SEC. 2. DEFINITIONS. 
Section 603 of the Fair Credit Reporting Act (15 
U.S.C. 1681a) is amended by adding at the end the fol-
lowing new subsections: 
‘‘(r) RESELLER.—The term ‘reseller’ means a con-
sumer reporting agency that—
‘‘(1) acts as a reseller of information by assem-
bling and merging information contained in the 
database of another consumer reporting agency or 
multiple consumer reporting agencies; and 
‘‘(2) does not maintain a permanent database 
of the assembled or merged information from which 
new consumer reports are produced. 
‘‘(s) OTHER DEFINITIONS.—
‘‘(1) BOARD; CREDIT; CREDITOR.—The terms 
‘Board’, ‘credit’ and ‘creditor’ have the same mean-
ings as in section 103 of the Truth in Lending Act. 
‘‘(2) ELECTRONIC FUND TRANSFER.—The term 
‘electronic fund transfer’ has the same meaning as 
in section 903 of the Electronic Fund Transfer Act. 
‘‘(3) FEDERAL BANKING AGENCY.—The term 
‘Federal banking agency’ has the same meaning as 
in section 3 of the Federal Deposit Insurance Act. 
‘‘(4) IDENTITY
THEFT.—The term ‘identity 
theft’ includes a violation of section 1028, 1029, or 
1030 of title 18, United States Code.’’.
TITLE 
I—UNIFORM 
NATIONAL 
CONSUMER 
PROTECTION 
STANDARDS 
SEC. 101. UNIFORM NATIONAL CONSUMER PROTECTIONS 
STANDARDS MADE PERMANENT. 
Section 624(d) of the Fair Credit Reporting Act (15 
U.S.C. 1681t(d)) is amended—
(1) by striking ‘‘Subsections (b) and (c)’’ and 
all that follows through ‘‘do not affect any settle-
ment,’’ and inserting ‘‘Subsections (b) and (c) do 
not affect any settlement,’’; and 
(2) by striking ‘‘Consumer Credit Reporting 
Reform Act of 1996’’ and all that follows through 
the period at the end of paragraph (2) and inserting 
‘‘Consumer Credit Reporting Reform Act of 1996.’’. 
TITLE II—IDENTITY THEFT 
PREVENTION 
SEC. 201. INVESTIGATING CHANGES OF ADDRESS. 
(a) IN GENERAL.—Section 605 of the Fair Credit 
Reporting Act (15 U.S.C. 1681c) is amended by inserting 
after subsection (f), the following new subsection: 
‘‘(g) INVESTIGATION OF CHANGES OF ADDRESS.—If 
a credit card issuer receives a request for an additional 
credit card with respect to an existing credit card account
within 30 days after receiving notification of a change of 
address for that account, the card issuer shall—
‘‘(1) notify the cardholder of the request—
‘‘(A) at both the new address and the 
former address of the cardholder; or 
‘‘(B) by such other means of communica-
tion as the cardholder and the credit card 
issuer previously agreed to, 
in accordance with reasonable policies and proce-
dures established by the card issuer pursuant to reg-
ulations which the Board shall prescribe; and 
‘‘(2) provide to the cardholder a means of 
promptly reporting incorrect changes.’’. 
(b) CLERICAL AMENDMENTS.—
(1) The heading for section 605 of the Fair 
Credit Reporting Act is amended to read as follows: 
‘‘§ 605. Requirements relating to information con-
tained in consumer reports and to iden-
tity theft.’’. 
(2) The table of sections for title VI of the Con-
sumer Credit Protection Act is amended by striking 
the item relating to section 605 and inserting the 
following new item:
‘‘605. Requirements relating to information contained in consumer reports and 
to identity theft.’’.
SEC. 202. FRAUD ALERTS. 
Section 605 of the Fair Credit Reporting Act (15 
U.S.C. 1681c) is amended by adding at the end the fol-
lowing new subsection: 
‘‘(i) FRAUD ALERTS.—
‘‘(1) IN GENERAL.—Upon the request of a con-
sumer who asserts in good faith a suspicion that the 
consumer has been or is about to become a victim 
of fraud or related crime, and upon receiving proper 
identification, a consumer reporting agency shall in-
clude a fraud alert in the file of that consumer. 
