To prevent identity theft, and for other purposes.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Identity Theft Prevention Act of 
2001''.

SEC. 2. FINDINGS.

    Congress finds that--
            (1) the crime of identity theft has become one of the major 
        law enforcement challenges of the new economy, as vast 
        quantities of sensitive, personal information are now 
        vulnerable to criminal interception and misuse;
            (2) a number of indicators reveal that, despite increased 
        public awareness of the crime, the incidents of identity theft 
        continue to rise;
            (3) 1,000,000 consumers annually call the Fraud Victim 
        Assistance Department of one national consumer reporting 
        agency, a number that almost doubled from 1997 to 2001;
            (4) as of March 2001, the Federal Trade Commission Identity 
        Theft Data Clearinghouse was averaging more than 2,000 call-ins 
        a week, a four-fold increase since the Clearinghouse began 
        operation in November 1999;
            (5) allegations of identity theft reported to the fraud 
        hotline of the Social Security Administration increased from 
        11,058 in fiscal year 1998 to 46,480 in fiscal year 2000;
            (6) in its fiscal year 2000 annual report, the Postal 
        Inspection Service noted that identity theft is a growing trend 
        and the agency's investigations of such crimes has ``increased 
        by 67 percent since last year'';
            (7) an integral part of many identity crimes involves the 
        interception of personal financial data or the fraudulent 
        acquisition of credit cards and other financial products in 
        another person's name;
            (8) identity theft is an act that violates the privacy of 
        our citizens and ruins their good names, victims can suffer 
        restricted access to credit and diminished employment 
        opportunities, and may spend years repairing damage to credit 
        histories;
            (9) the resources available to identity theft victims are 
        inadequate, and both private sector and Federal agencies should 
        provide better and more sympathetic assistance to such victims; 
        and
            (10) credit reporting agencies and issuers of credit should 
        have uniform reporting requirements and effective fraud alerts 
        to assist identity theft victims in repairing and protecting 
        their credit.

SEC. 3. IDENTITY THEFT PREVENTION.

    (a) Changes of Address.--
            (1) Duty of issuers of credit.--Section 132 of the Truth in 
        Lending Act (15 U.S.C. 1642) is amended--
                    (A) by inserting ``(a) In General.--'' before ``No 
                credit''; and
                    (B) by adding at the end the following:
    ``(b) Confirmation of Changes of Address.--If a card issuer 
receives a request for an additional credit card with respect to an 
existing credit account not later than 30 days after receiving 
notification of a change of address for that account, the card issuer 
shall--
            ``(1) not later than 5 days after sending the additional 
        card to the new address, notify the cardholder of the request 
        at both the new address and the former address; and
            ``(2) provide to the cardholder a means of promptly 
        reporting incorrect changes.''.
            (2) Duty of consumer reporting agencies.--Section 605 of 
        the Fair Credit Reporting Act (15 U.S.C. 1681c) is amended by 
        adding at the end the following:
    ``(g) Notice of Potential Fraud.--In any case in which a person has 
requested a consumer report relating to a consumer, and the request 
includes an address for the consumer that differs from the most recent 
address in the file of the consumer, the consumer reporting agency 
shall notify the requester of the discrepancy.''.
            (3) Enforcement.--
                    (A) Federal trade commission.--Except as provided 
                in subparagraph (B), compliance with section 132(b) of 
                the Truth in Lending Act (as added by this subsection) 
                shall be enforced by the Federal Trade Commission in 
                the same manner and with the same power and authority 
                as the Commission has under the Fair Debt Collection 
                Practices Act to enforce compliance with that Act.
                    (B) Other agencies in certain cases.--
                            (i) In general.--Compliance with section 
                        132(b) of the Truth in Lending Act (as added by 
                        this subsection) shall be enforced under--
                                    (I) section 8 of the Federal 
                                Deposit Insurance Act, in the case of a 
                                card issuer that is--
                                            (aa) a national bank or a 
                                        Federal branch or Federal 
                                        agency of a foreign bank, by 
                                        the Office of the Comptroller 
                                        of the Currency;
                                            (bb) a member bank of the 
                                        Federal Reserve System (other 
                                        than a national bank), a branch 
                                        or agency of a foreign bank 
                                        (other than a Federal branch, 
                                        Federal agency, or insured 
                                        State branch of a foreign 
                                        bank), a commercial lending 
                                        company owned or controlled by 
                                        a foreign bank, or an 
                                        organization operating under 
                                        section 25 or 25A of the 
                                        Federal Reserve Act, by the 
                                        Board of Governors of the 
                                        Federal Reserve System;
                                            (cc) a bank insured by the 
                                        Federal Deposit Insurance 
                                        Corporation (other than a 
                                        member of the Federal Reserve 
                                        System or a national nonmember 
                                        bank) or an insured State 
                                        branch of a foreign bank, by 
                                        the Board of Directors of the 
                                        Federal Deposit Insurance 
                                        Corporation; and
                                            (dd) a savings association, 
                                        the deposits of which are 
                                        insured by the Federal Deposit 
                                        Insurance Corporation, by the 
                                        Director of the Office of 
Thrift Supervision; and
                                    (II) the Federal Credit Union Act, 
                                by the Administrator of the National 
                                Credit Union Administration in the case 
                                of a card issuer that is a Federal 
                                credit union, as defined in that Act.
                    (C) Violations treated as violations of other 
                laws.--For the purpose of the exercise by any agency 
                referred to in this paragraph of its powers under any 
                Act referred to in this paragraph, a violation of 
                section 132(b) of the Truth in Lending Act (as added by 
                this subsection) shall be deemed to be a violation of a 
                requirement imposed under that Act. In addition to its 
                powers under any provision of law specifically referred 
                to in subparagraph (A) or (B), each of the agencies 
                referred to in those subparagraphs may exercise, for 
                the purpose of enforcing compliance with section 132(b) 
                of the Truth in Lending Act (as added by this 
                subsection), any other authority conferred on such 
                agency by law.
    (b) Fraud Alerts.--Section 605 of the Fair Credit Reporting Act (15 
U.S.C. 1681c) is amended by adding at the end the following:
    ``(h) Fraud Alerts.--
            ``(1) In general.--Upon the request of a consumer and upon 
        receiving proper identification, a consumer reporting agency 
        shall include a fraud alert in the file of that consumer.
            ``(2) Notice to users.--A consumer reporting agency shall 
        notify each person procuring consumer credit information with 
        respect to a consumer of the existence of a fraud alert in the 
        file of that consumer, regardless of whether a full credit 
        report, credit score, or summary report is requested.
            ``(3) Penalties.--Any user of a consumer report that fails 
        to comply with preauthorization procedures contained in a fraud 
        alert and issues or extends credit in the name of the consumer 
        to a person other than the consumer, shall be in violation of 
        this section.
            ``(4) Definition.--In this subsection, the term `fraud 
        alert' means a clear and conspicuous statement in the file of a 
        consumer that notifies all prospective users of a consumer 
        report made with respect to that consumer that the consumer 
        does not authorize the issuance or extension of credit in the 
        name of the consumer unless--
                    ``(A) the issuer of such credit first obtains 
                verbal authorization from the consumer at a telephone 
                number designated by the consumer; or
                    ``(B) the issuer complies with such other method of 
                preauthorization by the consumer as is mutually agreed 
                upon by the consumer and the consumer reporting 
                agency.''.
    (c) Rules on Complaint Referral, Investigations, and Inquiries.--
Not later than 270 days after the date of enactment of this Act, the 
Federal Trade Commission (in this subsection referred to as the 
``Commission'') shall promulgate rules in accordance with section 553 
of title 5, United States Code--
            (1) to require each consumer reporting agency (as defined 
        in section 603 of the Fair Credit Reporting Act) to investigate 
        discrepancies between personal or identifying information 
        contained in the file maintained by the agency with respect to 
        a consumer and in the personal and identifying information 
        supplied to the agency by the user of the consumer report;
            (2) to develop procedures for referral of consumer 
        complaints about identity theft and fraud alerts between and 
        among the consumer reporting agencies and the Commission; and
            (3) to develop a model form and standard procedures to be 
        used by consumers who are victims of identity fraud for 
        contacting and informing creditors and consumer reporting 
        agencies of the fraud.

