---
kind: "section"
citation: "15 U.S.C. § 1681c–1"
title: "15"
title_heading: "Commerce and Trade"
number: "1681c–1"
heading: "Identity theft prevention; fraud alerts and active duty alerts"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/15/1681c-1"
units:
  - "Chapter 41 — Consumer Credit Protection"
  - "Subchapter III — Credit Reporting Agencies"
---

# §1681c–1. Identity theft prevention; fraud alerts and active duty alerts


(a) One-call [fraud alerts](/usc/15/1681a.md?p=q-2)

(1) Initial alerts

Upon the direct request of a [consumer](/usc/15/1681a.md?p=c), or an individual acting on behalf of or as a personal representative of a [consumer](/usc/15/1681a.md?p=c), who asserts in good faith a suspicion that the [consumer](/usc/15/1681a.md?p=c) has been or is about to become a victim of fraud or related crime, including [identity theft](/usc/15/1681a.md?p=q-3), a [consumer reporting agency](/usc/15/1681a.md?p=f) described in [section 1681a(p) of this title](/usc/15/1681a.md?p=p) that maintains a file on the [consumer](/usc/15/1681a.md?p=c) and has received appropriate proof of the identity of the requester shall—

(A) include a [fraud alert](/usc/15/1681a.md?p=q-2) in the file of that [consumer](/usc/15/1681a.md?p=c), and also provide that alert along with any [credit](/usc/15/1602.md?p=f) score generated in using that file, for a period of not less than 1 year, beginning on the date of such request, unless the [consumer](/usc/15/1681a.md?p=c) or such representative requests that such [fraud alert](/usc/15/1681a.md?p=q-2) be removed before the end of such period, and the agency has received appropriate proof of the identity of the requester for such purpose; and

(B) refer the information regarding the [fraud alert](/usc/15/1681a.md?p=q-2) under this paragraph to each of the other [consumer reporting agencies](/usc/15/1681a.md?p=f) described in [section 1681a(p) of this title](/usc/15/1681a.md?p=p), in accordance with procedures developed under [section 1681s(f) of this title](/usc/15/1681s.md?p=f).

(2) Access to free reports

In any case in which a [consumer reporting agency](/usc/15/1681a.md?p=f) includes a [fraud alert](/usc/15/1681a.md?p=q-2) in the file of a [consumer](/usc/15/1681a.md?p=c) pursuant to this subsection, the [consumer reporting agency](/usc/15/1681a.md?p=f) shall—

(A) disclose to the [consumer](/usc/15/1681a.md?p=c) that the [consumer](/usc/15/1681a.md?p=c) may request a free copy of the file of the [consumer](/usc/15/1681a.md?p=c) pursuant to [section 1681j(d) of this title](/usc/15/1681j.md?p=d); and

(B) provide to the [consumer](/usc/15/1681a.md?p=c) all disclosures required to be made under [section 1681g of this title](/usc/15/1681g.md), without charge to the [consumer](/usc/15/1681a.md?p=c), not later than 3 business days after any request described in subparagraph (A).

(b) Extended alerts

(1) In general

Upon the direct request of a [consumer](/usc/15/1681a.md?p=c), or an individual acting on behalf of or as a personal representative of a [consumer](/usc/15/1681a.md?p=c), who submits an [identity theft report](/usc/15/1681a.md?p=q-4) to a [consumer reporting agency](/usc/15/1681a.md?p=f) described in [section 1681a(p) of this title](/usc/15/1681a.md?p=p) that maintains a file on the [consumer](/usc/15/1681a.md?p=c), if the agency has received appropriate proof of the identity of the requester, the agency shall—

(A) include a [fraud alert](/usc/15/1681a.md?p=q-2) in the file of that [consumer](/usc/15/1681a.md?p=c), and also provide that alert along with any [credit](/usc/15/1602.md?p=f) score generated in using that file, during the 7-year period beginning on the date of such request, unless the [consumer](/usc/15/1681a.md?p=c) or such representative requests that such [fraud alert](/usc/15/1681a.md?p=q-2) be removed before the end of such period and the agency has received appropriate proof of the identity of the requester for such purpose;

(B) during the 5-year period beginning on the date of such request, exclude the [consumer](/usc/15/1681a.md?p=c) from any list of [consumers](/usc/15/1681a.md?p=c) prepared by the [consumer reporting agency](/usc/15/1681a.md?p=f) and provided to any third party to offer [credit](/usc/15/1602.md?p=f) or insurance to the [consumer](/usc/15/1681a.md?p=c) as part of a transaction that was not initiated by the [consumer](/usc/15/1681a.md?p=c), unless the [consumer](/usc/15/1681a.md?p=c) or such representative requests that such exclusion be rescinded before the end of such period; and

(C) refer the information regarding the extended [fraud alert](/usc/15/1681a.md?p=q-2) under this paragraph to each of the other [consumer reporting agencies](/usc/15/1681a.md?p=f) described in [section 1681a(p) of this title](/usc/15/1681a.md?p=p), in accordance with procedures developed under [section 1681s(f) of this title](/usc/15/1681s.md?p=f).

(2) Access to free reports

In any case in which a [consumer reporting agency](/usc/15/1681a.md?p=f) includes a [fraud alert](/usc/15/1681a.md?p=q-2) in the file of a [consumer](/usc/15/1681a.md?p=c) pursuant to this subsection, the [consumer reporting agency](/usc/15/1681a.md?p=f) shall—

(A) disclose to the [consumer](/usc/15/1681a.md?p=c) that the [consumer](/usc/15/1681a.md?p=c) may request 2 free copies of the file of the [consumer](/usc/15/1681a.md?p=c) pursuant to [section 1681j(d) of this title](/usc/15/1681j.md?p=d) during the 12-month period beginning on the date on which the [fraud alert](/usc/15/1681a.md?p=q-2) was included in the file; and

(B) provide to the [consumer](/usc/15/1681a.md?p=c) all disclosures required to be made under [section 1681g of this title](/usc/15/1681g.md), without charge to the [consumer](/usc/15/1681a.md?p=c), not later than 3 business days after any request described in subparagraph (A).