‘‘(2) NOTICE TO USERS.—A consumer reporting 
agency shall notify each person procuring a con-
sumer report with respect to a consumer of the ex-
istence of a fraud alert in effect for such consumer, 
regardless of whether a full credit report, credit 
score, or summary report is requested. 
‘‘(3) PROHIBITION.—No user of a consumer re-
port with a fraud alert may issue or extend credit 
in the name of the consumer to a person other than 
the consumer without attempting to obtain the au-
thorization or preauthorization of the consumer in 
the manner contained in the fraud alert in effect for 
such consumer. 
‘‘(4) DEFINITION.—In this subsection, the term 
‘fraud alert’ means a clear and conspicuous state-
ment in the file of a consumer that notifies all pro-
spective users of a consumer report made with re-
spect to that consumer that the consumer does not 
authorize the issuance or extension of credit in the 
name of the consumer unless— 
‘‘(A) the issuer or extender of such credit 
first obtains verbal authorization from the con-
sumer at a telephone number designated by the 
consumer; or 
‘‘(B) the issuer of such credit utilizes an-
other reasonable means of communication to 
obtain 
the 
express 
authorization 
or 
preauthorization of the consumer. 
‘‘(5) EXCEPTIONS.—
‘‘(A) RESELLERS.—
‘‘(i) IN GENERAL.—The provisions of 
this subsection shall not apply to a reseller. 
‘‘(ii) LIMITATION.—A reseller shall 
preserve any fraud alert placed on a con-
sumer report by another consumer report-
ing agency. 
‘‘(B) EXEMPT
INSTITUTIONS.—The re-
quirement under this subsection to place a 
fraud alert in a consumer file shall not apply 
to—
‘‘(i) a check services company, which 
issues authorizations for the purpose of ap-
proving or processing negotiable instru-
ments, electronic funds transfers, or simi-
lar methods of payments; or 
‘‘(ii) a deposit account information 
service company, which issues reports re-
garding account closures due to fraud, sub-
stantial overdrafts, automated teller ma-
chine abuse, or similar negative informa-
tion regarding a consumer, to inquiring 
banks or other financial institutions for 
use only in reviewing a consumer request 
for a demand deposit account at the in-
quiring bank or financial institution.’’. 
SEC. 203. TRUNCATION OF CREDIT CARD AND DEBIT CARD 
ACCOUNT NUMBERS. 
(a) IN GENERAL.—Except as provided in this section, 
no person, firm, partnership, association, corporation, or 
limited liability company that accepts credit cards or debit 
cards for the transaction of business shall print more than 
the last 4 digits of the card account number or the expira-
tion date upon any receipt provided to the cardholder at 
the point of the sale or transaction.
(b) LIMITATION.—This section applies only to re-
ceipts that are electronically printed, and does not apply 
to transactions in which the sole means of recording the 
person’s credit card or debit card account number is by 
handwriting or by an imprint or copy of the card. 
(c) DEFINITIONS.—For purposes of this section, the 
following definitions shall apply: 
(1) CREDIT CARD.—The term ‘‘credit card’’ has 
the same meaning as in section 103(k) of the Truth 
in Lending Act. 
(2) DEBIT
CARD.—The term ‘‘debit card’’ 
means any card issued by a financial institution to 
a consumer for use in initiating electronic fund 
transfers (as defined in section 903(6) of the Elec-
tronic Fund Transfer Act) from the account (as de-
fined in such Act) of the consumer at such financial 
institution for the purpose of transferring money be-
tween accounts or obtaining money, property, labor, 
or services. 
(d) EFFECTIVE DATE.—This section shall become ef-
fective on—
(1) January 1, 2007, with respect to any cash 
register or other machine or device that electroni-
cally prints receipts for credit card or debit card
transactions that is in use before January 1, 2005; 
and 
(2) January 1, 2005, with respect to any cash 
register or other machine or device that electroni-
cally prints receipts for credit card or debit card 
transactions that is first put into use on or after 
such date. 
SEC. 204. SUMMARY OF RIGHTS OF IDENTITY THEFT VIC-
TIMS. 
