the lender to obtain a temporary release, it is possible that the consumer will leave something out.  Then there will be correspondence back and forth between the credit bureau and the consumer, and the temporary release may end up taking a week or ten days.

Section 152(C) authorizes (but does not require) a credit bureau to “develop procedures involving the use of telephone, facsimile, the Internet, or other electronic media to receive and process a request” for a temporary release.  Anything that could speed up the temporary release process will be welcome to consumers and lenders alike–but a truly automated release process is unlikely, for reasons that I will explain.
   
We are all familiar with the instant convenience of using a PIN in connection with an ATM/debit card transaction.  It would be wonderful if someone with a security freeze in place could go to a car dealer to buy a car, enter a PIN on a key pad, pay the required file-release fee (if any) by debit or credit card, and obtain a temporary release of a “frozen” credit report so that the dealer can instantaneously approve credit.  Something this simple will probably not exist any time soon.

Credit bureaus’ existing technology is not designed to allow electronic PIN-based remote access by consumers for the purpose of freezing and unfreezing credit files.  A PIN-based electronic access system will probably not be established until credit bureaus somehow are able to recover the cost of setting up such a system by charging adequate fees for imposing and temporarily releasing security freezes.  

The placing and temporary lifting of a security freeze on a credit report is a valuable service.  Consumers should be permitted to pay a fee that will allow them to obtain this service on a more efficient, electronic basis.  But many state legislatures see the placing and temporary lifting of a security freeze as a “right” for which a fee should not be charged.  If this view prevails, credit bureaus will have no economic incentive to invest in technology that could provide a much faster, more efficient process of placing and temporarily releasing a security freeze.     

The credit bureau system in the U.S. is a network of separate, locally-owned credit bureaus.  It’s not one big company with the same computer software used everywhere; and it’s not possible just to “flip a switch” somewhere to “upgrade” every office to a system with enhanced features.  It may be many years before all credit bureau offices will be uniformly capable of allowing electronic security freezes and releases.

The typical process of temporarily releasing a security freeze may look more like this:  Local credit bureau personnel, upon receiving a consumer’s instructions to temporarily release a file, together with the PIN (or password) as verification, plus any required payment, will access the particular consumer’s credit file on the computer, and will type in certain commands that cause the credit file no longer to be blocked to access by credit bureau members. At the end of the temporary-access period that the customer specifies, the credit bureau personnel will manually enter commands to again freeze access to the file.  This individual freezing and unfreezing of credit files is likely to be handled only as employees’ work load permits (within a deadline of three business days), and probably only during the credit bureau’s normal business hours.

4.  Is a “Freeze” a Good Idea?

It may be desirable to gain some experience with the local credit bureau’s average time for unfreezing credit reports, before advising consumers to consider placing a security freeze.  Certainly, “identity theft” victims will want and need a security freeze–no matter what.  But the average consumer (or the average senior) needs to have a full understanding of what limitations will come with a security freeze, before deciding whether it’s right for him.   

Someone who applies for credit on at least an occasional basis, and who likes to shop at sales, or who sometimes buys on the spur of the moment, may not be happy with the time it takes to get a credit report temporarily released after a security freeze is in place.  (“The TV ad says, ‘Take Advantage of the Incredible 48-Hour Sale Going on Right Now at XYZ Chevrolet,’ but I can’t get my credit report released!!”)  

A consumer who is very methodical and logical, and has patience and self-discipline, and can plan ahead, may appreciate the peace of mind that a security freeze provides, and may be very content.  Meanwhile, the consumer who is impulsive–who wants to make decisions “on the spot,” and cannot stand delays–may not like having restrictions on his credit report.  I expect that quite a few consumers who opt for a security freeze will end up permanently removing it after trying it for a while.  There might be less frustration if certain consumers would recognize in advance that a security freeze won’t suit them.    

Many consumers feel that no one should have (or need) access to their credit report without their knowledge and approval. But this is somewhat naïve—like wishing for a simpler time that no longer exists.  Every day we take for granted the convenience of transactions that are routinely processed and approved by using information from our credit reports—without a glitch, and without out knowledge.   (We “think” we would be happier if no one could access our credit report, but we might be very unhappy with that outcome.)    

It’s my understanding that the typical online debit card or credit card payment transaction (for example, to purchase airline tickets) accesses credit bureau information to verify that the online customer is the actual cardholder.  (Providers want the purchase to be as convenient as possible, but also want to protect themselves from unauthorized transactions.)  

Typically, a purchaser who enters credit/debit card information online must disclose (1) what type of card it is, (2) the card number, (3) the cardholder’s name as shown on the card, and (4) the billing statement address for the card.  Of these items, the billing statement address is the only one not imprinted on the card.  This address may not be readily available, for example, to someone who finds a lost card, or to someone (such as a dishonest employee in a restaurant) who copies the cardholder’s name and card number from a merchant charge slip.  