(c) [Active duty alerts](/usc/15/1681a.md?p=q-2)

Upon the direct request of an [active duty military consumer](/usc/15/1681a.md?p=q-1), or an individual acting on behalf of or as a personal representative of an [active duty military consumer](/usc/15/1681a.md?p=q-1), a [consumer reporting agency](/usc/15/1681a.md?p=f) described in [section 1681a(p) of this title](/usc/15/1681a.md?p=p) that maintains a file on the [active duty military consumer](/usc/15/1681a.md?p=q-1) and has received appropriate proof of the identity of the requester shall—

(1) include an [active duty alert](/usc/15/1681a.md?p=q-2) in the file of that [active duty military consumer](/usc/15/1681a.md?p=q-1), and also provide that alert along with any [credit](/usc/15/1602.md?p=f) score generated in using that file, during a period of not less than 12 months, or such longer period as the [Bureau](/usc/15/1602.md?p=b) shall determine, by regulation, beginning on the date of the request, unless the [active duty military consumer](/usc/15/1681a.md?p=q-1) or such representative requests that such [fraud alert](/usc/15/1681a.md?p=q-2) be removed before the end of such period, and the agency has received appropriate proof of the identity of the requester for such purpose;

(2) during the 2-year period beginning on the date of such request, exclude the [active duty military consumer](/usc/15/1681a.md?p=q-1) from any list of [consumers](/usc/15/1681a.md?p=c) prepared by the [consumer reporting agency](/usc/15/1681a.md?p=f) and provided to any third party to offer [credit](/usc/15/1602.md?p=f) or insurance to the [consumer](/usc/15/1681a.md?p=c) as part of a transaction that was not initiated by the [consumer](/usc/15/1681a.md?p=c), unless the [consumer](/usc/15/1681a.md?p=c) requests that such exclusion be rescinded before the end of such period; and

(3) refer the information regarding the [active duty alert](/usc/15/1681a.md?p=q-2) to each of the other [consumer reporting agencies](/usc/15/1681a.md?p=f) described in [section 1681a(p) of this title](/usc/15/1681a.md?p=p), in accordance with procedures developed under [section 1681s(f) of this title](/usc/15/1681s.md?p=f).

(d) Procedures

Each [consumer reporting agency](/usc/15/1681a.md?p=f) described in [section 1681a(p) of this title](/usc/15/1681a.md?p=p) shall establish policies and procedures to comply with this section, including procedures that inform [consumers](/usc/15/1681a.md?p=c) of the availability of initial, extended, and [active duty alerts](/usc/15/1681a.md?p=q-2) and procedures that allow [consumers](/usc/15/1681a.md?p=c) and [active duty military consumers](/usc/15/1681a.md?p=q-1) to request initial, extended, or [active duty alerts](/usc/15/1681a.md?p=q-2) (as applicable) in a simple and easy manner, including by telephone.

(e) Referrals of alerts

Each [consumer reporting agency](/usc/15/1681a.md?p=f) described in [section 1681a(p) of this title](/usc/15/1681a.md?p=p) that receives a referral of a [fraud alert](/usc/15/1681a.md?p=q-2) or [active duty alert](/usc/15/1681a.md?p=q-2) from another [consumer reporting agency](/usc/15/1681a.md?p=f) pursuant to this section shall, as though the agency received the request from the [consumer](/usc/15/1681a.md?p=c) directly, follow the procedures required under—

(1) paragraphs (1)(A) and (2) of subsection (a), in the case of a referral under subsection (a)(1)(B);

(2) paragraphs (1)(A), (1)(B), and (2) of subsection (b), in the case of a referral under subsection (b)(1)(C); and

(3) paragraphs (1) and (2) of subsection (c), in the case of a referral under subsection (c)(3).

(f) Duty of [reseller](/usc/15/1681a.md?p=u) to reconvey alert

A [reseller](/usc/15/1681a.md?p=u) shall include in its report any [fraud alert](/usc/15/1681a.md?p=q-2) or [active duty alert](/usc/15/1681a.md?p=q-2) placed in the file of a [consumer](/usc/15/1681a.md?p=c) pursuant to this section by another [consumer reporting agency](/usc/15/1681a.md?p=f).

(g) Duty of other [consumer reporting agencies](/usc/15/1681a.md?p=f) to provide contact information

If a [consumer](/usc/15/1681a.md?p=c) contacts any [consumer reporting agency](/usc/15/1681a.md?p=f) that is not described in [section 1681a(p) of this title](/usc/15/1681a.md?p=p) to communicate a suspicion that the [consumer](/usc/15/1681a.md?p=c) has been or is about to become a victim of fraud or related crime, including [identity theft](/usc/15/1681a.md?p=q-3), the agency shall provide information to the [consumer](/usc/15/1681a.md?p=c) on how to contact the [Bureau](/usc/15/1602.md?p=b) and the [consumer reporting agencies](/usc/15/1681a.md?p=f) described in [section 1681a(p) of this title](/usc/15/1681a.md?p=p) to obtain more detailed information and request alerts under this section.