(a) IN GENERAL.—Section 609 of the Fair Credit 
Reporting Act (15 U.S.C. 1681g) is amended by adding 
at the end the following new subsection: 
‘‘(d) SUMMARY OF RIGHTS OF IDENTITY THEFT VIC-
TIMS.—A consumer reporting agency shall establish rea-
sonable policies and procedures for providing consumers 
who have reason to believe they are the victims of fraud 
or identity theft involving credit, electronic fund transfers, 
or accounts or transactions at or with a financial institu-
tion with a summary of the rights of consumers under the 
Consumer Credit Protection Act and other provisions of 
Federal law and procedures for remedying the effects of 
any such alleged offense.’’. 
(b) BEST PRACTICES.—The Federal Trade Commis-
sion shall develop guidelines for model policies and model
procedures with regard to the summary of rights required 
under the amendment made by subsection (a). 
SEC. 205. BLOCKING OF INFORMATION RESULTING FROM 
IDENTITY THEFT. 
Section 605 of the Fair Credit Reporting Act (15 
U.S.C. 1681c) is amended by inserting after subsection 
(i) (as added by section 202 of this title) the following 
new subsection: 
‘‘(j) BLOCK
OF INFORMATION RESULTING FROM 
IDENTITY THEFT.—
‘‘(1) BLOCK.—Except as provided in paragraph 
(3) and not later than 30 days after the date of re-
ceipt of proof of the identity of a consumer and an 
official copy of a police report evidencing the claim 
of the consumer of identity theft, a consumer report-
ing agency shall block the reporting of any informa-
tion identified by the consumer in the file of the con-
sumer resulting from the alleged identity theft, so 
that the information cannot be reported. 
‘‘(2) NOTIFICATION.—A consumer reporting 
agency shall promptly notify the furnisher of infor-
mation identified by the consumer under paragraph 
(1)—
‘‘(A) that the information may be a result 
of identity theft;
‘‘(B) that a police report has been filed; 
‘‘(C) that a block has been requested under 
this subsection; and 
‘‘(D) of the effective date of the block. 
‘‘(3) AUTHORITY TO DECLINE OR RESCIND.—
‘‘(A) IN GENERAL.—A consumer reporting 
agency may decline to block, or may rescind 
any block, of consumer information under this 
subsection if—
‘‘(i) the consumer reporting agency 
reasonably determined that—
‘‘(I) the information was blocked 
due to a misrepresentation of fact by 
the consumer relevant to the request 
to block; or 
‘‘(II) the consumer knowingly ob-
tained possession of goods, services, or 
moneys as a result of the blocked 
transaction or transactions, or the 
consumer should have known that the 
consumer 
obtained 
possession 
of 
goods, services, or moneys as a result 
of the blocked transaction or trans-
actions; or
‘‘(ii) the consumer agrees that the 
blocked information or portions of the 
blocked information were blocked in error. 
‘‘(B) NOTIFICATION
TO
CONSUMER.—If 
the block of information is declined or rescinded 
under this paragraph, the affected consumer 
shall be notified promptly, in the same manner 
as consumers are notified of the reinsertion of 
information under section 611(a)(5)(B). 
‘‘(C) SIGNIFICANCE OF BLOCK.—For pur-
poses of this paragraph, if a consumer report-
ing agency rescinds a block, the presence of in-
formation in the file of a consumer prior to the 
blocking of such information is not evidence of 
whether the consumer knew or should have 
known that the consumer obtained possession of 
any goods, services, or monies as a result of the 
block. 
‘‘(4) EXCEPTIONS.—
‘‘(A) NEGATIVE
INFORMATION
DATA.—A 
consumer reporting agency shall not be required 
to comply with this subsection when such agen-
cy is issuing information for authorizations, for 
the purpose of approving or processing nego-
tiable instruments, electronic funds transfers,
or similar methods of payment, based solely on 
negative information, including—
‘‘(i) dishonored checks; 
‘‘(ii) accounts closed for cause; 
‘‘(iii) substantial overdrafts; 
‘‘(iv) abuse of automated teller ma-
chines; or 
‘‘(v) other information which indicates 
a risk of fraud occurring. 
‘‘(B) RESELLERS.—
‘‘(i) NO RESELLER FILE.—The provi-
sions of this subsection do not apply to a 
consumer reporting agency if the consumer 
reporting agency—
‘‘(I) is a reseller; 
‘‘(II) is not, at the time of the re-
quest of the consumer under para-
graph (1), otherwise furnishing or re-
selling a consumer report concerning 
the information identified by the con-
sumer; and 
‘‘(III) informs the consumer, by 
any means, that the consumer may re-
port the identity theft to the Federal
Trade Commission to obtain consumer 
information regarding identity theft. 
