BRIAN M. BOYNTON, Acting Assistant Attorney General, Civil Division

MICHAEL D. GRANSTON, Deputy Assistant Attorney General

GUSTAV W. EYLER, Director, Consumer Protection Branch 

LISA K. HSIAO, Assistant Director

ALISHA M. CROVETTO, Trial Attorney

Consumer Protection Branch

Civil Division

U.S. Department of Justice

450 5th Street, N.W.

Washington, DC 20530

Telephone: (202) 305-7196

alisha.m.crovetto@usdoj.gov

THE UNITED STATES DISTRICT COURT

DISTRICT OF UTAH

UNITED STATES OF AMERICA,

Plaintiff,

v.

VIVINT SMART HOME, INC., a corporation,

Defendant.

Case No. 2:21-cv-00267-TS

COMPLAINT FOR CIVIL 

PENALTIES, PERMANENT 

INJUNCTION AND OTHER 

RELIEF

Judge Ted Stewart

Plaintiff, the United States of America, acting upon notification and authorization to the 

Attorney General by the Federal Trade Commission (“FTC” or “Commission”), for its 

Complaint, alleges: 

1. Plaintiff brings this action under Sections 5(a), 13(b), and 16(a) of the Federal 

Trade Commission Act (“FTC Act”), 15 U.S.C. §§ 45(a), 53(b), and 56(a), and Section 621(a) of 

the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. § 1681s(a), to obtain monetary civil 

penalties and permanent injunctive or other relief for Defendant’s violations of the FTC Act, 15 

U.S.C. § 45(a); the FCRA, 15 U.S.C. §§ 1681-1681x; and the Duties Regarding the Detection, 

Case 2:21-cv-00267-TS Document 2 Filed 04/29/21 PageID.3 Page 1 of 15
2

Prevention, and Mitigation of Identity Theft (“Red Flags Rule”), 16 C.F.R. § 681.1, issued 

pursuant to Section 615(e) of the FCRA, 15 U.S.C. § 1681m(e).

JURISDICTION AND VENUE

2. This Court has subject matter jurisdiction pursuant to 28 U.S.C. §§ 1331, 1337(a), 

1345, and 1355, and 15 U.S.C. § 1681s(a).

3. Venue is proper in this District under 28 U.S.C. §§ 1391(b)(1), (b)(2), (c)(2), 

1395(a), and 15 U.S.C. § 53(b).

DEFENDANT

4. Defendant Vivint Smart Home, Inc. (“Vivint” or the “Company”), is a Delaware 

corporation with its principal place of business at 4931 North 300 West, Provo, Utah 84604. 

Vivint transacts business in this District.

COMMERCE

5. At all times relevant to this Complaint, the Defendant has maintained a substantial 

course of trade in or affecting commerce, as “commerce” is defined in Section 4 of the FTC Act, 

15 U.S.C. § 44.

DEFENDANT’S BUSINESS ACTIVITIES

6. Vivint sells smart home technology platforms, including home security devices 

and related monitoring services. The Company currently serves over 1.5 million customers in 

the United States and Canada. One of the channels through which Vivint acquires new 

customers is its door-to-door sales force, which includes young adults, often students on summer 

breaks. Vivint equips its sales representatives with iPads loaded with Vivint’s proprietary sales 

Case 2:21-cv-00267-TS Document 2 Filed 04/29/21 PageID.4 Page 2 of 15
3

system—Street Genie—which manages the new customer onboarding process, including 

customer credit verifications with Consumer Report Agencies (“CRAs”).

New Account Credit Financing

7. The typical Vivint smart home security and monitoring system costs 

approximately one thousand dollars or more, and thus most consumers finance the cost of the 

equipment with a loan. 

8. Prior to 2017, Vivint offered its customers a package that included home security 

and automation equipment and monitoring services for a combined monthly fee. Under this 

product offering, customers were required to pass a credit check and agree to subscribe to 

Vivint’s services for a minimum contractual term, which usually ranged from 36 to 60 months.

