II 

108TH CONGRESS 

1ST SESSION S. 223

To prevent identity theft, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JANUARY 28, 2003

Mrs. FEINSTEIN (for herself, Mr. GRASSLEY, Mr. CORZINE, and Mr. GREGG) 

introduced the following bill; which was read twice and referred to the 

Committee on Banking, Housing, and Urban Affairs 

A BILL

To prevent identity theft, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Identity Theft Preven5 tion Act’’. 

6 SEC. 2. FINDINGS. 

7 Congress finds that—

8 (1) the crime of identity theft has become one 

9 of the major law enforcement challenges of the new 

10 economy, as vast quantities of sensitive, personal in-
2

•S 223 IS 

1 formation are now vulnerable to criminal intercep2 tion and misuse; 

3 (2) in November 2002, Americans were alerted 

4 to the dangers of identity theft when Federal pros5 ecutors announced that 3 individuals had allegedly 

6 sold the credit and personal information of 30,000 

7 people, the largest single identity theft case in 

8 United States history; 

9 (3) hundreds of thousands of Americans are 

10 victims of identity theft each year, resulting in an 

11 annual cost to industry of more than 

12 $3,500,000,000. 

13 (4) several indicators reveal that despite in14 creased public awareness of the crime, the number 

15 of incidents of identity theft continues to rise; 

16 (5) in December 2001, the Federal Trade Com17 mission received an average of more than 3,000 

18 identity theft calls per week, a 700 percent increase 

19 since the Identity Theft Data Clearinghouse began 

20 operation in November 1999; 

21 (6) allegations of social security number fraud 

22 increased by 500 percent between 1998 and 2001, 

23 from 11,000 to 65,000; 
3

•S 223 IS 

1 (7) a national credit reporting agency reported 

2 that consumer requests for fraud alerts increased by 

3 53 percent during fiscal year 2001; 

4 (8) identity theft violates the privacy of Amer5 ican citizens and ruins their good names; 

6 (9) victims of identity theft may suffer re7 stricted access to credit and diminished employment 

8 opportunities, and may spend years repairing the 

9 damage to credit histories caused by identity theft; 

10 (10) businesses and government agencies that 

11 handle sensitive personal information of consumers 

12 have a responsibility to protect this information from 

13 identity thieves; and 

14 (11) the private sector can better protect con15 sumers by implementing effective fraud alerts, af16 fording greater consumer access to credit reports, 

17 truncating of credit card numbers, and establishing 

18 other prevention measures. 

19 SEC. 3. IDENTITY THEFT PREVENTION. 

20 (a) CHANGES OF ADDRESS.—

21 (1) DUTY OF ISSUERS OF CREDIT.—Section 

22 132 of the Truth in Lending Act (15 U.S.C. 1642) 

23 is amended—

24 (A) by inserting ‘‘(a) IN GENERAL.—’’ be25 fore ‘‘No credit’’; and 
4

•S 223 IS 

1 (B) by adding at the end the following: 

2 ‘‘(b) CONFIRMATION OF CHANGES OF ADDRESS.—If 

3 a card issuer receives a request for an additional credit 

4 card with respect to an existing credit account not later 

5 than 30 days after receiving notification of a change of 

6 address for that account, the card issuer shall—

7 ‘‘(1) not later than 5 days after sending the ad8 ditional card to the new address, notify the card9 holder of the request at both the new address and 

10 the former address; and 

11 ‘‘(2) provide to the cardholder a means of 

12 promptly reporting incorrect changes.’’. 

13 (2) ENFORCEMENT.—

14 (A) FEDERAL TRADE COMMISSION.—Ex15 cept as provided in subparagraph (B), compli16 ance with section 132(b) of the Truth in Lend17 ing Act (as added by this subsection) shall be 

18 enforced by the Federal Trade Commission in 

19 the same manner and with the same power and 

20 authority as the Commission has under the 

21 Fair Debt Collection Practices Act to enforce 

22 compliance with that Act. 