‘‘(ii) RESELLER
WITH
FILE.—The 
sole obligation of the consumer reporting 
agency under this subsection, with regard 
to any request of a consumer under this 
subsection, shall be to block the consumer 
report maintained by the consumer report-
ing agency from any subsequent use if—
‘‘(I) the consumer, in accordance 
with the provisions of paragraph (1), 
identifies, to a consumer reporting 
agency, information in the file of the 
consumer that resulted from identity 
theft; and 
‘‘(II) the consumer reporting 
agency is a reseller of the identified 
information. 
‘‘(iii) NOTICE.—In carrying out its 
obligation under clause (ii), the reseller 
shall promptly provide a notice to the con-
sumer of the decision to block the file. 
Such notice shall contain the name, ad-
dress, and telephone number of each con-
sumer reporting agency from which the
consumer information was obtained for re-
sale.’’. 
SEC. 206. ESTABLISHMENT OF PROCEDURES FOR DEPOSI-
TORY INSTITUTIONS TO IDENTIFY POSSIBLE 
INSTANCES OF IDENTITY THEFT. 
(a) IN GENERAL.—Section 605 of the Fair Credit 
Reporting Act (15 U.S.C. 1681c) is amended by inserting 
after subsection (j) (as added by section 205 of this title) 
the following new subsection: 
‘‘(k) ‘RED FLAG’ GUIDELINES REQUIRED.—The 
Federal banking agencies shall jointly establish and main-
tain guidelines for use by insured depository institutions 
in identifying patterns, practices, and specific forms of ac-
tivity that indicate the possible existence of identity theft, 
and update such guidelines as often as necessary.’’. 
(b) EFFECTIVE DATE.—The amendment made by 
subsection (a) shall take effect at the end-of the 1-year 
period beginning the date of the enactment of this Act.
TITLE III—IMPROVING RESOLU-
TION 
OF 
CONSUMER 
DIS-
PUTES 
SEC. 301. COORDINATION OF CONSUMER COMPLAINT IN-
VESTIGATIONS. 
Section 621 of the Fair Credit Reporting Act (15 
U.S.C. 1681s) is amended by adding at the end the fol-
lowing new subsections: 
‘‘(f) COORDINATION OF CONSUMER COMPLAINT IN-
VESTIGATIONS.— Not later than 365 days after the date 
of enactment of the Fair and Accurate Credit Trans-
actions Act of 2003, the Federal Trade Commission shall 
prescribe rules in accordance with section 553 of title 5, 
United States Code—
‘‘(1) to develop procedures for referral of con-
sumer complaints under this title about identity 
theft and fraud alerts between and among the con-
sumer reporting agencies and the Commission; and 
‘‘(2) to develop a model form and model proce-
dures to be used by consumers who are victims of 
identity fraud for contacting and informing creditors 
and consumer reporting agencies of the fraud.’’. 
SEC. 302. NOTICE OF DISPUTE THROUGH RESELLER. 
Section 611(a)(1)(A) of the Fair Credit Reporting 
Act (15 U.S.C. 1681i(a)(1)(A)) is amended by inserting
‘‘, or indirectly through a reseller,’’ after ‘‘notifies the 
agency directly’’. 
SEC. 303. PROMPT INVESTIGATION OF DISPUTED CON-
SUMER INFORMATION. 
(A) STUDY REQUIRED.—The Board of Governors of 
the Federal Reserve System and the Federal Trade Com-
mission shall each study the extent to which, and the man-
ner in which, consumer reporting agencies and furnishers 
of consumer information to consumer reporting agencies 
are complying with the procedures, time lines, and require-
ments under the Fair Credit Reporting Act for the prompt 
investigation of the disputed accuracy of any consumer in-
formation and the prompt correction or deletion, in ac-
cordance with such Act, of any inaccurate or incomplete 
information or information that cannot be verified. 
(b) REPORT REQUIRED.—Before the end of the 6-
month period beginning on the date of the enactment of 
this Act, the Board of Governors of the Federal Reserve 
System and the Federal Trade Commission shall each sub-
mit a progress report to the Congress on the results of 
the study required under subsection (a). 