As I understand it, the online credit/debit card approval process electronically accesses the consumer’s credit report to verify that there is a match between the cardholder name and billing address as filled out by the consumer in the online payment information form.   If there is a match, and the customer has an available limit on his card, the transaction is approved instantaneously.  The consumer then goes about his business, with no thought as to how this approval was accomplished. If the information cannot be matched, the online payment transaction is not approved, and the consumer is unhappy.

Based on 15 U.S.C. Section 1681b(a)(3)(F)–part of the Fair Credit Reporting Act (and ignoring the effect of the new Oklahoma provisions)–a credit bureau can furnish a copy of the consumer’s credit report, or a lesser portion of that information, to anyone “in connection with a business transaction that is initiated by the consumer.”  When the consumer uses his credit/debit card for an online purchase, he is initiating a business transaction.  

An automated online payment system, by arrangement with the credit bureau, can obtain access to consumers’ credit bureau files for the very limited purpose of verifying that a credit card number exists, and that it matches both the name shown on the card and the billing address for the card, as stated by the consumer in connection with an online payment transaction.

I assume that a security freeze will make it difficult or impossible for that same consumer to use an automated online payment system to buy anything, because the address-verification information used as a method of verifying the cardholder’s identity will no longer be accessible through the credit bureau.  (Not understanding how credit report information is used to approve such transactions, most consumers would not expect this outcome.)  

Many seniors would never use a debit or credit card online (if they even have one), so telling them that online purchasing can be limited by a security freeze would be an advantage, not a hardship.  

Whether a security freeze is a good idea will depend on a particular consumer’s circumstances, transaction patterns, and credit-security needs. 

5.  Assistance with Temporary Releases 

There will be various situations where a bank is asked to help the customer in obtaining a temporary release of a credit report.  Bank employees should be ready to assist.   

Technically, it’s the consumer’s responsibility to deal with the situation, and a bank is not required to do anything—but that would be bad customer service.  If a credit bureau rightfully declines to provide a credit report because the consumer has a security freeze in place, the lender can simply treat the application as incomplete, and decline to process it further.  But a “hands-off” approach won’t get the loan made.

If a loan officer says, “We can’t process your loan application because your credit report is frozen,” the customer may become frustrated (1) with the credit bureau for not providing the credit report, and (2) with the bank for not approving the loan—even though the customer placed the security freeze, and everything else flowed from that.  

I expect that quite a few loan applicants may become very impatient when the release of a credit report is delayed by a security freeze.  Each person naturally wants things to go his way, and circumstances that block his plans are never welcome.  Although the customer may be equally unhappy with everyone (the credit bureau and the bank) who may stand between himself and his goal, it’s more difficult to “vent” to the credit bureau, which may not even be accessible on a walk-in basis.  The bank’s customer will probably expect the bank not only to listen to the problem, but also to “fix” the problem—not because it’s the bank’s fault, but because the bank is handy.  The bank has a choice either to resolve the situation to the customer’s satisfaction, or to send the customer away unhappy.

From a standpoint of good customer relations, and to expedite the processing of a loan application, the bank will be way ahead if it steps in to help the customer to obtain a temporary release whenever there is a security freeze.  This way, the customer will not stumble around, and the loan application will not be delayed unnecessarily.  

I think it would be very useful if the bank had a standard form letter for the customer to use in requesting a temporary release.  This should be already addressed to the credit bureau, with a place to fill in the consumer’s name, SSN, special PIN number or password issued by the credit bureau, the span of time for which the consumer wants a temporary release, and perhaps some check-the-box payment options, as follows:  (1) release fee of $___ enclosed; (2) identity-theft victim (exempt from release fee); or (3) age 65 or older (first-time release–exempt from release fee).

6.  Assistance with Security Freezes

In a variety of situations, customers will ask the bank for help in placing a security freeze on a credit report, or will ask for advice on whether a
security freeze is a good idea.  Customers may say to themselves, “I don’t know anyone else who works with credit reports, so I should ask the bank about this.”

Customers regularly inform their bank that debit cards, credit cards, or checks are missing or stolen.  The bank will be in a good position to help the customer evaluate whether a security freeze is justified based on the particular incident.  Circumstances may range from a purse-snatching or burglary, to fraudulent transactions on an account, to missing mail or other items that simply cannot be located.  

Not every situation will turn into an “identity theft” problem.  In some cases there is no clear indication that a “perpetrator” even exists.  If a customer simply misplaces his checkbook (not knowing if he has lost it around the house, or in a location where someone else will find it), it may be appropriate to close the bank account as a precaution, but a security freeze may be going too far.