23 (B) OTHER AGENCIES IN CERTAIN

24 CASES.—
5

•S 223 IS 

1 (i) IN GENERAL.—Compliance with 

2 section 132(b) of the Truth in Lending Act 

3 shall be enforced under—

4 (I) section 8 of the Federal De5 posit Insurance Act, in the case of a 

6 card issuer that is—

7 (aa) a national bank or a 

8 Federal branch or Federal agen9 cy of a foreign bank, by the Of10 fice of the Comptroller of the 

11 Currency; 

12 (bb) a member bank of the 

13 Federal Reserve System (other 

14 than a national bank), a branch 

15 or agency of a foreign bank 

16 (other than a Federal branch, 

17 Federal agency, or insured State 

18 branch of a foreign bank), a com19 mercial lending company owned 

20 or controlled by a foreign bank, 

21 or an organization operating 

22 under section 25 or 25A of the 

23 Federal Reserve Act, by the 

24 Board of Governors of the Fed25 eral Reserve System; 
6

•S 223 IS 

1 (cc) a bank insured by the 

2 Federal Deposit Insurance Cor3 poration (other than a member of 

4 the Federal Reserve System or a 

5 national nonmember bank) or an 

6 insured State branch of a foreign 

7 bank, by the Board of Directors 

8 of the Federal Deposit Insurance 

9 Corporation; and 

10 (dd) a savings association, 

11 the deposits of which are insured 

12 by the Federal Deposit Insurance 

13 Corporation, by the Director of 

14 the Office of Thrift Supervision; 

15 and 

16 (II) the Federal Credit Union 

17 Act, by the Administrator of the Na18 tional Credit Union Administration in 

19 the case of a card issuer that is a 

20 Federal credit union, as defined in 

21 that Act. 

22 (C) VIOLATIONS TREATED AS VIOLATIONS

23 OF OTHER LAWS.—

24 (i) IN GENERAL.—For the purpose of 

25 the exercise by any agency referred to in
7

•S 223 IS 

1 this paragraph of its powers under any Act 

2 referred to in this paragraph, a violation 

3 of section 132(b) of the Truth in Lending 

4 Act (as added by this subsection) shall be 

5 deemed to be a violation of a requirement 

6 imposed under that Act. 

7 (ii) AGENCY AUTHORITY.—In addition 

8 to its powers under any provision of law 

9 specifically referred to in subparagraph (A) 

10 or (B), each of the agencies referred to in 

11 those subparagraphs may exercise, for the 

12 purpose of enforcing compliance with sec13 tion 132(b) of the Truth in Lending Act, 

14 any other authority conferred on such 

15 agency by law. 

16 (b) FRAUD ALERTS.—Section 605 of the Fair Credit 

17 Reporting Act (15 U.S.C. 1681c) is amended by adding 

18 at the end the following: 

19 ‘‘(g) FRAUD ALERTS.—

20 ‘‘(1) DEFINED TERM.—In this subsection, the 

21 term ‘fraud alert’ means a statement in the file of 

22 a consumer that notifies all prospective users of a 

23 consumer report made with respect to that consumer 

24 that—
8

•S 223 IS 

1 ‘‘(A) the consumer’s identity may have 

2 been used, without the consumer’s consent, to 

3 fraudulently obtain goods or services in the con4 sumer’s name; and 

5 ‘‘(B) the consumer does not authorize the 

6 issuance or extension of credit in the name of 

7 the consumer unless the issuer of such credit— 

8 ‘‘(i) obtains express preauthorization 

9 from the consumer at a telephone number 

10 designated by the consumer; or 

11 ‘‘(ii) utilizes another reasonable means 

12 of communications to obtain the express 

13 preauthorization of the consumer. 

14 ‘‘(2) INCLUSION OF FRAUD ALERT IN CON15 SUMER FILE.—Upon the request of a consumer and 

16 upon receiving proper identification, a consumer re17 porting agency shall include a fraud alert in the file 

18 of that consumer. 

19 ‘‘(3) NOTICE SENT BY CONSUMER REPORTING

20 AGENCIES.—A consumer reporting agency shall no21 tify each person procuring consumer credit informa22 tion with respect to a consumer of the existence of 

23 a fraud alert in the file of that consumer, regardless 

24 of whether a full credit report, credit score, or sum25 mary report is requested. 
9

•S 223 IS 

1 ‘‘(4) PROCEDURES TO RECEIVE FRAUD

2 ALERTS.—Any person who uses a consumer credit 

3 report in connection with a credit transaction shall 

4 establish reasonable procedures to receive fraud 

5 alerts transmitted by consumer reporting agencies. 

