The New FACTs of Life

  The FACT Act updates the federal credit-reporting law and places new obligations on collection agencies, credit bureaus and card issuers. But the full impact of the law won't be known until the regulators have their say.
  Sweeping, sprawling, call it what you will, the Fair and Accurate Credit Transactions Act of 2003 is one of those pieces of Congressional work in which it's quicker to list who isn't affected by it than who is.
  Signed into law last Dec. 4 by President Bush, the FACT Act amends the Fair Credit Reporting Act, the federal law governing the use of credit reports. Credit bureaus, credit card issuers-the bureaus' biggest customers-other lenders and the supporting cast of the credit industry all hail the law because it pre-empts potential state efforts to legislate in many areas pre-empted with the FCRA's 1996 overhaul but scheduled to expire at the end of 2003. There are few things credit bureaus and national lenders such as card issuers want more than to have just one set of rules to comply with rather than 50.
  Letting the FCRA's old pre-emptions expire would have been little short of a disaster for the lending industry, according to some observers. In an analysis of the FACT Act prepared for its several hundred financial-service industry clients, law firm ReedSmith LLP asserts that "the threat of state and municipal laws being adopted made passage of the amendments essential to avoid chaos in the retail credit market."
  Pre-emption came about as a result of a compromise in which consumer interests also accomplished some long-sought goals through the FACT Act, especially its provision guaranteeing that consumers can get a free credit report every year. The old FCRA allowed for free reports only in limited circumstances, most notably when a consumer was denied a loan.
  But pre-emption and free reports are only two of the many areas the FCRA amendments touch. With the goal of not only making credit reports more accurate but also limiting identity theft, the law places new data-reporting and protection obligations on credit bureaus and everyone from collection agencies to debt buyers to merchant acquirers. Retailers and acquirers that haven't already started truncating credit and debit card account numbers on receipts soon will be mandated to do so, all in the name of providing fraudsters with less ammo with which to commit ID theft.
  Some 27.3 million people have had their identities stolen, according to the Federal Trade Commission. The crime often involves stolen credit card numbers and new credit card accounts created by fraudsters in other people's names. The FTC, which enforces the FCRA, says identity theft is the nation's fastest-growing financial crime.
  The law also touches on credit card marketing in various ways. It will require more prominent display of opt-out notices on prescreened credit card solicitations, and tinkers with what's permissible in terms of data sharing between corporate affiliates.
  Despite the wide net cast by the amendments, a senior MasterCard International executive says the updated FCRA is a law the card industry can live with.
  "We're strong supporters of the FACT Act," says Joshua L. Peirez, senior vice president and assistant general counsel for Purchase, N.Y.-based MasterCard. "The legislation is a very well-balanced approach, particularly in the identity-theft area."
  A Higher Standard
  For collection agencies and other furnishers of data to the credit bureaus, the amendments mean a higher standard of reporting information about debtors' payments, loan balances and other relevant information. The old FCRA forbade a furnisher from reporting data that it "knows or consciously avoids knowing," says David Medine, a former senior FTC official, quoting the statutory language. The wording in the amended FCRA forbids a furnisher from reporting data it "knows or has reasonable cause to believe" is inaccurate.
  According to Medine, now a partner in consumer finance and privacy law practice with Wilmer, Cutler & Pickering in Washington, D.C., the old standard basically held furnishers only to a "head-in-the-sand" standard of responsibility for allowing bad data to get into credit reports. But under the FACT Act, "you can't say, 'I didn't know it for certain and therefore I can continue reporting that information.' That is a higher standard of care."
  Exactly what that revised language will mean in practical terms for lenders, collection agencies and other data furnishers to the credit bureaus awaits rule-making by the FTC and the Federal Reserve. Indeed, many provisions of the new law won't take effect until December. In the interim, the FTC, which has responsibility for the statute's provisions affecting non-bank entities such as credit bureaus and third-party collection agencies, and the Federal Reserve, the lead agency making FACT Act rules for banks, are embarking on a rule-making process that could take the rest of this year and extend into 2005, sources say.
  While data furnishers are being held to higher standards of reporting, the Edina, Minn.-based ACA International, the main trade association of third-party collections agencies, is happy that the amendments will bring clarification to one cloudy area: who should be responsible for the accuracy of the reported date of delinquency of a loan account.
  "We have a legislative victory in the FACT Act," says Rozanne Andersen, general counsel and senior vice president of legal/governmental affairs at the ACA.
  Under the old law, a collection agency could face civil fines if the date it reported to credit bureaus was wrong regarding when an account the agency had worked had become delinquent, even if the agency accurately reported the delinquency date it received from the loan originator. Andersen says she knows of at least one collection agency that fell into that nebulous trap and was fined by the FTC.
