FTC FACTS for Business

FOR THE CONSUMER 1-877-FTC-HELP

ftc.gov FEDERAL TRADE COMMISSION

T he Fair Credit Reporting Act (FCRA) spells out rights for victims of identity theft, as well as responsibilities for businesses. Identity theft victims are entitled 

to ask businesses for a copy of transaction records — such as applications for credit — 

relating to the theft of their identity.

Indeed, victims can authorize law enforcement officers to get the records or ask that the 

business send a copy of the records directly to a law enforcement officer. The businesses 

covered by the law must provide copies of these records, free of charge, within 30 days of 

receiving the request for them in writing. This means that the law enforcement officials who 

ask for these records in writing may get them from your business without a subpoena, as 

long as they have the victim’s authorization.

The Federal Trade Commission (FTC), the nation’s consumer protection agency, enforces 

the FCRA including this requirement, which is known as Section 609(e). Here is some 

additional information to help your business comply with this provision of the law: 

Q. Who must comply with Section 609(e) of the FCRA?

A. The law applies to a business that has provided credit, goods, or services to, accepted 

payment from, or otherwise entered into a transaction with someone who is believed to 

have fraudulently used another person’s identification. For example, if your business 

opened a cell phone account in the victim’s name or extended credit to someone 

misusing the victim’s identity, you may be required to provide the records relating to 

the transaction to the identity theft victim or the law enforcement officer acting on that 

victim’s behalf.

Q. What documents must my business provide?

A. Your business must provide applications and business transactions records, maintained 

either by your business or by another entity on your behalf, that support any transaction 

alleged to be a result of identity theft. Records like invoices, credit applications, or 

account statements may help victims document the fraudulent transaction and provide 

useful evidence about the identity thief.

Businesses Must Provide Victims and Law 

Enforcement with Transaction Records 

Relating to Identity Theft
Facts for Business

Q. What are the procedures for requesting 

these materials?

A. Requests for documents must be submitted in 

writing. Your business may specify an address 

to receive these requests. You may ask the 

victim to provide relevant information, like 

the transaction date or account number, if they 

know it. You also can require that victims 

provide:

1. proof of identity, like a government-issued ID 

card, the same type of information the identity 

thief used to open the account, or the type of 

information you are currently requesting from 

applicants; and

2. a police report and completed affidavit. 

Victims can use the FTC’s ID Theft Affidavit, 

available at ftc.gov/idtheft, or another affidavit 

you accept.

Q. Is it ever appropriate not to provide documents?

A. You can refuse to provide the records if you 

determine in good faith that:

• you cannot verify the true identity of the 

person asking for the information;

• the request for the information is based on a 

misrepresentation; or

• the information requested is Internet 

navigational data or similar information about 

a person’s visit to a website or online service.

Your business may not deny disclosure of these 

records based on the financial privacy provisions 

of the Gramm-Leach-Bliley Act (see Subtitle A 

of Title V of Public Law 106-102). Nevertheless, 

you may refuse to disclose them if state or another 

federal law prohibits you from doing so.

Q. Are there recordkeeping requirements of 

Section 609(e)?

A. Section 609(e) does not require any new 

recordkeeping procedures for your business.

FOR MORE INFORMATION

The FTC works to prevent fraudulent, deceptive, 

and unfair business practices in the marketplace 

and to provide information to help businesses 

comply with a wide variety of rules and regulations. 

To file a complaint or to get free information on 

consumer issues, visit ftc.gov or call toll-free, 

1-877-FTC-HELP (1-877-382-4357); TTY: 

1-866-653-4261. To file an identity theft complaint 

and obtain more information about how to minimize 

your risk and remedy the effects of identity theft, 

visit ftc.gov/idtheft or call the toll-free hotline at 

1-877-ID-THEFT (1-877-438-4338). The FTC 

enters Internet, telemarketing, identity theft, and 

other fraud-related complaints into Consumer 

Sentinel, a secure online database available to 

over 1400 civil and criminal law enforcement 

agencies in the U.S. and abroad.

YOUR OPPORTUNITY TO COMMENT

The National Small Business Ombudsman and 

10 Regional Fairness Boards collect comments 

from small businesses about federal compliance 

and enforcement activities. Each year, the 

Ombudsman evaluates the conduct of these activities 

and rates each agency’s responsiveness to small 

businesses. Small businesses can comment to the 

Ombudsman without fear of reprisal. To comment, 

call toll-free 1-888-REGFAIR (1-888-734-3247) 

or go to www.sba.gov/ombudsman.

May 2006

1-877-FTC-HELP FOR THE CONSUMER

FEDERAL TRADE COMMISSION ftc.gov

Federal Trade Commission

Bureau of Consumer Protection

Offi ce of Consumer and Business Education