9. Since 2017, Vivint has offered its customers the option of financing home 

security equipment with Vivint internally through its own loans, called Retail Installment 

Contracts (“RICs”). These internally-financed credit arrangements have made up a substantial 

portion of Vivint’s sales from 2017 through 2019.

10. In the second quarter of 2017, Vivint began offering an additional financing 

option to its customers, called “Vivint Flex Pay,” which connects the customer with a third-party

bank for financing. If a customer declines or does not qualify for the third-party financing but 

meets Vivint’s minimum criteria, Vivint continues to offer its internal financing option through 

RICs.

11. RIC accounts made up approximately 32% of new accounts sold in 2017, 

approximately 20% of accounts sold in 2018, approximately 11% of new accounts sold in 2019, 

Case 2:21-cv-00267-TS Document 2 Filed 04/29/21 PageID.5 Page 3 of 15
4

and approximately 3% of accounts sold through the fall of 2020, in total amounting to hundreds 

of thousands of customer accounts over this time period. 

12. For either type of approach to credit financing, Vivint requires that potential 

customers satisfy a certain threshold of creditworthiness in order to qualify for the loan. In 

connection with a RIC, the determination of creditworthiness is made through an inquiry to a 

CRA by the door-to-door Vivint sales representative through Vivint’s custom software.

Misconduct by Sales Representatives

13. Vivint compensates its seasonal sales representatives entirely through 

commissions for the sales of new systems. These sales representatives are attracted to Vivint by 

the promise of a lucrative summer job. As with any commission-based occupation, this approach 

to payment incentivized the sales representatives to work hard and, occasionally, to cut corners. 

In Vivint’s case, the compensation structure combined with the lack of effective oversight also 

incentivized the representatives to violate the law.

14. As part of the customer onboarding process, the Vivint sales representative must 

request and obtain from a CRA a consumer report to evaluate the potential customer’s 

creditworthiness. The sales representative uses Vivint’s Street Genie app on the Companyissued iPad to request and obtain the consumer’s credit report from a CRA. Due to the size of 

the Vivint business and the size of its seasonal sales force—more than 4,000 in an average 

year—Vivint’s sales representatives request thousands of consumer credit reports per day during 

its peak sales season from April through October each year, and continue to request numerous 

credit reports per day the rest of the year. For example, Vivint’s sales representatives made more 

than 130,000 inquiries to a single CRA in a single month in 2016.

Case 2:21-cv-00267-TS Document 2 Filed 04/29/21 PageID.6 Page 4 of 15
5

15. If a customer meets the credit requirement, the sales representative is able to 

complete the new customer registration and earn the commission. If a customer does not qualify, 

then the sales representative cannot proceed with the new customer registration. As a result, 

certain Vivint sales representatives developed two means by which to deceive the software to 

permit them to register a new customer who did not satisfy the credit requirement—the first is 

informally known as “white paging” and the second is adding impermissible co-signers.

16. Although the specifics could vary, “white paging” worked generally as follows: 

If a potential customer did not satisfy the credit requirement, the sales representative would use 

the white pages to identify an unrelated individual with a same or similar name to the customer 

who had just failed the credit check. The sales representative would then enter that unrelated 

customer’s address as a “previous address” in the Street Genie app, and re-run the credit check, 

pulling the credit score of the similarly-named third party. The sales representative would 

thereby trick Vivint’s system into approving a new account for the unqualified customer by 

unlawfully using the credit history of the unrelated individual. Vivint would then extend credit 

to this unqualified customer, based on the third party’s credit score. 

17. Adding impermissible co-signers worked similarly, except the name unlawfully 

added to the account was not the same or similar to the primary account holder. For example, a 

Vivint sales representative might ask a consumer who had failed credit whether they knew of 

anyone else who might qualify (e.g., a relative). The rep would then obtain a credit report for 

that individual without permission, add their address into “previous address” and thereby qualify 

the primary account holder. In other instances, the representative would add a co-signer on the 

account whom the primary account holder does not know, but is a person the representative 

Case 2:21-cv-00267-TS Document 2 Filed 04/29/21 PageID.7 Page 5 of 15
6

knows can pass credit. Similarly to white paging, Vivint would then extend credit to the 

unqualified customer, based on the innocent third party’s credit score.