SEC. 4. TRUNCATION OF CREDIT CARD ACCOUNT NUMBERS.

    (a) In General.--Except as provided in this section, no person, 
firm, partnership, association, corporation, or limited liability 
company that accepts credit cards for the transaction of business shall 
print more than the last 5 digits of the credit card account number or 
the expiration date upon any receipt provided to the cardholder.
    (b) Limitation.--This section applies only to receipts that are 
electronically printed, and does not apply to transactions in which the 
sole means of recording the person's credit card account number is by 
handwriting or by an imprint or copy of the credit card.
    (c) Effective Date.--This section shall become effective on--
            (1) January 1, 2006, with respect to any cash register or 
        other machine or device that electronically prints receipts for 
        credit card transactions that is in use before January 1, 2003; 
        and
            (2) January 1, 2003, with respect to any cash register or 
        other machine or device that electronically prints receipts for 
        credit card transactions that is first put into use on or after 
        January 1, 2003.
    (d) Effect on State Law.--Nothing in this section prevents a State 
from imposing requirements that are the same or substantially similar 
to the requirements of this section at any time before the effective 
date of this section.

SEC. 5. FREE REPORTS ANNUALLY.

    Section 612(c) of the Fair Credit Reporting Act (15 U.S.C. 
1681j(c)) is amended to read as follows:
    ``(c) Free Annual Disclosure.--Upon the request of the consumer, a 
consumer reporting agency shall make all disclosures pursuant to 
section 609 once during any 12-month period without charge to the 
consumer.''.

Summary: Identity Theft Prevention Act of 2001 - Amends the Truth in Lending Act to prescribe procedural guidelines under which a credit card issuer shall confirm changes of address. Amends the Fair Credit Reporting Act to prescribe procedural guidelines under which a consumer reporting agency shall: (1) notify the requester of a discrepancy in the address in the consumer file. (2) include a fraud alert in the file of a requesting consumer. And (3) make free annual disclosures upon consumer request. Confers enforcement jurisdiction upon the Federal Trade Commission. Mandates truncation of credit card account numbers, so that an entity that accepts credit cards for the transaction of business is prohibited from printing more than the last 5 digits of the credit card account number or the expiration date upon any receipt provided to the cardholder.