(h) Limitations on use of information for [credit](/usc/15/1602.md?p=f) extensions

(1) Requirements for initial and [active duty alerts](/usc/15/1681a.md?p=q-2)

(A) Notification

Each initial [fraud alert](/usc/15/1681a.md?p=q-2) and [active duty alert](/usc/15/1681a.md?p=q-2) under this section shall include information that notifies all prospective users of a [consumer report](/usc/15/1681a.md?p=d-1) on the [consumer](/usc/15/1681a.md?p=c) to which the alert relates that the [consumer](/usc/15/1681a.md?p=c) does not authorize the establishment of any [new credit plan](/usc/15/1681a.md?p=q-5) or extension of [credit](/usc/15/1602.md?p=f), other than under an open-end [credit](/usc/15/1602.md?p=f) plan (as defined in [section 1602(i)](/usc/15/1602.md?p=i)[^1] of this title), in the name of the [consumer](/usc/15/1681a.md?p=c), or issuance of an additional card on an existing [credit](/usc/15/1602.md?p=f) [account](/usc/15/1681a.md?p=r-4) requested by a [consumer](/usc/15/1681a.md?p=c), or any increase in [credit](/usc/15/1602.md?p=f) limit on an existing [credit](/usc/15/1602.md?p=f) [account](/usc/15/1681a.md?p=r-4) requested by a [consumer](/usc/15/1681a.md?p=c), except in accordance with subparagraph (B).

(B) Limitation on users

(i) In general

No prospective user of a [consumer report](/usc/15/1681a.md?p=d-1) that includes an initial [fraud alert](/usc/15/1681a.md?p=q-2) or an [active duty alert](/usc/15/1681a.md?p=q-2) in accordance with this section may establish a [new credit plan](/usc/15/1681a.md?p=q-5) or extension of [credit](/usc/15/1602.md?p=f), other than under an open-end [credit](/usc/15/1602.md?p=f) plan (as defined in [section 1602(i)](/usc/15/1602.md?p=i)[^1] of this title), in the name of the [consumer](/usc/15/1681a.md?p=c), or issue an additional card on an existing [credit](/usc/15/1602.md?p=f) [account](/usc/15/1681a.md?p=r-4) requested by a [consumer](/usc/15/1681a.md?p=c), or grant any increase in [credit](/usc/15/1602.md?p=f) limit on an existing [credit](/usc/15/1602.md?p=f) [account](/usc/15/1681a.md?p=r-4) requested by a [consumer](/usc/15/1681a.md?p=c), unless the user utilizes reasonable policies and procedures to form a reasonable belief that the user knows the identity of the [person](/usc/15/1602.md?p=e) making the request.

(ii) Verification

If a [consumer](/usc/15/1681a.md?p=c) requesting the alert has specified a telephone number to be used for identity verification purposes, before authorizing any [new credit plan](/usc/15/1681a.md?p=q-5) or extension described in clause (i) in the name of such [consumer](/usc/15/1681a.md?p=c), a user of such [consumer report](/usc/15/1681a.md?p=d-1) shall contact the [consumer](/usc/15/1681a.md?p=c) using that telephone number or take reasonable steps to verify the [consumer](/usc/15/1681a.md?p=c)’s identity and confirm that the application for a [new credit plan](/usc/15/1681a.md?p=q-5) is not the result of [identity theft](/usc/15/1681a.md?p=q-3).

(2) Requirements for extended alerts

(A) Notification

Each extended alert under this section shall include information that provides all prospective users of a [consumer report](/usc/15/1681a.md?p=d-1) relating to a [consumer](/usc/15/1681a.md?p=c) with—

(i) notification that the [consumer](/usc/15/1681a.md?p=c) does not authorize the establishment of any [new credit plan](/usc/15/1681a.md?p=q-5) or extension of [credit](/usc/15/1602.md?p=f) described in clause (i), other than under an open-end [credit](/usc/15/1602.md?p=f) plan (as defined in [section 1602(i)](/usc/15/1602.md?p=i)[^1] of this title), in the name of the [consumer](/usc/15/1681a.md?p=c), or issuance of an additional card on an existing [credit](/usc/15/1602.md?p=f) [account](/usc/15/1681a.md?p=r-4) requested by a [consumer](/usc/15/1681a.md?p=c), or any increase in [credit](/usc/15/1602.md?p=f) limit on an existing [credit](/usc/15/1602.md?p=f) [account](/usc/15/1681a.md?p=r-4) requested by a [consumer](/usc/15/1681a.md?p=c), except in accordance with subparagraph (B); and

(ii) a telephone number or other reasonable contact method designated by the [consumer](/usc/15/1681a.md?p=c).

(B) Limitation on users

No prospective user of a [consumer report](/usc/15/1681a.md?p=d-1) or of a [credit](/usc/15/1602.md?p=f) score generated using the information in the file of a [consumer](/usc/15/1681a.md?p=c) that includes an extended [fraud alert](/usc/15/1681a.md?p=q-2) in accordance with this section may establish a [new credit plan](/usc/15/1681a.md?p=q-5) or extension of [credit](/usc/15/1602.md?p=f), other than under an open-end [credit](/usc/15/1602.md?p=f) plan (as defined in [section 1602(i)](/usc/15/1602.md?p=i)[^1] of this title), in the name of the [consumer](/usc/15/1681a.md?p=c), or issue an additional card on an existing [credit](/usc/15/1602.md?p=f) [account](/usc/15/1681a.md?p=r-4) requested by a [consumer](/usc/15/1681a.md?p=c), or any increase in [credit](/usc/15/1602.md?p=f) limit on an existing [credit](/usc/15/1602.md?p=f) [account](/usc/15/1681a.md?p=r-4) requested by a [consumer](/usc/15/1681a.md?p=c), unless the user contacts the [consumer](/usc/15/1681a.md?p=c) in [person](/usc/15/1602.md?p=e) or using the contact method described in subparagraph (A)(ii) to confirm that the application for a [new credit plan](/usc/15/1681a.md?p=q-5) or increase in [credit](/usc/15/1602.md?p=f) limit, or request for an additional card is not the result of [identity theft](/usc/15/1681a.md?p=q-3).

(i) National [security](/usc/15/1667.md?p=5) freeze

(1) Definitions

For purposes of this subsection:

(A) The term “[consumer reporting agency](/usc/15/1681a.md?p=f)” means a [consumer reporting agency](/usc/15/1681a.md?p=f) described in [section 1681a(p) of this title](/usc/15/1681a.md?p=p).

(B) The term “proper identification” has the meaning of such term as used under [section 1681h of this title](/usc/15/1681h.md).