It’s possible that a wrongdoer will obtain possession of some checks printed on what becomes a closed bank account, but this person (if he exists, and does not also have access to a Social Security number) will probably be unsuccessful in applying for credit in the victim’s name—and wouldn’t bother trying.  Until a consumer knows for sure that someone actually has his checks, there isn’t any certainty that an “identity theft” or a “wrongdoer” even exists.  

The person who has merely misplaced his checkbook probably cannot file an incident report with the police.  He is not yet an “identity theft” victim under the statute, and would not be eligible to obtain a free security freeze and free temporary releases.  The consumer will be required to pay a security freeze fee and ongoing temporary release fees under these circumstances—so the cost is a factor to consider.

The other major issue (where no known “identity theft” has yet occurred) is the potential “nuisance” and delay involved in obtaining temporary releases of the credit report, over and over, in the future (as discussed earlier).  Choosing a radical “cure” (a security freeze) may be excessive while there still is no certainty that a “perpetrator” even exists, and no actual attempt (yet) to impersonate the consumer.    

Of course, various people have a different tolerance of “risk,” and have different needs concerning future credit applications.  Some consumers would be scared by any suggestion that their credit could be attacked, and won’t mind that a security freeze makes future loan approvals lengthier.  Other consumers would look at the low risk of identity theft if no perpetrator has shown up yet, and would decide not to place a security freeze (at least for the time being) if doing so would mean giving up access to quick credit approval.  

7.  Lender Exceptions to Security Freeze

Section 155 sets out nine exceptions that allow third parties to obtain a copy of the consumer’s credit report even while a security freeze remains in place—without any temporary release by the consumer.  I will review the exceptions that are most useful to banks.

First, a lender continues to be able to obtain a consumer’s credit report for the purpose of reviewing or collecting an existing loan, if the lender (a) owns that obligation (as originator or assignee), or (b) is looking at purchasing it.  A lender’s subsidiary, affiliate, or agent (for example, a loan servicer, or a collection attorney) can obtain the consumer’s credit report as fully as the lender can, to review or collect on a loan.  

The same exception allows a bank to obtain a credit report to review or collect on any contract (including a “demand deposit account”) on which the consumer is financially obligated.  If a customer’s bank account is overdrawn or charged off, the bank can obtain a credit report to review or collect on that account.  As another example, if a bank performs an annual review of all overdraft protection accounts and obtains certain information on all accountholders from the credit bureau as part of that process—at least partly in order to determine whether an increase in the overdraft limit might be appropriate–this also is a permitted reason for obtaining information from a credit report, even while a security freeze remains in place.  

I do anticipate that a creditor will need to “jump through more hoops” to  obtain a copy of an existing customer’s credit report while a security freeze is in effect—even though the statute assures that the credit report will be available.  I expect a credit bureau may want to examine credit report requests on a more individual basis in these circumstances.

If the lender requesting a credit report is an entity already reporting credit history on the consumer, and the debt has not been paid off, it shouldn’t be hard for a credit bureau to recognize that the lender requesting the information is entitled to the consumer’s credit report.  When the party requesting a credit report is an assignee, affiliate, subsidiary or agent of the lender, this person’s name probably will not show up as a lender on the credit report.  Such a person may get more scrutiny before being allowed to obtain a copy of the consumer’s credit report.  A credit bureau may want to individually review each request of this type that comes from someone who is not the creditor.  This may cause some delay.

A second lender-related exception allows a consumer’s credit information to be used for purposes of “pre-screening”—even if a security freeze is in place.  (A credit card lender or debt consolidation lender often asks a credit bureau to provide a pre-screened list of consumers whose credit score or other characteristics will satisfy certain minimum criteria that the lender has established.  Using the lender’s guidelines, the credit bureau searches its data base, and generates a list of people (including addresses) who meet those criteria. It does not provide credit reports on these consumers.  In exchange for being allowed to obtain and use a pre-screened list of consumers, the lender must agree to make the same loan offer to everyone whose name is on the pre-screened list.

A person on a pre-screened list then gets a credit application in the mail, indicating that he has been “pre-approved.”  However, he is not finally approved until he fills out the lender’s simplified application form, and the lender obtains a credit report.  (A consumer who receives a “pre-approved” application is in a situation very similar to a consumer who receives a bulk-mailed advertisement inviting him to apply for a loan.  In both cases, unless the consumer completes the application and the consumer with a security freeze authorizes a temporary release of his credit report, the loan will not be made.  “Pre-screening” is not prohibited, even where a security freeze is in effect, because pre-screening is not really the critical step that protects a consumer from fraud.  Instead, the temporary release of the credit report (or not) is the key step, and the consumer remains in control of this.

