Kim Phan and Dave Gettings bring you the latest updates from the regulatory and litigation sides of the house.
In this episode of FCRA Focus, hosts Kim Phan and Dave Gettings bring you the latest updates from the regulatory and litigation sides of the house. Dave shares his insights on the challenges and litigation surrounding identity theft investigations, offering practical tips for furnishers to navigate these complex issues. Kim provides an overview of the Consumer Financial Protection Bureau's renewed supervision efforts and what it means for Fair Credit Reporting Act compliance. Tune in for an engaging discussion filled with valuable information and practical advice.
FCRA Focus — The Next FCRA Frontier: Identity Theft and CFPB Updates
Hosts: Kim Phan and Dave Gettings
Date Aired: April 29, 2025
Kim Phan:
Welcome back to the FCRA Focus podcast of Troutman Pepper Locke. Today you're going to be hearing from myself, Kim Phan, and my co-host Dave Gettings. We seldom do a show together, so I think you're in for a real treat today. I will be giving some updates from the regulatory side of the house. All things CFPB and what's happening there. Dave will come in with some of his thoughts on some of the recent litigation, specifically with regard to identity theft, which I understand is keeping him up at night.
Dave Gettings:
Keeping me up at night, Kim.
Kim Phan:
I am sorry to hear that. But before we jump into that discussion, let me remind our audience to come and visit and subscribe to our blogs, TroutmanFinancialServices.com and ConsumerFinancialServicesLawMonitor.com. And while you're at it, head on over to Troutman.com and add yourself to our Consumer Financial Services email list that allow you to get invitations to our webinars, receive our alerts and advisories that we send out from time to time, and hear about the latest updates from our various consumer financial services podcasts.
And if you can't get enough of FCRA, I'd like to encourage you to explore our subscription-based tracker service, which provides information on federal and state regulatory and legislative developments, as well as summaries of FCRA case law on a weekly basis. And it also includes a monthly roundtable led by either Stefanie Jackman or myself as the host of those roundtable discussions. These tracker services can also cover other topics including debt collection and privacy and data security. But enough about the many other sources that we make available to our listeners. We're here today on FCRA Focus, just me, Dave, and you, let's get into it. Dave, you want to start out talking about some of these things that unfortunately are keeping you up at night?
Dave Gettings:
Yeah, of course. Kim, you do that intro a lot better than I do, so I'm going to start taking notes on how you do the intro. I think about this as the My Cousin Vinny episode of the podcast. Kim, have you seen My Cousin Vinny?
Kim Phan:
Who has not, in the legal profession?
Dave Gettings:
One of my favorite movies. And there's this scene in My Cousin Vinny where he doesn't have an examination of the sheriff prepared. He just gets him up on stage and he is like, "So tell me what you got." That's how you opened this one. To just look at me and say, "Tell me what you got." Right?
Kim Phan:
Hopefully, you have something as useful as the sheriff did at the end of My Cousin Vinny.
Dave Gettings:
No, I will not be talking about two gentlemen picked up with a .457 revolver or whatever it was, .357 revolver. Oh boy, we need to delete this.
Kim Phan:
In a civilly colored vehicle.
Dave Gettings:
Buick Skylark. It was a Buick Skylark. Okay, so no, what I wanted to talk about today is identity theft investigations, specifically from the furnisher side because they are keeping me up at night. We have been seeing a lot of claims for ID theft investigations or reasonable investigations. They have become very expensive to settle with demands often starting in the six figures. And on the flip side, they have become very expensive to litigate given the work that's involved in attempting to prove the reporting is accurate and the investigation is reasonable. So, I thought it would be good to maybe give some helpful tips on what we've seen in litigation, what's worked, what's been efficient, and ultimately slogging through these ID theft investigations. Does that make sense?
Kim Phan:
Dave, let me just ask you. To prevent all that litigation, and I'm thinking of this from a regulatory compliance perspective, what I advise my clients is block, block, block. Just block everything. The FCRA obligations with regard to identity theft are so strict and unforgiving. They're inflexible with regard to what the obligation is. And the only really avenue for furnishers to start re-reporting on a trade line that is alleged to be identity theft is if they know that the consumer is fraudulently claiming identity theft. And that's a pretty high standard. I'm imagining that would have to be a video of the consumer walking into a brick and mortar store, video of them actually signing the application, producing the evidence of that actual assigned application to establish a knowing that the consumer is fraudulently claiming identity theft. Dave, is that what you're seeing in your litigation? Otherwise, I would just say block everything.