(C) The term “[security](/usc/15/1667.md?p=5) freeze” means a restriction that prohibits a [consumer reporting agency](/usc/15/1681a.md?p=f) from disclosing the contents of a [consumer report](/usc/15/1681a.md?p=d-1) that is subject to such [security](/usc/15/1667.md?p=5) freeze to any [person](/usc/15/1602.md?p=e) requesting the [consumer report](/usc/15/1681a.md?p=d-1).

(2) Placement of [security](/usc/15/1667.md?p=5) freeze

(A) In general

Upon receiving a direct request from a [consumer](/usc/15/1681a.md?p=c) that a [consumer reporting agency](/usc/15/1681a.md?p=f) place a [security](/usc/15/1667.md?p=5) freeze, and upon receiving proper identification from the [consumer](/usc/15/1681a.md?p=c), the [consumer reporting agency](/usc/15/1681a.md?p=f) shall, free of charge, place the [security](/usc/15/1667.md?p=5) freeze not later than—

(i) in the case of a request that is by toll-free telephone or secure electronic means, 1 business day after receiving the request directly from the [consumer](/usc/15/1681a.md?p=c); or

(ii) in the case of a request that is by mail, 3 business days after receiving the request directly from the [consumer](/usc/15/1681a.md?p=c).

(B) Confirmation and additional information

Not later than 5 business days after placing a [security](/usc/15/1667.md?p=5) freeze under subparagraph (A), a [consumer reporting agency](/usc/15/1681a.md?p=f) shall—

(i) send confirmation of the placement to the [consumer](/usc/15/1681a.md?p=c); and

(ii) inform the [consumer](/usc/15/1681a.md?p=c) of—

(I) the process by which the [consumer](/usc/15/1681a.md?p=c) may remove the [security](/usc/15/1667.md?p=5) freeze, including a mechanism to authenticate the [consumer](/usc/15/1681a.md?p=c); and

(II) the [consumer](/usc/15/1681a.md?p=c)’s right described in [section 1681m(d)(1)(D) of this title](/usc/15/1681m.md?p=d-1-D).

(C) Notice to third parties

A [consumer reporting agency](/usc/15/1681a.md?p=f) may advise a third party that a [security](/usc/15/1667.md?p=5) freeze has been placed with respect to a [consumer](/usc/15/1681a.md?p=c) under subparagraph (A).

(3) Removal of [security](/usc/15/1667.md?p=5) freeze

(A) In general

A [consumer reporting agency](/usc/15/1681a.md?p=f) shall remove a [security](/usc/15/1667.md?p=5) freeze placed on the [consumer report](/usc/15/1681a.md?p=d-1) of a [consumer](/usc/15/1681a.md?p=c) only in the following cases:

(i) Upon the direct request of the [consumer](/usc/15/1681a.md?p=c).

(ii) The [security](/usc/15/1667.md?p=5) freeze was placed due to a material misrepresentation of fact by the [consumer](/usc/15/1681a.md?p=c).

(B) Notice if removal not by request

If a [consumer reporting agency](/usc/15/1681a.md?p=f) removes a [security](/usc/15/1667.md?p=5) freeze under subparagraph (A)(ii), the [consumer reporting agency](/usc/15/1681a.md?p=f) shall notify the [consumer](/usc/15/1681a.md?p=c) in writing prior to removing the [security](/usc/15/1667.md?p=5) freeze.

(C) Removal of [security](/usc/15/1667.md?p=5) freeze by [consumer](/usc/15/1681a.md?p=c) request

Except as provided in subparagraph (A)(ii), a [security](/usc/15/1667.md?p=5) freeze shall remain in place until the [consumer](/usc/15/1681a.md?p=c) directly requests that the [security](/usc/15/1667.md?p=5) freeze be removed. Upon receiving a direct request from a [consumer](/usc/15/1681a.md?p=c) that a [consumer reporting agency](/usc/15/1681a.md?p=f) remove a [security](/usc/15/1667.md?p=5) freeze, and upon receiving proper identification from the [consumer](/usc/15/1681a.md?p=c), the [consumer reporting agency](/usc/15/1681a.md?p=f) shall, free of charge, remove the [security](/usc/15/1667.md?p=5) freeze not later than—

(i) in the case of a request that is by toll-free telephone or secure electronic means, 1 hour after receiving the request for removal; or

(ii) in the case of a request that is by mail, 3 business days after receiving the request for removal.

(D) Third-party requests

If a third party requests access to a [consumer report](/usc/15/1681a.md?p=d-1) of a [consumer](/usc/15/1681a.md?p=c) with respect to which a [security](/usc/15/1667.md?p=5) freeze is in effect, where such request is in connection with an application for [credit](/usc/15/1602.md?p=f), and the [consumer](/usc/15/1681a.md?p=c) does not allow such [consumer report](/usc/15/1681a.md?p=d-1) to be accessed, the third party may treat the application as incomplete.

(E) Temporary removal of [security](/usc/15/1667.md?p=5) freeze

Upon receiving a direct request from a [consumer](/usc/15/1681a.md?p=c) under subparagraph (A)(i), if the [consumer](/usc/15/1681a.md?p=c) requests a temporary removal of a [security](/usc/15/1667.md?p=5) freeze, the [consumer reporting agency](/usc/15/1681a.md?p=f) shall, in accordance with subparagraph (C), remove the [security](/usc/15/1667.md?p=5) freeze for the period of time specified by the [consumer](/usc/15/1681a.md?p=c).

