15 U.S.C. 1681c - part 3

Part 3 will complete my explanation of 15 U.S.C. 1681c of the Fair Credit Reporting Act.

"(g) Truncation of Credit Card and Debit Card Numbers

(1) In general. Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.

(2) Limitation. This subsection shall apply only to receipts that are electronically printed, and shall not apply to transactions in which the sole means of recording a credit card or debit card account number is by handwriting or by an imprint or copy of the card."

[I find it odd that Congress decided to make this a part of the Fair Credit Reporting Act, since it has nothing to do with credit reporting. This governs what information is printed on a receipt a consumer is given when the consumer purchases something with either a credit or debit card. If the seller is providing an electronically printed receipt (as opposed to a handwritten one or the old timey imprint kind - you know where the employee takes your card and makes an imprint of the front of it on a piece of paper), the seller can only put no more than the last five digits of the credit or debit card number on the receipt and can not put the expiration date on it. This is a measure to prevent identity theft by thieves who somehow get your receipt (i.e. out of the trash or off the table at a restaurant). Other than that tenuous link to preventing identity theft, this provision really has no reason to be in the FCRA but I am glad that it is, since it is a good law and is now subject to enforcement via 1681n or 1681o.]

"(3) Effective date. This subsection shall become effective --

(A) 3 years after the date of enactment of this subsection, with respect to any cash register or other machine or device that electronically prints receipts for credit card or debit card transactions that is in use before January 1, 2005; and

(B) 1 year after the date of enactment of this subsection, with respect to any cash register or other machine or device that electronically prints receipts for credit card or debit card transactions that is first put into use on or after January 1, 2005."

[Both of these dates have now passed so, business owners that provide electronically printed receipts, make sure you comply!]

"(h) Notice of Discrepancy in Address

(1) In general. If a person has requested a consumer report relating to a consumer from a consumer reporting agency described in section 603(p) [i.e. 1681a(p)], the request includes an address for the consumer that substantially differs from the addresses in the file of the consumer, and the agency provides a consumer report in response to the request, the consumer reporting agency shall notify the requester of the existence of the discrepancy."

[This applies to the situation where a third party requests a consumer's credit report for a permissible purpose but the address provided by the third party for the consumer does not match any of the addresses appearing on the consumer's credit report. In that situation, the consumer reporting agency is required to notify the company requesting the credit report of the discrepancy in the addresses as that could mean its a potential fraud situation (i.e. where the identity thief uses an address other than the consumer's so he or she can get the fraudulent credit card when it arrives.) Lots of times identity thieves use addresses that they have access to but no other connection to, so the address used won't lead directly back to them.]

"(2) Regulations

(A) Regulations required. The Federal banking agencies, the National Credit Union Administration, and the Commission shall jointly, with respect to the entities that are subject to their respective enforcement authority under section 621, prescribe regulations providing guidance regarding reasonable policies and procedures that a user of a consumer report should employ when such user has received a notice of discrepancy under paragraph (1)."

[This section just requires the appropriate agency to provide some type of guidance to the companies that receive credit reports with a discrepancy in addresses so they will know why the discrepancy is potentially important and will know what to do in response.]

"(B) Policies and procedures to be included. The regulations prescribed under subparagraph (A) shall describe reasonable policies and procedures for use by a user of a consumer report --

(i) to form a reasonable belief that the user knows the identity of the person to whom the consumer report pertains; and

(ii) if the user establishes a continuing relationship with the consumer, and the user regularly and in the ordinary course of business furnishes information to the consumer reporting agency from which the notice of discrepancy pertaining to the consumer was obtained, to reconcile the address of the consumer with the consumer reporting agency by furnishing such address to such consumer reporting agency as part of information regularly furnished by the user for the period in which the relationship is established."

[In other words, the suggested procedures provided to the recipient of the credit report containing the address discrepancy should instruct the company to verify the identity of the consumer is what they think it is (i.e. not an identity thief) and, if it is so verified, report the new address to the consumer reporting agency if they make regular reports to the consumer reporting agency at issue.]

This concludes my explanation of 15 U.S.C. 1681c. I will start the explanation of 15 U.S.C. 1681c-1 in the near future.