18. In the event that a customer registered under such false pretenses eventually 

defaulted on its Vivint account, the address of the unrelated individual with the same or similar 

name or the impermissible co-signer entered into Street Genie as a “previous address” would be 

passed on to Vivint’s debt buyer, thus implicating the innocent individual’s credit standing and 

causing them to be pursued by debt collectors. Consumers have complained to the FTC and the 

Better Business Bureau accusing Vivint of identity theft, with several consumers describing this 

exact scenario—the consumer learns from a collection agency that they have defaulted on a 

Vivint account, but they had never even heard of Vivint, much less held an account with the 

company. 

Vivint Knew About Sales Representatives’

Misconduct And Allowed It To Continue

19. Vivint has been aware of “white paging” since at least 2016, but failed to take 

meaningful steps to curb the problem. 

20. In early 2017, Vivint terminated hundreds of sales representatives for misconduct

related to white paging and impermissible co-signers. Vivint later rehired some of these same 

sales representatives. Because one of the implicated sales teams generated millions of dollars of 

revenue for Vivint, the Company allowed many of the terminated sales representatives to work at 

Vivint’s sister company for a year, and permitted some of them to return to Vivint the following 

sales season. Following the discovery of the scheme in 2016, Vivint instituted easilycircumvented controls to regulate the frequency with which the consumer reports were 

Case 2:21-cv-00267-TS Document 2 Filed 04/29/21 PageID.8 Page 6 of 15
7

requested. For example, the Company claims that its system limited running credit inquires to 

only two consumers per address. Sales representatives learned they could run multiple credit 

inquiries on a single address simply by modifying the sale location address slightly (e.g., adding 

“BLDG 1” or “Apartment A” after the street address). This function would allow a sales 

representative to continue running credit inquires on an individual until the consumer “passes” 

credit and the representative can earn a commission on the sale.

21. Since at least 2017, several Vivint employees have warned Vivint managers that 

sales representatives have continued to evade the meager prevention measures the Company 

attempted to implement. At least one company employee engaged in a back-end analysis that 

revealed issues with white-paging and impermissible co-signers. Evidence shows that the 

Company was aware of this scheme, and sometimes mildly penalized the worst offending sales 

representatives who had been involved. However, the Company allowed the practices to 

continue. 

22. Notwithstanding the risk to which these practices expose the thousands of 

consumers whose consumer reports have been obtained from CRAs on a daily basis for years, 

Vivint did not have a written Identity Theft Prevention Program (“Program”) designed to detect, 

prevent, and mitigate identity theft until January 2020, several months after the FTC began 

investigating Vivint and learning of the FTC staff’s concerns. 

23. Based on the facts and violations of law alleged in this Complaint, the FTC has 

reason to believe that Defendant is violating or are about to violate laws enforced by the 

Commission.

Case 2:21-cv-00267-TS Document 2 Filed 04/29/21 PageID.9 Page 7 of 15
8

RED FLAGS RULE VIOLATIONS

24. Section 615 of the FCRA (15 U.S.C. § 1681m(e)) requires the FTC to promulgate 

rules requiring creditors to address identity theft. The Commission subsequently promulgated

the Red Flags Rule (16 C.F.R. § 681.1), requiring that creditors offering covered accounts must

address identity theft through, among other things, the:

(d) Establishment of an Identity Theft Prevention Program –

(1) Program requirement. Each financial institution or creditor that 

offers or maintains one or more covered accounts must develop and 

implement a written Identity Theft Prevention Program (Program) that is 

designed to detect, prevent, and mitigate identity theft in connection with 

the opening of a covered account or any existing covered account. The 

Program must be appropriate to the size and complexity of the financial 

institution or creditor and the nature and scope of its activities.

(2) Elements of the Program. The Program must include reasonable 

policies and procedures to:

(i) Identify relevant Red Flags for the covered accounts that the

financial institution or creditor offers or maintains, and 

incorporate those Red Flags into its Program;

(ii) Detect Red Flags that have been incorporated into the 

Program of the financial institution or creditor;

(iii) Respond appropriately to any Red Flags that are detected 

pursuant to paragraph (d)(2)(ii) of this section to prevent and 

mitigate identity theft; and

(iv) Ensure the Program (including the Red Flags determined to 

be relevant) is updated periodically, to reflect changes in risks to 

customers and to the safety and soundness of the financial 

institution or creditor from identity theft.