(c) RECOMMENDATIONS.—The report under sub-
section (b) shall include such recommendations as the 
Board and the Commission determine to be appropriate 
for legislative or administrative action to ensure that—
(1) consumer disputes with consumer reporting 
agencies over the accuracy or completeness of infor-
mation in a consumer’s file are promptly and fully 
investigated and any incorrect, incomplete, or un-
verifiable information is immediately corrected or de-
leted; 
(2) furnishers of information to consumer re-
porting agencies maintain full and prompt compli-
ance with the duties and responsibilities established 
under section 623 of the Fair Credit Reporting Act; 
and 
(3) consumer reporting agencies establish and 
maintain appropriate internal controls and manage-
ment review procedures for maintaining full and 
continuous compliance with the procedures, time 
lines, and requirements under the Fair Credit Re-
porting Act for the prompt investigation of the dis-
puted accuracy of any consumer information and the 
prompt correction or deletion, in accordance with 
such Act, of any inaccurate or incomplete informa-
tion or information that cannot be verified. 
(d) DEFINITIONS.—For purposes of this section, the 
terms ‘‘consumer’’, ‘‘consumer report’’, and ‘‘consumer re-
porting agency’’ have the same meaning as in the Fair 
Credit Reporting Act.
TITLE 
IV—IMPROVING 
ACCU-
RACY 
OF 
CONSUMER 
RECORDS 
SEC. 401. RECONCILING ADDRESSES. 
Section 605 of the Fair Credit Reporting Act (15 
U.S.C. 1681c) is amended by inserting after subsection 
(g) (as added by section 201 of this Act) the following 
new subsection. 
‘‘(h) NOTICE
OF DISCREPANCY.—In any case in 
which a person has requested a consumer report relating 
to a consumer, and the request includes an address for 
the consumer that substantially differs from the most re-
cent address in the file of the consumer, the consumer re-
porting agency shall—
‘‘(1) notify the requester of the discrepancy; 
and 
‘‘(2) reconcile or resolve, within 30 days, any 
substantial variation between the most recent ad-
dress in the file of the consumer at the agency and 
the address contained in the request, in accordance 
with reasonable policies and procedures established 
by the consumer reporting agency.’’.
SEC. 402. PREVENTION OF REPOLLUTION OF CONSUMER 
REPORTS. 
Section 623(a)(1) of the Fair Credit Reporting Act 
(15 U.S.C. 1681s–2(a)(1)) is amended by adding at the 
end the following new subparagraph: 
‘‘(D) INFORMATION KNOWN TO INCLUDE 
IDENTITY THEFT ACTIVITY.—A person may not 
furnish information to any consumer reporting 
agency that the person knows or has reason to 
believe has resulted from fraudulent activity, in-
cluding identity theft.’’. 
SEC. 403. NOTICE BY USERS WITH RESPECT TO FRAUDU-
LENT INFORMATION. 
Section 615 of the Fair Credit Reporting Act (15 
U.S.C. 1681m) is amended by adding at the end the fol-
lowing new subsection: 
‘‘(e) NOTICE OF FRAUDULENT INFORMATION RE-
LATING TO IDENTITY THEFT.—Any assignee or agent, in-
cluding a debt collector (as defined in title VIII), of a per-
son who uses a consumer report on any consumer, who 
learns that any information in such consumer report is 
fraudulent and may be the result of identity theft shall 
notify the person of such fraudulent information.’’.
TITLE 
V—IMPROVEMENTS 
IN 
USE OF AND CONSUMER AC-
CESS TO CREDIT INFORMA-
TION 
SEC. 501. FREE REPORTS ANNUALLY. 
Section 612(c) of the Fair Credit Reporting Act (15 
U.S.C. 1681j(c)) is amended to read as follows: 
‘‘(c) FREE ANNUAL DISCLOSURE.—Upon the request 
of the consumer, a consumer reporting agency shall make 
all disclosures pursuant to section 609 once during any 
12-month period without charge to the consumer.’’. 
SEC. 502. SUMMARY OF CREDIT SCORES. 
