Identity Theft Prevention Act of 2000

Summary: (Sec. 3) Amends the Fair Credit Reporting Act to require a consumer reporting agency to submit notification of potential fraud to each creditor using a consumer report whenever the agency learns of a card application bearing a different address for the consumer than the one in the consumer's file.
States that compliance with this Act shall be enforced by the following agencies with respect to entities under their jurisdiction that are also issuers of credit cards: (1) the Federal Trade Commission (FTC); (2) the Office of the Comptroller of the Currency; (3) the Board of Governors of the Federal Reserve Board; (4) the Board of Directors of the Federal Deposit Insurance Corporation; (5) the Director of the Office of Thrift Supervision; and (6) the Administrator of the National Credit Union Administration.
(Sec. 4) Amends the Fair Credit Reporting Act to require a consumer reporting agency and users of consumer credit information to comply with certain fraud alert procedures. Sets forth penalties for noncompliance.
(Sec. 5) Directs the FTC to promulgate regulations to require each consumer reporting agency to investigate discrepancies between certain information contained in its files with information supplied by the user of the consumer report.
(Sec. 6) Amends the Fair Credit Reporting Act to mandate, upon request, one free annual disclosure to a consumer by a consumer reporting agency.
(Sec. 8) Requires an individual reference services provider to disclose, upon request and proper identification of the consumer, all information contained in its files pertaining to such consumer.
(Sec. 9) Amends the Social Security Act to establish a civil monetary penalty for specified identity theft violations.
(Sec. 10) Directs the FTC to develop model forms and standard procedures for consumers to inform creditors and credit reporting agencies of identity fraud.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Identity Theft Prevention Act of 
2000''.

SEC. 2. FINDINGS.

    Congress finds that--
            (1) the crime of identity theft has become one of the major 
        law enforcement challenges of the new economy, as vast 
        quantities of sensitive, personal information are now 
        vulnerable to criminal interception and misuse;
            (2) the United States Postal Inspection Service estimates 
        that 50,000 people a year have become victims of identity theft 
        since the mid-1990's;
            (3) the United States Secret Service investigated identity 
        theft losses to individuals and institutions of $745,000,000 in 
        1997, a 75 percent increase over the $442,000,000 lost in 1995;
            (4) according to TransUnion Corporation, a national credit 
        bureau, the total number of identity theft inquiries to its 
        Fraud Victim Assistance Department grew from 35,235 in 1992 to 
        522,922 in 1997;
            (5) an integral part of many identity crimes is the 
        fraudulent acquisition of the social security number of an 
        individual;
            (6) credit issuers, credit reporting agencies, and other 
        organizations with access to sensitive personal data have an 
        obligation to handle such information responsibly, and should 
        take affirmative steps to prevent identity criminals from 
        intercepting such information;
            (7) identity theft causes extraordinary damage to its 
        victims, jeopardizing their access to needed credit and forcing 
        many to spend years trying to restore their good name;
            (8) the resources available to identity theft victims are 
        inadequate, and both the private sector and Federal agencies 
        should provide better and more sympathetic assistance to such 
        victims;
            (9) credit reporting agencies and credit issuers should 
        have uniform reporting requirements and effective fraud alerts 
        to assist identity theft victims in repairing and protecting 
        their credit; and
            (10) consumers need greater access to information that is 
        collected about them so they can quickly identify fraudulent 
        activity.

SEC. 3. CHANGES OF ADDRESS.