16 C.F.R. § 681.1(d). In addition to these requirements, the Red Flags Rule imposes other 

requirements regarding the administration (16 C.F.R. § 681.1(e)) and content (16 C.F.R. 

§ 681.1(f)) of the Identity Theft Prevention Program.

Case 2:21-cv-00267-TS Document 2 Filed 04/29/21 PageID.10 Page 8 of 15
9

25. “Creditor” is defined in the Red Flags Rule initially by reference to Section 702 of 

the Equal Credit Opportunity Act (“ECOA”) (15 U.S.C. § 1691a(d)). The ECOA defines 

“creditor” in pertinent part as “any person who regularly extends, renews, or continues credit; 

[or] any person who regularly arranges for the extension, renewal, or continuation of credit[.]”

15 U.S.C. § 1691a(e). Vivint is a “creditor” under the ECOA because it regularly extends, 

renews, continues, or arranges for the extension of credit through both the RIC accounts and the 

Vivint Flex Pay accounts.

26. The Red Flags Rule then narrows the ECOA definition of “creditor” by specifying 

in pertinent part that it only applies to creditors that, regularly and in the ordinary course of 

business “obtain[] or use[] consumer reports, directly or indirectly, in connection with a credit 

transaction[.]” 15 U.S.C. § 1681m(e)(4). Vivint is a “creditor” under the Red Flags Rule 

because it regularly extends, obtains or uses consumer reports in connection with its RIC and 

Vivint Flex Pay credit transactions.

27. The Red Flags Rule applies to “covered accounts,” which it defines as an account 

that (1) “a creditor offers or maintains, primarily for personal, family, or household purposes, 

that involves or is designed to permit multiple payments or transactions, such as a credit card 

account, mortgage loan, automobile loan . . .cell phone account,” and (2) “any other account that 

[a creditor] offers or maintains for which there is a reasonably foreseeable risk to customers or to 

the safety and soundness of the [creditor] from identity theft, including financial, operational, 

compliance, reputational, or litigation risks.” 16 C.F.R. § 681.1(b)(3). Vivint’s RIC accounts 

are “covered accounts” under the Red Flags Rule because they are accounts that Vivint, as a 

direct creditor, offers or maintains primarily for personal, family or household purposes (i.e., 

Case 2:21-cv-00267-TS Document 2 Filed 04/29/21 PageID.11 Page 9 of 15
10

smart home monitoring system operations), and that involve multiple payments. The RIC 

accounts involve a reasonably foreseeable risk to customers or Vivint from identity theft.

28. Vivint failed to develop and implement a written Identity Theft Prevention 

Program designed to detect, prevent, and mitigate identity theft in connection with the opening of 

a covered account or any existing covered account. Vivint’s limited efforts to address identity 

theft were inadequate and, in any case, failed to satisfy the Red Flags Rule. Vivint did not 

provide for adequate training or monitoring of employees who obtain consumer reports and 

participate in extending financing agreements to customers, and did not take into account 

previous allegations of identity theft at the Company. In addition to being a clear violation of the 

language of the Red Flags Rule, Vivint’s lack of an Identity Theft Prevention Program enabled

systemic violations of the FCRA to the detriment of consumers, which would have been 

remediated had Vivint executed on the basic requirements of a Red Flags program, such as by 

examining the “methods it provides to open its covered accounts,” 16 C.F.R. Appendix 

A(II)(A)(2) to Part 681, as discussed in the next Section.

29. Section 621(a)(2)(A) of the FCRA, 15 U.S.C. § 1681s(a)(2)(A), as adjusted by 16 

C.F.R. § 1.98(m), authorizes the Court to award monetary civil penalties of not more than $4,111

for each knowing violation of the FCRA that constitutes a pattern or practice of violations of the 

statute.