A third exception that may be useful to banks is the subpoena exception:  In Oklahoma, an attorney, as an officer of the court, acting with respect to a pending litigation matter in state court, can issue subpoenas for information relating to another party to the suit.  The new provisions make clear that no security freeze can override or block a “court order, warrant, or subpoena.”  A credit report also apparently can be obtained for the purpose of collecting a judgment.  

(If someone is trying to commit fraud against the lender, is trying to hide assets, or has submitted a financial statement that does not match the consumer’s credit history, a security freeze won’t shield that person, at least after it turns into a lawsuit.)  

(There is also an anti-fraud provision in Section 153(A)(2), allowing a credit bureau on its own volition to remove or temporarily lift a security freeze on a credit report that has been “frozen due to a material misrepresentation of fact by the consumer.”) 

8. Other Exceptions to Security Freeze

There are several other circumstances in which a third party can obtain a copy of the consumer’s credit report even though a security freeze remains in place.  These relate to the following persons or agencies:  (1) any person using the information in connection with the underwriting of insurance; (2) a child support agency; (3) a state or its agents, investigating fraud, or investigating or collecting delinquent taxes or unpaid court orders, or filling certain of its other statutory responsibilities; (4) anyone administering a credit-file-monitoring subscription service to which the consumer has subscribed; and (5) any person obtaining a copy of the credit report for the purpose of providing it to the consumer, at the consumer’s request.

9.  Excluded Entities

The act states that three categories of entities are not required to accept “security freezes” from consumers (although to some extent they might be considered limited-purpose credit reporting agencies under federal law).  These entities are as follows:

(1) resellers of credit information (which assemble and merge information from other credit bureaus but do not maintain a permanent database of consumer information)—provided that they honor a security freeze that another credit bureau puts in place;

(2) a check services or fraud prevention services company, which issues reports on incidents of fraud or authorizations for the purpose of approving or processing checks, EFT’s or similar methods of payment (for example, a local clearinghouse that issues fraud alerts to its members; or a company like TeleChek, which operates a check-approval system for merchants); and

(3) a deposit account information service company, that issues reports to banks regarding a consumer’s account closures due to fraud, substantial overdrafts, ATM abuse, or similar negative information, for use in reviewing a consumer’s request to open a deposit account.

10.  Notice of Changes

Section 156(C) provides, while a security freeze remains in effect, that the credit bureau must send the consumer a written confirmation within thirty days after any change is posted to the consumer’s file with respect to the consumer’s  (1) name, (2) date of birth, (3) Social Security number, or (4) address.  A person committing fraud might attempt to modify these items—particularly the mailing address for billing and correspondence.  The consumer, if he perhaps already suspects some improper activity with regard his credit report, would certainly like to know that someone other than himself may be trying to change these items of information.  

However, consumers could have a legitimate need to change these items of information, even while a security freeze is in place.  For example, a woman who marries may want to change her last name.  Even more common is a change of address—but for that one, the credit bureau must send a notice of the change to both the old address and the new address, to make sure that it’s not a situation where someone else is “highjacking” the consumer’s file by changing the mailing address. 

11. Security Freeze Notice Required

In each situation where a consumer is required to receive the federal “summary of rights” with regard to credit reports in general, Section 158 mandates that the consumer will also receive a new Oklahoma notice, with the heading “Oklahoma Consumers Have the Right to Obtain a Security Freeze.”  (Section 158 sets out the required language of this notice.)

This new notice basically tells the consumer what must be provided to obtain a security freeze and what is the maximum allowable fee (if applicable) for placing and temporarily releasing the freeze.  The notice explains that existing creditors, certain government agencies, collection agencies, etc., will not be affected by the freeze.

The notice also includes a strong warning that there may be problems in obtaining approval of other transactions while a freeze is in place:  A freeze “may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, government services or payments, rental housing, employment, investment, license, cellular phone, utilities, digital signature, Internet credit card transaction, or other services, including an extension of credit at point of sale.” 

12. Fines & Penalties

Section 159(A) and (C) state that anyone who either willfully fails or negligently fails to comply with any provision of this act is liable to the consumer for (1) the consumer’s actual damages, plus (2) court costs and attorney fees.

Based on Section 159(B), if someone uses false pretenses to obtain a credit report, to place a security freeze, or to temporarily or permanently release a security freeze, or in an attempt to violate state or federal law, that person will be liable to the credit bureau for (1) actual damages sustained by the credit bureau, or (2) $1,000, whichever is greater.

Section 159(D) provides that if a pleading or motion filed in a court case is in “bad faith” or is harassment, the court shall award reasonable attorney fees to the prevailing party.   This provision should significantly cut down on “frivolous” lawsuits that otherwise might be filed against a credit bureau.