Consumer complaint received 2020-12-19
Company: CAPITAL ONE FINANCIAL CORPORATION
State: KS
Product: Credit card or prepaid card
Sub-product: Store credit card
Issue: Problem with a purchase shown on your statement
Sub-issue: Card was charged for something you did not purchase with the card

Complaint:
An FTC complaint against Kohls Department Stores alleges the retailer violated the Fair Credit Reporting Act by refusing to provide victims of identity theft with complete records of questionable transactions a right the FCRA guarantees to victimized consumers. The {$220000.00} settlement is a reminder to other companies to rethink their approach to that provision of the law. 

The FTCs allegations start with the plain language of Section 609 ( e ) of the Fair Credit Reporting Act, but it boils down to this. Lets say a consumer spots unauthorized charges or lines of credit that suggest theyre victims of identity theft. To put the puzzle pieces together, theyll need copies of documents from the businesses where those transactions occurred. Once a consumer asks for those documents, Section 609 ( e ) gives businesses 30 days to provide the records. The law allows businesses to require proof of identity ( like a drivers license ) and proof of the identity theft ( like a police report and affidavit ), but the whole idea behind the provision is to avoid re-victimizing consumers by tying them up in red tape. 

Kohls original practice was to provide records to victims within 30 days, subject to proper verification. But according to the FTC, in XX/XX/XXXX, Kohls changed its policy and would share information identifying the identify thief only with law enforcement or with a victims attorney not with the victimized consumer. 

In XX/XX/XXXX, Kohls changed its policy again and gave customers with a Kohls charge account a more expansive list of business and transaction records for example, statements, receipts, and applications. But Kohls still refused to give them information identifying the alleged thief ( including the address and phone number listed on a fraudulent application or the shipping address used for fraudulent orders ). Kohls also stopped providing that information to victims attorneys. That left victims with only one recourse : a direct request from a law enforcement agency. 

According to the complaint, the companys revised policies left consumers with no practical way to get the documentation they needed to establish the charges werent theirs. Whats more, people whose lives had already been turned upside down by identity thieves now found themselves at odds with Kohls. Even when consumers complained to Kohls and sent the company copies of Section 609 ( e ) of the FCRA and accompanying FTC guidance documents, the complaint alleges that Kohls stonewalled them. 

It wasnt until XX/XX/XXXX that Kohls finally re-re-revised its policy to provide victims with the credit application and transaction records they asked for. The complaint charges that Kohls violated the FCRA by failing to provide consumers with the records they had a right to under the law. The FTC also says the company violated Section 609 ( e ) s 30-day requirement. In addition to the {$220000.00} civil penalty, the settlement requires Kohls to provide identity theft victims with business transaction records related to the theft within 30 days. The company also must post a notice on its website letting victims know how to get those records and must certify that its reached out to victims who were unlawfully denied access to those records in the past. 

In reconsidering your own companys compliance, take a close look at the FCRA, of course. But also view your procedures through the eyes of the millions of Americans who have been victims of identity theft including your friends, family members, and employees. How would you want them to be treated as they undertake the all-too-arduous task of reclaiming their good name in the aftermath of identity theft? In the long run, implementing a consumer-centric approach to Section 609 ( e ) compliance has two benefits for your business. First, it can keep you off the law enforcement radar screen. Second, by treating victims of identity theft with sensitivity and respect, you just may win a loyal customer for life.

Company response to consumer: Closed with explanation