    (a) Duty of Issuers of Credit.--Section 132 of the Truth in Lending 
Act (15 U.S.C. 1642) is amended--
            (1) by inserting ``(a) In General.--'' before ``No 
        credit''; and
            (2) by adding at the end the following:
    ``(b) Confirmation of Changes of Address.--
            ``(1) In general.--Not later than 10 days after receiving 
        notification from a cardholder of a change of address, a card 
        issuer shall send to the cardholder, both to the new address 
        and to the former address thereof, written confirmation of that 
        change of address.
            ``(2) Notification of request for additional cards.--If a 
        card issuer receives a request for an additional credit card 
        with respect to an existing credit account not later than 30 
        days after receiving notification of a change of address for 
        that account, the card issuer shall notify the cardholder of 
        the request at both the new address and the former address.''.
    (b) Duty of Consumer Reporting Agencies.--Section 605 of the Fair 
Credit Reporting Act (15 U.S.C. 1681c) is amended by adding at the end 
the following:
    ``(g) Notice of Potential Fraud.--A consumer reporting agency shall 
notify each user of a consumer report that is a creditor (as defined in 
section 103 of the Truth in Lending Act) if the agency becomes aware 
that an application to the card issuer to open a new credit card 
account bears an address for the consumer that is different from the 
address in the file of the consumer.''.
    (c) Enforcement.--
            (1) Federal trade commission.--Except as provided in 
        paragraph (2), compliance with section 132(b) of the Truth in 
        Lending Act (as added by this section) shall be enforced by the 
        Federal Trade Commission in the same manner and with the same 
        power and authority as the Commission has under the Fair Debt 
        Collection Practices Act to enforce compliance with that Act.
            (2) Other agencies in certain cases.--
                    (A) In general.--Compliance with section 132(b) of 
                the Truth in Lending Act (as added by this section) 
                shall be enforced under--
                            (i) section 8 of the Federal Deposit 
                        Insurance Act, in the case of a card issuer 
                        that is--
                                    (I) a national bank or a Federal 
                                branch or Federal agency of a foreign 
                                bank, by the Office of the Comptroller 
                                of the Currency;
                                    (II) a member bank of the Federal 
                                Reserve System (other than a national 
                                bank), a branch or agency of a foreign 
                                bank (other than a Federal branch, 
                                Federal agency, or insured State branch 
                                of a foreign bank), a commercial 
                                lending company owned or controlled by 
                                a foreign bank, or an organization 
                                operating under section 25 or 25A of 
                                the Federal Reserve Act, by the Board 
of Governors of the Federal Reserve System;
                                    (III) a bank insured by the Federal 
                                Deposit Insurance Corporation (other 
                                than a member of the Federal Reserve 
                                System or a national nonmember bank) or 
                                an insured State branch of a foreign 
                                bank, by the Board of Directors of the 
                                Federal Deposit Insurance Corporation; 
                                and
                                    (IV) a savings association, the 
                                deposits of which are insured by the 
                                Federal Deposit Insurance Corporation, 
                                by the Director of the Office of Thrift 
                                Supervision; and
                            (ii) the Federal Credit Union Act, by the 
                        Administrator of the National Credit Union 
                        Administration in the case of a card issuer 
                        that is a Federal credit union, as defined in 
                        that Act.
            (3) Violations treated as violations of other laws.--For 
        the purpose of the exercise by any agency referred to in this 
        subsection of its powers under any Act referred to in this 
        subsection, a violation of section 132(b) of the Truth in 
        Lending Act (as added by this section) shall be deemed to be a 
        violation of a requirement imposed under that Act. In addition 
        to its powers under any provision of law specifically referred 
        to in paragraph (1) or (2), each of the agencies referred to in 
        those paragraphs may exercise, for the purpose of enforcing 
        compliance with section 132(b) of the Truth in Lending Act (as 
        added by this section), any other authority conferred on such 
        agency by law.

SEC. 4. FRAUD ALERTS.

    Section 605 of the Fair Credit Reporting Act (15 U.S.C. 1681c) is 
amended by adding at the end the following:
    ``(h) Fraud Alerts.--
            ``(1) In general.--Upon the request of a consumer, a 
        consumer reporting agency shall include a fraud alert in the 
        file of that consumer.
            ``(2) Notice to users.--A consumer reporting agency shall 
        notify each person procuring consumer credit information with 
        respect to a consumer of the existence of a fraud alert in the 
        file of that consumer, regardless of whether a full credit 
        report, credit score, or summary report is requested.
            ``(3) Penalties.--Any consumer reporting agency that fails 
        to comply with this subsection, and any user of a consumer 
        report that fails to comply with preauthorization procedures 
        contained in a fraud alert and issues or extends credit in the 
        name of the consumer to a person other than the consumer, shall 
        be in violation of this section.
            ``(4) Definition.--In this subsection, the term `fraud 
        alert' means a clear and conspicuous statement in the file of a 
        consumer that notifies all prospective users of a consumer 
        report made with respect to that consumer that the consumer 
        does not authorize the issuance or extension of credit in the 
        name of the consumer unless--
                    ``(A) the issuer of such credit first obtains 
                verbal authorization from the consumer at a telephone 
                number designated by the consumer; or
                    ``(B) the issuer complies with such other method of 
                preauthorization by the consumer as is mutually agreed 
                upon by the consumer and the consumer reporting 
                agency.''.