6 ‘‘(5) VIOLATIONS.—

7 ‘‘(A) CONSUMER REPORTING AGENCY.—

8 Any consumer reporting agency that fails to no9 tify any user of a consumer credit report of the 

10 existence of a fraud alert in that report shall be 

11 in violation of this section. 

12 ‘‘(B) USER OF A CONSUMER REPORT.—

13 Any user of a consumer report that fails to 

14 comply with preauthorization procedures con15 tained in a fraud alert and issues or extends 

16 credit in the name of the consumer to a person 

17 other than the consumer shall be in violation of 

18 this section. 

19 ‘‘(6) EXCEPTIONS.—

20 ‘‘(A) RESELLERS.—

21 ‘‘(i) IN GENERAL.—The provisions of 

22 this subsection do not apply to a consumer 

23 reporting agency that acts as a reseller of 

24 information by assembling and merging in25 formation contained in the database of an-
10

•S 223 IS 

1 other consumer reporting agency or mul2 tiple consumer reporting agencies, and 

3 does not maintain a permanent database of 

4 the assembled or merged information from 

5 which new consumer reports are produced. 

6 ‘‘(ii) LIMITATION.—A reseller of as7 sembled or merged information shall pre8 serve any fraud alert placed on a consumer 

9 report by another consumer reporting 

10 agency. 

11 ‘‘(B) EXEMPT INSTITUTIONS.—The re12 quirement under this subsection to place a 

13 fraud alert in a consumer file shall not apply 

14 to—

15 ‘‘(i) a check services company, which 

16 issues authorizations for the purpose of ap17 proving or processing negotiable instru18 ments, electronic funds transfers, or simi19 lar methods of payments; or 

20 ‘‘(ii) a demand deposit account infor21 mation service company, which issues re22 ports regarding account closures due to 

23 fraud, substantial overdrafts, ATM abuse, 

24 or similar negative information regarding a 

25 consumer, to inquiring banks or other fi-
11

•S 223 IS 

1 nancial institutions for use only in review2 ing a consumer request for a demand de3 posit account at the inquiring bank or fi4 nancial institution.’’. 

5 SEC. 4. TRUNCATION OF CREDIT CARD ACCOUNT NUM6 BERS. 

7 (a) IN GENERAL.—Except as provided in this section, 

8 no person, firm, partnership, association, corporation, or 

9 limited liability company that accepts credit cards for the 

10 transaction of business shall print more than the last 5 

11 digits of the credit card account number or the expiration 

12 date upon any receipt provided to the cardholder. 

13 (b) LIMITATION.—This section—

14 (1) applies only to receipts that are electroni15 cally printed; and 

16 (2) does not apply to transactions in which the 

17 sole means of recording the cardholder’s credit card 

18 account number is by handwriting or by an imprint 

19 or copy of the credit card. 

20 (c) EFFECTIVE DATE.—This section shall take ef21 fect—

22 (1) on the date that is 4 years after the date 

23 of enactment of this Act, with respect to any cash 

24 register or other machine or device that electroni25 cally prints receipts for credit card transactions that 
12

•S 223 IS 

1 is in use prior to the date of enactment of this Act; 

2 and 

3 (2) on the date that is 18 months after the date 

4 of enactment of this Act, with respect to any cash 

5 register or other machine or device that electroni6 cally prints receipts for credit card transactions that 

7 is first put into use on or after the date of enact8 ment of this Act. 

9 (d) EFFECT ON STATE LAW.—Nothing in this sec10 tion prevents a State from imposing requirements that are 

11 the same or substantially similar to the requirements of 

12 this section at any time before the effective date of this 

13 section. 

14 SEC. 5. FREE ANNUAL CREDIT REPORT. 

15 Section 612(c) of the Fair Credit Reporting Act (15 

16 U.S.C. 1681j(c)) is amended to read as follows: 

17 ‘‘(c) FREE ANNUAL DISCLOSURE.—Upon the request 

18 of the consumer and without charge to the consumer, a 

19 consumer reporting agency shall make all the disclosures 

20 listed under section 609 once during any 12-month pe21 riod.’’.

Æ