30. Each instance in which Vivint has failed to comply with the Red Flags Rule’s 

establishment of an identity theft prevention program provision, 16 C.F.R. § 681.1(d), constitutes 

a separate violation of the FCRA for the purpose of assessing monetary civil penalties. 

Case 2:21-cv-00267-TS Document 2 Filed 04/29/21 PageID.12 Page 10 of 15
11

VIOLATIONS OF THE FCRA’S PERMISSIBLE PURPOSE REQUIREMENT

31. Section 621 of the FCRA, 15 U.S.C. § 1681s, authorizes the Commission to use 

all of its functions and powers under the FTC Act to enforce compliance with the FCRA by all 

persons subject thereto except to the extent that enforcement specifically is committed to some 

other governmental agency, irrespective of whether the person is engaged in commerce or meets 

any other jurisdictional tests set forth by the FTC Act.

32. The FCRA prohibits CRAs from furnishing consumer reports except for certain 

permissible purposes, Section 604(a), 15 U.S.C. § 1681b(a), and prohibits persons from 

obtaining consumer reports for any reason other than those permissible purposes, Section 604(f), 

15 U.S.C. § 1681b(f). Additionally, a user must certify truthfully that it is obtaining the 

consumer report for a permissible purpose. Section 604(f)(2), 15 U.S.C. § 1681b(f)(2).

33. The FCRA restricts requests for consumer reports to the permissible purposes 

enumerated in Section 604(a), 15 U.S.C. § 1681b(a). Pursuant to the limitation in Section 604(f) 

of the FCRA, 15 U.S.C. § 1681b(f): “A person shall not use or obtain a consumer report for any 

purpose unless . . . the consumer report is obtained for a purpose for which the consumer report 

is authorized to be furnished under this section.”

34. Vivint violated this restriction on the use or obtainment of consumer reports each 

time Vivint’s sales representatives successfully sought and obtained the consumer report of a 

third party in order to circumvent the credit score limitations of its customer acquisition 

software. Circumventing credit score limitations on software is not a permissible purpose under 

the FCRA.

Case 2:21-cv-00267-TS Document 2 Filed 04/29/21 PageID.13 Page 11 of 15
12

35. Each instance in which Vivint failed to comply with the FCRA’s Permissible 

Purpose Requirement, Section 604(f) of the FCRA, 15 U.S.C. § 1681b(f), also constitutes a 

separate violation of the FCRA for the purpose of assessing monetary civil penalties under 

Section 621(a)(2)(A) of the FCRA, 15 U.S.C. § 1681s(a)(2)(A). 

Count I

No Established Identity Theft Prevention Program 

36. Paragraphs 1-35 are incorporated as if set forth herein.

37. Through the acts and practices described in paragraphs 28-30, Vivint has failed to

develop and implement a written Identity Theft Prevention Program that is designed to detect, 

prevent, and mitigate identity theft in connection with the opening of a covered account or any 

existing covered account.

38. Vivint thereby has violated the Red Flags Rule establishment of an Identity Theft 

Prevention Program provisions, 16 C.F.R. § 681.1(d).

39. Pursuant to Section 621(a)(1) of the FCRA, 15 U.S.C. § 1681s(a)(1), Vivint’s 

violations of the Red Flags Rule constitute unfair or deceptive acts or practices in violation of 

Section 5(a) of the FTC Act, 15 U.S.C. § 45(a).

40. The acts and practices described in paragraphs 28-30 constitute a pattern or 

practice of knowing violations, as set forth in Section 621(a)(2)(A) of the FCRA, 15 U.S.C. § 

1681s(a)(2)(A).

Count II

Obtaining Credit Reports Without a Permissible Purpose

41. Paragraphs 1-40 are incorporated as if set forth herein.

Case 2:21-cv-00267-TS Document 2 Filed 04/29/21 PageID.14 Page 12 of 15
13

42. Through the acts and practices described in paragraphs 13-23 and 34-35, the 

Defendant permitted Vivint’s sales representatives to obtain consumer reports for individuals 

without permission in order to qualify a potential customer for a Vivint account. 