(4) Exceptions

A [security](/usc/15/1667.md?p=5) freeze shall not apply to the making of a [consumer report](/usc/15/1681a.md?p=d-1) for use of the following:

(A) A [person](/usc/15/1602.md?p=e) or entity, or a subsidiary, affiliate, or agent of that [person](/usc/15/1602.md?p=e) or entity, or an assignee of a financial obligation owed by the [consumer](/usc/15/1681a.md?p=c) to that [person](/usc/15/1602.md?p=e) or entity, or a prospective assignee of a financial obligation owed by the [consumer](/usc/15/1681a.md?p=c) to that [person](/usc/15/1602.md?p=e) or entity in conjunction with the proposed purchase of the financial obligation, with which the [consumer](/usc/15/1681a.md?p=c) has or had prior to assignment an [account](/usc/15/1681a.md?p=r-4) or contract including a demand deposit [account](/usc/15/1681a.md?p=r-4), or to whom the [consumer](/usc/15/1681a.md?p=c) issued a negotiable instrument, for the purposes of reviewing the [account](/usc/15/1681a.md?p=r-4) or collecting the financial obligation owed for the [account](/usc/15/1681a.md?p=r-4), contract, or negotiable instrument. For purposes of this subparagraph, “reviewing the [account](/usc/15/1681a.md?p=r-4)” includes activities related to [account](/usc/15/1681a.md?p=r-4) maintenance, monitoring, [credit](/usc/15/1602.md?p=f) line increases, and [account](/usc/15/1681a.md?p=r-4) upgrades and enhancements.

(B) Any Federal, [State](/usc/15/1602.md?p=s), or local agency, law enforcement agency, trial court, or private collection agency acting pursuant to a court order, warrant, or subpoena.

(C) A child support agency acting pursuant to part D of title IV of the Social Security Act ([42 U.S.C. 651](/usc/42/651.md) et seq.).

(D) A Federal agency or a [State](/usc/15/1602.md?p=s) or its agents or assigns acting to investigate fraud or acting to investigate or collect delinquent taxes or unpaid court orders or to fulfill any of its other statutory responsibilities, provided such responsibilities are consistent with a permissible purpose under [section 1681b of this title](/usc/15/1681b.md).

(E) By a [person](/usc/15/1602.md?p=e) using [credit](/usc/15/1602.md?p=f) information for the purposes described under [section 1681b(c) of this title](/usc/15/1681b.md?p=c).

(F) Any [person](/usc/15/1602.md?p=e) or entity administering a [credit](/usc/15/1602.md?p=f) file monitoring subscription or similar service to which the [consumer](/usc/15/1681a.md?p=c) has subscribed.

(G) Any [person](/usc/15/1602.md?p=e) or entity for the purpose of providing a [consumer](/usc/15/1681a.md?p=c) with a copy of the [consumer](/usc/15/1681a.md?p=c)’s [consumer report](/usc/15/1681a.md?p=d-1) or [credit](/usc/15/1602.md?p=f) score, upon the request of the [consumer](/usc/15/1681a.md?p=c).

(H) Any [person](/usc/15/1602.md?p=e) using the information in connection with the underwriting of insurance.

(I) Any [person](/usc/15/1602.md?p=e) using the information for employment, tenant, or background screening purposes.

(J) Any [person](/usc/15/1602.md?p=e) using the information for assessing, verifying, or authenticating a [consumer](/usc/15/1681a.md?p=c)’s identity for purposes other than the granting of [credit](/usc/15/1602.md?p=f), or for investigating or preventing actual or potential fraud.

(5) Notice of rights

At any time a [consumer](/usc/15/1681a.md?p=c) is required to receive a summary of rights required under [section 1681g of this title](/usc/15/1681g.md), the following notice shall be included:

“[Consumers](/usc/15/1681a.md?p=c) Have the Right To Obtain a [Security](/usc/15/1667.md?p=5) Freeze

“You have a right to place a ‘[security](/usc/15/1667.md?p=5) freeze’ on your [credit](/usc/15/1602.md?p=f) report, which will prohibit a [consumer reporting agency](/usc/15/1681a.md?p=f) from releasing information in your [credit](/usc/15/1602.md?p=f) report without your express authorization. The [security](/usc/15/1667.md?p=5) freeze is designed to prevent [credit](/usc/15/1602.md?p=f), loans, and services from being approved in your name without your consent. However, you should be aware that using a [security](/usc/15/1667.md?p=5) freeze to take control over who gets access to the personal and financial information in your [credit](/usc/15/1602.md?p=f) report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, [credit](/usc/15/1602.md?p=f), mortgage, or any other [account](/usc/15/1681a.md?p=r-4) involving the extension of [credit](/usc/15/1602.md?p=f).

“As an alternative to a [security](/usc/15/1667.md?p=5) freeze, you have the right to place an initial or extended [fraud alert](/usc/15/1681a.md?p=q-2) on your [credit](/usc/15/1602.md?p=f) file at no cost. An initial [fraud alert](/usc/15/1681a.md?p=q-2) is a 1-year alert that is placed on a [consumer](/usc/15/1681a.md?p=c)’s [credit](/usc/15/1602.md?p=f) file. Upon seeing a [fraud alert](/usc/15/1681a.md?p=q-2) display on a [consumer](/usc/15/1681a.md?p=c)’s [credit](/usc/15/1602.md?p=f) file, a business is required to take steps to verify the [consumer](/usc/15/1681a.md?p=c)’s identity before extending new [credit](/usc/15/1602.md?p=f). If you are a victim of [identity theft](/usc/15/1681a.md?p=q-3), you are entitled to an extended [fraud alert](/usc/15/1681a.md?p=q-2), which is a [fraud alert](/usc/15/1681a.md?p=q-2) lasting 7 years.

“A [security](/usc/15/1667.md?p=5) freeze does not apply to a [person](/usc/15/1602.md?p=e) or entity, or its affiliates, or collection agencies acting on behalf of the [person](/usc/15/1602.md?p=e) or entity, with which you have an existing [account](/usc/15/1681a.md?p=r-4) that requests information in your [credit](/usc/15/1602.md?p=f) report for the purposes of reviewing or collecting the [account](/usc/15/1681a.md?p=r-4). Reviewing the [account](/usc/15/1681a.md?p=r-4) includes activities related to [account](/usc/15/1681a.md?p=r-4) maintenance, monitoring, [credit](/usc/15/1602.md?p=f) line increases, and [account](/usc/15/1681a.md?p=r-4) upgrades and enhancements.”.