Section 609(a)(1) of the Fair Credit Reporting Act 
(15 U.S.C. 1681g(a)(1)) is amended by striking ‘‘except 
that nothing’’ and all that follows through the period at 
the end and inserting ‘‘including a summary of how any 
individual credit score of the consumer was derived and 
how such score might be improved.’’. 
SEC. 503. SIMPLER AND EASIER METHOD FOR CONSUMERS 
TO USE NOTIFICATION SYSTEM. 
(a) IN GENERAL.—Section 604(e)(5)(A)(i) of the 
Fair Credit Reporting Act (15 U.S.C. 1681b(e)(5)(A)(i)) 
is amended by inserting ‘‘in a simple and easy manner 
and’’ after ‘‘notify the agency,’’.
(b) TECHNICAL AND CONFORMING AMENDMENT.—
Section 615(d) of the Fair Credit Reporting Act (15 
U.S.C. 1681m(d)) is amended—
(1) by redesignating paragraphs (2), (3), and 
(4), as paragraphs (3), (4) and (5); and 
(2) by inserting after paragraph (1) the fol-
lowing new paragraph: 
‘‘(2) SIMPLE
AND
EASY
NOTIFICATION.—Any 
statement given the consumer under paragraph 
(1)(E) shall be in a simple and easy to understand 
format and shall afford a simple and easy method 
for the consumer to respond.’’. 
TITLE 
VI—PROTECTING 
EM-
PLOYEE MISCONDUCT INVES-
TIGATIONS 
SEC. 601. CERTAIN EMPLOYEE INVESTIGATION COMMU-
NICATIONS EXCLUDED FROM DEFINITION OF 
CONSUMER REPORT. 
(a) IN GENERAL.—Section 603 of the Fair Credit 
Reporting Act (15 U.S.C. 1681a) is amended—
(1) by redesignating subsection (p) as sub-
section (q); and 
(2) by inserting after subsection (o) the fol-
lowing new subsection:
‘‘(p) EXCLUSION OF CERTAIN COMMUNICATIONS FOR 
EMPLOYEE INVESTIGATIONS.—
‘‘(1) COMMUNICATIONS
DESCRIBED
IN
THIS 
SUBSECTION.—A communication is described in this 
subsection if—
‘‘(A) but for subsection (d)(2)(D), the 
communication would be a consumer report; 
‘‘(B) the communication is made to an em-
ployer in connection with an investigation of—
‘‘(i) suspected misconduct relating to 
employment; or 
‘‘(ii) compliance with Federal, State, 
or local laws and regulations, the rules of 
a self-regulatory organization, or any pre-
existing written policies of the employer; 
‘‘(C) the communication is not made for 
the purpose of investigating a consumer’s credit 
worthiness, credit standing, or credit capacity; 
and 
‘‘(D) the communication is not provided to 
any person except—
‘‘(i) to the employer or an agent of 
the employer; 
‘‘(ii) to any Federal or State officer, 
agency, or department, or any officer,
agency, or department of a unit of general 
local government; 
‘‘(iii) to any self-regulatory organiza-
tion with regulatory authority over the ac-
tivities of the employer or employee; 
‘‘(iv) as otherwise required by law; or 
‘‘(v) pursuant to section 608. 
‘‘(2) SUBSEQUENT DISCLOSURE.—After taking 
any adverse action based in whole or in part on a 
communication described in paragraph (1), the em-
ployer shall disclose to the consumer a summary 
containing the nature and substance of the commu-
nication upon which the adverse action is based, ex-
cept that the sources of information acquired solely 
for use in preparing what would be but for sub-
section (d)(2)(D) an investigative consumer report 
need not be disclosed. 
‘‘(3) SELF-REGULATORY
ORGANIZATION
DE-
FINED.—For purposes of this subsection, the term 
‘self-regulatory organization’ includes any self-regu-
latory organization (as defined in section 3(a)(26) of 
the Securities Exchange Act of 1934), any entity es-
tablished under Title I of the Sarbanes-Oxley Act of 
2002, any board of trade designated by the Com-
modity Futures Trading Commission, and any fu-
tures association registered with such Commission.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.—
Section 603(d)(2)(D) of the Fair Credit Reporting Act (15 
U.S.C. 1681a(d)(2)(D)) is amended by inserting ‘‘or (p)’’ 
after ‘‘subsection (o)’’.
Æ