43. Defendant thereby violated the permissible purpose requirement of the FCRA, 15 

U.S.C. § 1681b(f).

44. Pursuant to Section 621(a)(1) of the FCRA, 15 U.S.C. § 1681s(a)(1), the 

Defendant’s violations of the FCRA constitute unfair or deceptive acts or practices in violation 

of Section 5(a) of the FTC Act, 15 U.S.C. § 45(a).

45. The acts and practices described in paragraphs 13-23 and 34-35 constitute a 

pattern or practice of knowing violations, as set forth in Section 621(a)(2)(A) of the FCRA, 15 

U.S.C. § 1681s(a)(2)(A).

Count III

Unfair Sale of False Debt to Debt Buyers or Collectors

46. Paragraphs 1-45 are incorporated as if set forth herein.

47. In numerous instances, Defendant transmitted to third-party debt buyers the 

names and addresses of individuals that were produced through the “white paging” and 

impermissible co-signer schemes identified above, at paragraphs 13-18, causing them to be 

pursued by debt buyers or collectors.

48. Defendant’s actions cause or are likely to cause substantial injury to consumers 

that consumers cannot reasonably avoid themselves and that is not outweighed by countervailing 

benefits to consumers or competition.

Case 2:21-cv-00267-TS Document 2 Filed 04/29/21 PageID.15 Page 13 of 15
14

49. Therefore, Defendant’s acts or practices as set forth in paragraphs 13-18

constitute unfair acts or practices in violation of Section 5 of the FTC Act, 15 U.S.C. § 45(a), (n).

CONSUMER INJURY

50. Consumers are suffering, have suffered, and will continue to suffer substantial 

injury as a result of Defendant’s violations of the FTC Act, the FCRA, and the Red Flags Rule.

PRAYER FOR RELIEF

WHEREFORE, Plaintiff, pursuant to 15 U.S.C. § § 45(a), 53(b), and 1681s, and the 

Court’s own equitable powers, requests that the Court:

A. Enter judgment against Defendant and in favor of Plaintiff for each violation 

alleged in this Complaint;

B. Enter a permanent injunction to prevent future violations of the FTC Act, the 

FCRA, and the Red Flags Rule by the Defendant;

C. Award such relief as the Court finds necessary to address Defendant’s violations 

of the FTC Act, the FCRA, and the Red Flags Rule, including rescission or reformation of 

contracts, restitution, the refund of monies paid, the disgorgement of ill-gotten gains, or other 

relief necessary to redress injury to consumers resulting from Defendant’s violations;

D. Award Plaintiff monetary civil penalties from Defendant for each violation of the 

FCRA and the Red Flags Rule alleged in this Complaint; and 

E. Award Plaintiff the costs of bringing this action, as well as such other additional 

relief as the Court may determine to be just and proper.

Case 2:21-cv-00267-TS Document 2 Filed 04/29/21 PageID.16 Page 14 of 15
15

DATED: April 29, 2021

Of Counsel

GORANA NESKOVIC (D.C. Bar 

997322)

KEVIN MORIARTY (D.C. Bar 975904)

Attorneys

Federal Trade Commission

Division of Privacy and Identity 

Protection

Federal Trade Commission

600 Pennsylvania Ave, NW

Washington, DC 20580

Mail Stop CC-8232

(202) 326-2322(Neskovic)

(202) 326-2949 (Moriarty)

(202) 326-3392 (Fax)

FOR THE UNITED STATES OF 

AMERICA:

BRIAN M. BOYNTON

Acting Assistant Attorney General

Civil Division

MICHAEL D. GRANSTON

Deputy Assistant Attorney General

GUSTAV W. EYLER 

Director

Consumer Protection Branch

LISA K. HSIAO

Assistant Director

/s/Alisha M. Crovetto

ALISHA M. CROVETTO

Trial Attorney

Consumer Protection Branch

Civil Division

U.S. Department of Justice

450 5th Street, N.W.

Washington, DC 20530

(202) 305-7196

alisha.m.crovetto@usdoj.gov

Case 2:21-cv-00267-TS Document 2 Filed 04/29/21 PageID.17 Page 15 of 15