(6) Webpage

(A) [Consumer reporting agencies](/usc/15/1681a.md?p=f)

A [consumer reporting agency](/usc/15/1681a.md?p=f) shall establish a webpage that—

(i) allows a [consumer](/usc/15/1681a.md?p=c) to request a [security](/usc/15/1667.md?p=5) freeze;

(ii) allows a [consumer](/usc/15/1681a.md?p=c) to request an initial [fraud alert](/usc/15/1681a.md?p=q-2);

(iii) allows a [consumer](/usc/15/1681a.md?p=c) to request an extended [fraud alert](/usc/15/1681a.md?p=q-2);

(iv) allows a [consumer](/usc/15/1681a.md?p=c) to request an active duty [fraud alert](/usc/15/1681a.md?p=q-2);

(v) allows a [consumer](/usc/15/1681a.md?p=c) to opt-out of the use of information in a [consumer report](/usc/15/1681a.md?p=d-1) to send the [consumer](/usc/15/1681a.md?p=c) a solicitation of [credit](/usc/15/1602.md?p=f) or insurance, in accordance with [section 1681m(d) of this title](/usc/15/1681m.md?p=d); and

(vi) shall not be the only mechanism by which a [consumer](/usc/15/1681a.md?p=c) may request a [security](/usc/15/1667.md?p=5) freeze.

(B) FTC

The Federal Trade [Commission](/usc/15/1602.md?p=dd-1) shall establish a single webpage that includes a link to each webpage established under subparagraph (A) within the Federal Trade [Commission](/usc/15/1602.md?p=dd-1)’s website www.Identitytheft.gov, or a successor website.

(j) National protection for files and [credit](/usc/15/1602.md?p=f) records of protected [consumers](/usc/15/1681a.md?p=c)

(1) Definitions

As used in this subsection:

(A) The term “[consumer reporting agency](/usc/15/1681a.md?p=f)” means a [consumer reporting agency](/usc/15/1681a.md?p=f) described in [section 1681a(p) of this title](/usc/15/1681a.md?p=p).

(B) The term “protected [consumer](/usc/15/1681a.md?p=c)” means an individual who is—

(i) under the age of 16 years at the time a request for the placement of a [security](/usc/15/1667.md?p=5) freeze is made; or

(ii) an incapacitated [person](/usc/15/1602.md?p=e) or a protected [person](/usc/15/1602.md?p=e) for whom a guardian or conservator has been appointed.

(C) The term “protected [consumer](/usc/15/1681a.md?p=c)’s representative” means a [person](/usc/15/1602.md?p=e) who provides to a [consumer reporting agency](/usc/15/1681a.md?p=f) sufficient proof of authority to act on behalf of a protected [consumer](/usc/15/1681a.md?p=c).

(D) The term “record” means a compilation of information that—

(i) identifies a protected [consumer](/usc/15/1681a.md?p=c);

(ii) is created by a [consumer reporting agency](/usc/15/1681a.md?p=f) solely for the purpose of complying with this subsection; and

(iii) may not be created or used to consider the protected [consumer](/usc/15/1681a.md?p=c)’s [credit](/usc/15/1602.md?p=f) worthiness, [credit](/usc/15/1602.md?p=f) standing, [credit](/usc/15/1602.md?p=f) capacity, character, general reputation, personal characteristics, or mode of living.

(E) The term “[security](/usc/15/1667.md?p=5) freeze” means a restriction that prohibits a [consumer reporting agency](/usc/15/1681a.md?p=f) from disclosing the contents of a [consumer report](/usc/15/1681a.md?p=d-1) that is the subject of such [security](/usc/15/1667.md?p=5) freeze or, in the case of a protected [consumer](/usc/15/1681a.md?p=c) for whom the [consumer reporting agency](/usc/15/1681a.md?p=f) does not have a file, a record that is subject to such [security](/usc/15/1667.md?p=5) freeze to any [person](/usc/15/1602.md?p=e) requesting the [consumer report](/usc/15/1681a.md?p=d-1) for the purpose of opening a new [account](/usc/15/1681a.md?p=r-4) involving the extension of [credit](/usc/15/1602.md?p=f).

(F) The term “sufficient proof of authority” means documentation that shows a protected [consumer](/usc/15/1681a.md?p=c)’s representative has authority to act on behalf of a protected [consumer](/usc/15/1681a.md?p=c) and includes—

(i) an order issued by a court of law;

(ii) a lawfully executed and valid power of attorney;

(iii) a document issued by a Federal, [State](/usc/15/1602.md?p=s), or [local government](/usc/15/34.md?p=1) agency in the United States showing proof of parentage, including a birth certificate; or

(iv) with respect to a protected [consumer](/usc/15/1681a.md?p=c) who has been placed in a foster care setting, a written communication from a county welfare department or its agent or designee, or a county probation department or its agent or designee, certifying that the protected [consumer](/usc/15/1681a.md?p=c) is in a foster care setting under its jurisdiction.

(G) The term “sufficient proof of identification” means information or documentation that identifies a protected [consumer](/usc/15/1681a.md?p=c) and a protected [consumer](/usc/15/1681a.md?p=c)’s representative and includes—

(i) a social [security](/usc/15/1667.md?p=5) number or a copy of a social [security](/usc/15/1667.md?p=5) card issued by the Social [Security](/usc/15/1667.md?p=5) [Administration](/usc/15/636e.md?p=1);

(ii) a certified or official copy of a birth certificate issued by the entity authorized to issue the birth certificate; or

(iii) a copy of a driver’s license, an identification card issued by the motor vehicle [administration](/usc/15/636e.md?p=1), or any other government issued identification.