SEC. 5. REGULATIONS ON DUTY TO INVESTIGATE.

    Not later than 6 months after the date of enactment of this Act, 
the Federal Trade Commission shall promulgate regulations to require 
each consumer reporting agency (as defined in section 603 of the Fair 
Credit Reporting Act) to investigate discrepancies between personal or 
identifying information contained in the file maintained by the agency 
with respect to a consumer and in the personal and identifying 
information supplied to the agency by the user of the consumer report.

SEC. 6. FREE REPORTS ANNUALLY.

    Section 612(c) of the Fair Credit Reporting Act (15 U.S.C. 
1681j(c)) is amended to read as follows:
    ``(c) Free Annual Disclosure.--Upon the request of the consumer, a 
consumer reporting agency shall make all disclosures pursuant to 
section 609 once during any 12-month period without charge to the 
consumer.''.

SEC. 7. IDENTIFYING INFORMATION.

    (a) Limitation.--The Fair Credit Reporting Act (15 U.S.C. 1601 et 
seq.) is amended--
            (1) by redesignating section 624 (15 U.S.C. 1681t, as so 
        designated by Public Law 104-208) as section 626 and moving 
        that section to the end of the Act;
            (2) by redesignating section 624 (15 U.S.C. 1681u, as added 
        by Public Law 104-93) as section 625; and
            (3) by inserting after section 623 the following:

``SEC. 624. OTHER IDENTIFYING INFORMATION.

    ``Except as provided in section 608, a consumer reporting agency 
may furnish consumer identifying information, other than the name, 
generational designation, and current address of the consumer, only in 
a consumer report.''.
    (b) Disclosures to Governmental Agencies.--Section 608 of the Fair 
Credit Reporting Act (15 U.S.C. 1681f) is amended by striking ``section 
604'' and inserting ``sections 604 and 623''.
    (c) Permissible Purposes.--Section 604(a) of the Fair Credit 
Reporting Act (15 U.S.C. 1681b(a)) is amended in the matter preceding 
paragraph (1) by inserting ``or any identifying information (other than 
the name, generational designation, or current address of the 
consumer)'' after ``a consumer report''.

SEC. 8. INDIVIDUAL REFERENCE SERVICES.

    (a) In General.--An individual reference services provider shall, 
upon request and proper identification of a consumer--
            (1) clearly and accurately disclose to the consumer the 
        nature, content, and substance of all information in the file 
        maintained by the provider with respect to the consumer at the 
        time of the request that is obtainable based upon the 
        identifying information supplied by the consumer when making 
        such request; and
            (2) if the consumer has made a written request, deliver a 
        written copy or photocopy of all information described in 
        paragraph (1), together with a clear, simple, and plain meaning 
        explanation of the information provided under this subsection, 
        in a readable format and type, which shall in no case be 
        smaller than 10 point type.
    (b) Individual Reference Services Provider Defined.--
            (1) In general.--In this section, the term ``individual 
        reference services provider''--
                    (A) means any person that, for monetary fees, dues, 
                or on a cooperative nonprofit basis, regularly engages 
                in the practice of creating, assembling, evaluating, or 
                providing information, either directly or as a supplier 
                to others, with respect to any person regarding any 2 
                or more items of information described in paragraph 
                (2); and
                    (B) does not include the Federal Government or any 
                State government or political subdivision thereof.
            (2) Types of information.--The items of information 
        described in this paragraph are--
                    (A) social security number or other social security 
                information;
                    (B) mother's maiden name;
                    (C) prior address;
                    (D) birth date;
                    (E) criminal history;
                    (F) history of civil actions;
                    (G) driving records;
                    (H) vehicle information;
                    (I) past employment history;
                    (J) income level;
                    (K) tax records;
                    (L) history of voter registration; and
                    (M) other similar information, as determined by the 
                Federal Trade Commission.