  "The reason it was ambiguous before was because the credit grantor possesses the information, but the liability for the accuracy of that fell upon the data furnisher, like a collection agency," she says. "It's the wrong party that bore all the responsibility for that function."
  The amendments clarify that the original lender is to be looked to first for accuracy about the date of delinquency, according to Andersen. In the absence of reliable information from the credit grantor, the data furnisher may use "reasonable procedures" to ascertain the date, she says.
  Having clear standards about responsibility for the correct delinquency date has benefits besides potentially making credit reports better and the collections process smoother. The new standards could enhance the sale of bad-debt portfolios by making buyers more confident about the delinquency dates of the accounts they'll be working, according to Andersen. Such portfolios "would be more valuable than one that omits or fails to include the date of delinquency," she says.
  The law, however, creates at least one possible pitfall for collection agencies in another area: pre-emption. Although credit bureaus and lenders scored a slam-dunk on that issue, there is very little in the FACT Act regarding the obligations of collections agencies in relation to identity theft, according to Joseph T. Lynyak, a partner at ReedSmith who closely followed the FACT Act's progress through Congress. States, if they perceive a consumer-protection void in that area, might try to fill it.
  "That could be an area (in which) the third-party collectors get dinged on the state side," says Lynyak.
  Collections agencies aside, the FACT Act most certainly will keep lenders and credit bureaus on their toes regarding ID theft. The law establishes national standards in which credit bureaus must flag data on credit reports reported by consumers to be the result of suspected fraud. It also creates a host of procedures on how bureaus and data furnishers should handle such alerts.
  One credit-reporting agency (CRA) that receives a fraud alert will be obligated to notify the other agencies, according to ReedSmith. The major U.S. CRAs are Atlanta-based Equifax Inc., Chicago-based TransUnion LLC, and Costa Mesa, Calif.-based Experian Inc. Observers expect the mutual notification provision to boost the use of the so-called E-OSCAR dispute-handling system run by the credit bureaus' trade group, the Washington, D.C.-based Consumer Data Industry Association. The Web-based E-OSCAR system went live in 2001 and allows data furnishers to distribute information quickly to all three CRAs.
  The circa-1992 system that E-OSCAR replaced was electronically transmitting about 50% of consumer disputes sent to CRAs, according to the CDIA. The share handled by E-OSCAR is now about 55%, a CDIA spokesperson says. A considerable amount of paper thus remains in the dispute-resolution process.
  "We need even greater cooperation" from card issuers and other lenders to use E-OSCAR, says Peg Smith, executive vice president at Experian. "We have a major campaign to get clients to convert to that system."
  CRAs must also tell the consumer of his right to receive two free credit reports during the next 12 months in order to determine whether the alleged fraud has affected his credit.
  'Repollution'
  For lenders such as card issuers, the amendments place on creditors for the first time a direct obligation to investigate and correct alleged inaccuracies on data they previously reported to CRAs, according to ReedSmith. Receipt of a credit report containing a fraud alert means that the lender is prohibited from extending new credit until the lender confirms the person requesting credit is not an imposter. And if fraud has actually occurred, the lender may not sell, transfer or collect on the debt obligation.
  "You may have to freeze accounts," says Lynyak.
  Congress's intent in controlling the flow of information when fraud is suspected is to prevent the "repollution" of credit reports consumers thought they had cleaned up only to find that fraudsters have struck anew, according to attorney Medine. "One of the challenges of identity theft is it takes so many forms," he says. "It's bad enough to be hit once, but it's common to be hit multiple times."
  CRAs, meanwhile, aren't happy about having to provide a free report once a year for any reason, but they're not making much of a fuss in light of the fact that they won on big issues such as pre-emption. Prices for credit reports vary by state but average around $9. TransUnion and Experian won't estimate how much the provision of free reports will cost them; Equifax didn't return CCM calls.
  "Giving free reports will incur a significant cost," a TransUnion spokesperson says. The spokesperson adds that in states that mandate a free report, such as Colorado, demand tended to be high in the first year the provision took effect.
  The cost issue goes beyond just the reports themselves. "It's dealing with it after the fact," Experian's Smith says, referring to the inevitable questions or disputes consumers will generate after seeing their reports, which will take resources to handle.
  Free reports, more effort to control identity theft and many other provisions are the broad strokes of the FACT Act. But it may not be for a year or more, once the regulatory agencies are done with their jobs, that issuers, bureaus, collection agencies and others in the credit industry know exactly how the law affects their businesses. With the comment periods for rules just getting underway, all sides will attempt to make their opinions count.