(2) Placement of [security](/usc/15/1667.md?p=5) freeze for a protected [consumer](/usc/15/1681a.md?p=c)

(A) In general

Upon receiving a direct request from a protected [consumer](/usc/15/1681a.md?p=c)’s representative that a [consumer reporting agency](/usc/15/1681a.md?p=f) place a [security](/usc/15/1667.md?p=5) freeze, and upon receiving sufficient proof of identification and sufficient proof of authority, the [consumer reporting agency](/usc/15/1681a.md?p=f) shall, free of charge, place the [security](/usc/15/1667.md?p=5) freeze not later than—

(i) in the case of a request that is by toll-free telephone or secure electronic means, 1 business day after receiving the request directly from the protected [consumer](/usc/15/1681a.md?p=c)’s representative; or

(ii) in the case of a request that is by mail, 3 business days after receiving the request directly from the protected [consumer](/usc/15/1681a.md?p=c)’s representative.

(B) Confirmation and additional information

Not later than 5 business days after placing a [security](/usc/15/1667.md?p=5) freeze under subparagraph (A), a [consumer reporting agency](/usc/15/1681a.md?p=f) shall—

(i) send confirmation of the placement to the protected [consumer](/usc/15/1681a.md?p=c)’s representative; and

(ii) inform the protected [consumer](/usc/15/1681a.md?p=c)’s representative of the process by which the protected [consumer](/usc/15/1681a.md?p=c) may remove the [security](/usc/15/1667.md?p=5) freeze, including a mechanism to authenticate the protected [consumer](/usc/15/1681a.md?p=c)’s representative.

(C) Creation of file

If a [consumer reporting agency](/usc/15/1681a.md?p=f) does not have a file pertaining to a protected [consumer](/usc/15/1681a.md?p=c) when the [consumer reporting agency](/usc/15/1681a.md?p=f) receives a direct request under subparagraph (A), the [consumer reporting agency](/usc/15/1681a.md?p=f) shall create a record for the protected [consumer](/usc/15/1681a.md?p=c).

(3) Prohibition on release of record or file of protected [consumer](/usc/15/1681a.md?p=c)

After a [security](/usc/15/1667.md?p=5) freeze has been placed under paragraph (2)(A), and unless the [security](/usc/15/1667.md?p=5) freeze is removed in accordance with this subsection, a [consumer reporting agency](/usc/15/1681a.md?p=f) may not release the protected [consumer](/usc/15/1681a.md?p=c)’s [consumer report](/usc/15/1681a.md?p=d-1), any information derived from the protected [consumer](/usc/15/1681a.md?p=c)’s [consumer report](/usc/15/1681a.md?p=d-1), or any record created for the protected [consumer](/usc/15/1681a.md?p=c).

(4) Removal of a protected [consumer](/usc/15/1681a.md?p=c) [security](/usc/15/1667.md?p=5) freeze

(A) In general

A [consumer reporting agency](/usc/15/1681a.md?p=f) shall remove a [security](/usc/15/1667.md?p=5) freeze placed on the [consumer report](/usc/15/1681a.md?p=d-1) of a protected [consumer](/usc/15/1681a.md?p=c) only in the following cases:

(i) Upon the direct request of the protected [consumer](/usc/15/1681a.md?p=c)’s representative.

(ii) Upon the direct request of the protected [consumer](/usc/15/1681a.md?p=c), if the protected [consumer](/usc/15/1681a.md?p=c) is not under the age of 16 years at the time of the request.

(iii) The [security](/usc/15/1667.md?p=5) freeze was placed due to a material misrepresentation of fact by the protected [consumer](/usc/15/1681a.md?p=c)’s representative.

(B) Notice if removal not by request

If a [consumer reporting agency](/usc/15/1681a.md?p=f) removes a [security](/usc/15/1667.md?p=5) freeze under subparagraph (A)(iii), the [consumer reporting agency](/usc/15/1681a.md?p=f) shall notify the protected [consumer](/usc/15/1681a.md?p=c)’s representative in writing prior to removing the [security](/usc/15/1667.md?p=5) freeze.

(C) Removal of freeze by request

Except as provided in subparagraph (A)(iii), a [security](/usc/15/1667.md?p=5) freeze shall remain in place until a protected [consumer](/usc/15/1681a.md?p=c)’s representative or protected [consumer](/usc/15/1681a.md?p=c) described in subparagraph (A)(ii) directly requests that the [security](/usc/15/1667.md?p=5) freeze be removed. Upon receiving a direct request from the protected [consumer](/usc/15/1681a.md?p=c)’s representative or protected [consumer](/usc/15/1681a.md?p=c) described in subparagraph (A)(ii) that a [consumer reporting agency](/usc/15/1681a.md?p=f) remove a [security](/usc/15/1667.md?p=5) freeze, and upon receiving sufficient proof of identification and sufficient proof of authority, the [consumer reporting agency](/usc/15/1681a.md?p=f) shall, free of charge, remove the [security](/usc/15/1667.md?p=5) freeze not later than—

(i) in the case of a request that is by toll-free telephone or secure electronic means, 1 hour after receiving the request for removal; or

(ii) in the case of a request that is by mail, 3 business days after receiving the request for removal.

(D) Temporary removal of [security](/usc/15/1667.md?p=5) freeze

Upon receiving a direct request from a protected [consumer](/usc/15/1681a.md?p=c) or a protected [consumer](/usc/15/1681a.md?p=c)’s representative under subparagraph (A)(i), if the protected [consumer](/usc/15/1681a.md?p=c) or protected [consumer](/usc/15/1681a.md?p=c)’s representative requests a temporary removal of a [security](/usc/15/1667.md?p=5) freeze, the [consumer reporting agency](/usc/15/1681a.md?p=f) shall, in accordance with subparagraph (C), remove the [security](/usc/15/1667.md?p=5) freeze for the period of time specified by the protected [consumer](/usc/15/1681a.md?p=c) or protected [consumer](/usc/15/1681a.md?p=c)’s representative.