SEC. 9. EXTENSION OF THE CIVIL MONETARY PENALTY AUTHORITY.

    (a) In General.--Section 1129(a) of the Social Security Act (42 
U.S.C. 1320a-8(a)) is amended--
            (1) by striking ``(A)'', ``(B)'', and ``(C)'' and inserting 
        ``(i)'', ``(ii)'', and ``(iii)'', respectively;
            (2) by striking ``(a)(1)'' and inserting ``(a)(1)(A)'';
            (3) by striking ``(2)'' and inserting ``(B)''; and
            (4) by adding at the end the following new paragraph:
    ``(2) Any person (including an organization, agency, or other 
entity) who--
            ``(A) having received, while acting in the capacity as 
        representative payee pursuant to section 205(j) or section 
        1631(a)(2), a payment under title II or title XVI for the use 
        and benefit of another individual, converts such payment, or 
        any part thereof, to a use that such person knows or should 
        know is other than for the use and benefit of such other 
        individual; or
            ``(B) uses a social security account number that such 
        person knows or should know has been assigned by the 
        Commissioner of Social Security (pursuant to an exercise of 
        authority under section 205(c)(2) to establish and maintain 
        records) on the basis of false information furnished to the 
        Commissioner of Social Security by any individual; or
            ``(C) falsely represents a number to be the social security 
        account number assigned by the Commissioner of Social Security 
        to any individual, when such person knows or should know that 
        such number is not the social security account number 
assigned by the Commissioner of Social Security to such individual; or
            ``(D) knowingly alters a social security card issued by the 
        Commissioner of Social Security, or possesses such a card with 
        intent to alter it; or
            ``(E) knowingly buys or sells a card that is, or purports 
        to be, a card issued by the Commissioner of Social Security, or 
        possesses such a card with intent to buy or sell it; or
            ``(f) counterfeits a social security card, or possesses a 
        counterfeit card with intent to buy or sell it; or
            ``(G) discloses, uses, or compels the disclosure of the 
        social security account number of any person in violation of 
        the laws of the United States
shall be subject to, in addition to any other penalties that may be 
prescribed by law, a civil money penalty of not more than $5,000 for 
each such violation.''.
    (b) Conforming Amendments.--
            (1) Section 1129(b)(3)(A) of the Social Security Act (42 
        U.S.C. 1320a-8(b)(3)(A)) is amended by striking ``charging 
        fraud or false statements''.
            (2) Section 1129(c)(1) of such Act (42 U.S.C. 1320a-
        8(c)(1)) is amended by striking ``and representations'' and 
        inserting ``, representations, or actions''.
            (3) Section 1129(e)(1)(A) of such Act (42 U.S.C. 1320a-
        8(e)(1)(A)) is amended by striking ``statement or 
        representation referred to in subsection (a) was made'' and 
        inserting ``violation occurred''.
            (4) Section 1129(l) of such Act (42 U.S.C. 1320a-8(l)) is 
        amended by inserting ``assignment of a social security account 
        number or'' after ``application of an individual for''.
    (c) Effective Date.--The amendments made by this section shall be 
effective with respect to violations committed after the date of 
enactment of this Act.

SEC. 10. MODEL FORMS.

    (a) In General.--Six months after the date of enactment of this 
Act, the Federal Trade Commission shall develop a model form and 
standard procedures to be used by consumers that are victims of 
identity fraud in contacting and informing creditors and credit 
reporting agencies of such fraud, if the Commission determines, at that 
time, that issuers of credit and credit reporting agencies have failed 
to jointly develop such a model form and standard procedures.
    (b) Contents.--A model form developed under subsection (a) (by the 
Commission or the issuers and agencies referred to therein) shall 
require information necessary to demonstrate the fraudulent activity 
done in the name of the consumer to whom the form relates, including, 
if applicable--
            (1) a notarized affidavit or police report relating to the 
        activity;
            (2) a notarized handwriting sample; and
            (3) any other relevant documentation.