(k) [Credit](/usc/15/1602.md?p=f) monitoring

(1) Definitions

In this subsection:

(A) The term “[active duty military consumer](/usc/15/1681a.md?p=q-1)” includes a member of the National Guard.

(B) The term “National Guard” has the meaning given the term in [section 101(c) of title 10](/usc/10/101.md?p=c).

(2) [Credit](/usc/15/1602.md?p=f) monitoring

A [consumer reporting agency](/usc/15/1681a.md?p=f) described in [section 1681a(p) of this title](/usc/15/1681a.md?p=p) shall provide a free electronic [credit](/usc/15/1602.md?p=f) monitoring service that, at a minimum, notifies a [consumer](/usc/15/1681a.md?p=c) of material additions or modifications to the file of the [consumer](/usc/15/1681a.md?p=c) at the [consumer reporting agency](/usc/15/1681a.md?p=f) to any [consumer](/usc/15/1681a.md?p=c) who provides to the [consumer reporting agency](/usc/15/1681a.md?p=f)—

(A) appropriate proof that the [consumer](/usc/15/1681a.md?p=c) is an [active duty military consumer](/usc/15/1681a.md?p=q-1); and

(B) contact information of the [consumer](/usc/15/1681a.md?p=c).

(3) Rulemaking

Not later than 1 year after May 24, 2018, the Federal Trade [Commission](/usc/15/1602.md?p=dd-1) shall promulgate regulations regarding the requirements of this subsection, which shall at a minimum include—

(A) a definition of an electronic [credit](/usc/15/1602.md?p=f) monitoring service and material additions or modifications to the file of a [consumer](/usc/15/1681a.md?p=c); and

(B) what constitutes appropriate proof.

(4) Applicability

(A) Sections [1681n](/usc/15/1681n.md) and [1681o](/usc/15/1681o.md) of this title shall not apply to any violation of this subsection.

(B) This subsection shall be enforced exclusively under [section 1681s of this title](/usc/15/1681s.md) by the Federal agencies and Federal and [State](/usc/15/1602.md?p=s) officials identified in that section.


## Footnotes

[^1]: See References in Text note below.

## Source credit

(Pub. L. 90–321, title VI, § 605A, as added Pub. L. 108–159, title I, § 112(a), Dec. 4, 2003, 117 Stat. 1955; amended Pub. L. 111–203, title X, § 1088(a)(2)(C), July 21, 2010, 124 Stat. 2087; Pub. L. 115–174, title III, §§ 301(a), 302(d)(1), May 24, 2018, 132 Stat. 1326, 1334.)

## Notes

### Editorial Notes

### References in Text

Section 1602(i) of this title, referred to in subsec. (h), was redesignated section 1602(j) of this title by Pub. L. 111–203, title X, § 1100A(1)(A), July 21, 2010, 124 Stat. 2107.

The Social Security Act, referred to in subsec. (i)(4)(C), is act Aug. 14, 1935, ch. 531, 49 Stat. 620. Part D of title IV of the Act is classified generally to part D (§ 651 et seq.) of subchapter IV of chapter 7 of Title 42, The Public Health and Welfare. For complete classification of this Act to the Code, see section 1305 of Title 42 and Tables.

### Amendments

2018—Subsec. (a)(1)(A). Pub. L. 115–174, § 301(a)(1), substituted “1 year” for “90 days”.

Subsecs. (i), (j). Pub. L. 115–174, § 301(a)(2), added subsecs. (i) and (j).

Subsec. (k). Pub. L. 115–174, § 302(d)(1), added subsec. (k).

2010—Subsecs. (c)(1), (g). Pub. L. 111–203 substituted “the Bureau” for “the Commission”.

### Statutory Notes and Related Subsidiaries

### Effective Date of 2018 Amendment

Pub. L. 115–174, title III, § 301(c), May 24, 2018, 132 Stat. 1332, provided that: “The amendments made by this section [amending this section and section 1681t of this title] shall take effect on the date that is 120 days after the date of enactment of this Act [May 24, 2018].”

Amendment by section 302(d)(1) of Pub. L. 115–174 effective 1 year after May 24, 2018, see section 302(e) of Pub. L. 115–174, set out as a note under section 1681a of this title.

### Effective Date of 2010 Amendment

Amendment by Pub. L. 111–203 effective on the designated transfer date, see section 1100H of Pub. L. 111–203, set out as a note under section 552a of Title 5, Government Organization and Employees.

### Effective Date

Section subject to joint regulations establishing effective dates as prescribed by Federal Reserve Board and Federal Trade Commission, except as otherwise provided, see section 3 of Pub. L. 108–159, set out as an Effective Date of 2003 Amendment note under section 1681 of this title.

### Regulations

Pub. L. 108–159, title I, § 112(b), Dec. 4, 2003, 117 Stat. 1959, as amended by Pub. L. 111–203, title X, § 1088(b)(1), July 21, 2010, 124 Stat. 2092, provided that: “The Bureau shall prescribe regulations to define what constitutes appropriate proof of identity for purposes of sections 605A , 605B, and 609(a)(1) of the Fair Credit Reporting Act [15 U.S.C. 1681c–1, 1681c–2, 1681g(a)(1)], as amended by this Act.”

### Public Campaign To Prevent Identity Theft

Pub. L. 108–159, title I, § 151(b), Dec. 4, 2003, 117 Stat. 1964, provided that: “Not later than 2 years after the date of enactment of this Act [Dec. 4, 2003], the Commission shall establish and implement a media and distribution campaign to teach the public how to prevent identity theft. Such campaign shall include existing Commission education materials, as well as radio, television, and print public service announcements, video cassettes, interactive digital video discs (DVD’s) or compact audio discs (CD’s), and Internet resources.”

[For definitions of terms used in section 151(b) of Pub. L. 108–159, set out above, see section 2 of Pub. L. 108–159, set out as a Definitions note under section 1681 of this title.]