Dave Gettings:
It makes a difference. So certainly blocking is the safest approach, but we do see, for some of our furnisher clients, people alleging ID theft in order to get out of a valid debt. So the more that happens and the more it creates losses for the clients, the more it becomes unpalatable to just block automatically as a blanket rule. The other issue, Kim, and I guess I should have looked this up before the podcast, there's a different framework if the consumer's making a block request versus a just normal 1681i or STB dispute. The block request has specific requirements for when you have to block and then when you can reinsert versus a normal dispute where someone's claiming ID theft that might not meet the requirements of a block request, but you still have to conduct a reasonable investigation nonetheless. Do you see that distinction in your practice at all on the regulatory side?
Kim Phan:
I do, but again, my recommendation is generally because this gets very complicated very quickly, and the reality is a lot of customer service agents are not going to be able to make those types of distinctions on a timely basis given the very short windows of time companies have to respond to these claims of identity theft. If there's even a hint of identity theft, generally I'm going to recommend, for ease of administration and operationalizing, a process that provides a little bit more certainty in this area, an automatic block, again, with even the hint of identity theft. And I appreciate that that has business implications as we see increasing numbers of folks attempting to allege these identity theft claims. But whether or not the consumer reaches out to the company directly with the claim of identity theft or maybe they submit an indirect dispute through the consumer reporting agencies. Again, if there's an indicator of identity theft, for ease of administration, it might make sense just to block.
Dave Gettings:
Yeah, I certainly think for ease of administration. And that's going to get in a little bit to some of the hurdles we see in litigation if it gets there regarding ID theft investigation. So, in terms of lessons learned and what will help both furnishers and CRAs, if you're in a situation of having to defend your reasonable investigation, the first thing I'd recommend is documenting the steps you took in the initial investigation. It is so much more compelling in litigation to be able to point to, assuming you did a good reasonable investigation, to be able to point to what documents the investigator looked at and what they gleaned from those documents during the investigation. And also who the investigator talked to, if anyone, and what they gleaned from that conversation during the investigation. So that's step one. That's the basic blocking and tackling of what would help in defending these ID theft claims.
And it seems like very low-hanging fruit, but you'd be surprised sometimes how investigations aren't documented. And the second corollary to that is to make sure, in the investigation, you are considering each of the documents, if any, that the consumer submitted with the dispute. Sometimes you don't get documents. If you're a furnisher, sometimes you don't get images. But there's a general theme in these cases that the plaintiff's counsel always say the furnisher or the CRA should have done more. No matter what they did, they should have done more. So, a really good first or second step is to definitely make sure you're considering everything the consumer provided in the dispute. If they're providing receipts, if they're providing a police report, if they're providing an FTC identity theft affidavit, make sure you've considered it and make sure it's documented in the process. So Kim, that's steps one and two. Before I keep going, any questions or comments so far?
Kim Phan:
The only thing that I will say is you noted that you might feel surprised that some furnishers are not adequately documenting some of their processes. I was not surprised when you said that, Dave. And I 100% agree with your recommendation on that.
Dave Gettings:
Good, we're on the same page. And the sheriff's testimony is going okay. All right. So the next big one, which we see furnishers doing more and more of, is making sure you're leveraging the internal information that you have available to you. So for example, if you're a bank or if you're a credit union, and this happens a lot for them, were the purchases that are allegedly either fraudulent or subject to account takeover, were they part of a consistent pattern before and after the ID theft? Was the transaction a card transaction that required a chip? And was the consumer in possession of the chip at the time? Were there complaints from the consumer that he or she lost the card? Were the transactions online and did the consumer have any password resets? Effectively, were they online and can we prove that the consumer still had access to the account password and account login?
Did the money from the disputed transaction go to another account in the consumer's name? So if it's a credit card, for example, was the cash advance to an account that's a checking account or a savings account in the consumer's name. These are all items of information that, depending on the furnisher, they may have available to themselves internally that they can use to pressure test their investigation. Continuing on that, for example, are there non-disputed transactions at or after the time of the disputed transaction? So if you're disputing one transaction, but then you are admittedly conducting another transaction two days later, that may be more likely that you actually conducted the disputed transaction. And then continuing on outside the basic details of the transactions. For example, if this is a personal loan or a credit card, what documents did you collect at the account opening? Did you get a passport and driver's license and pay stub or a lease, a W-2?
The more documents you got at the time of account opening that were verified or verifiable may help or frankly may hurt your case of a reasonable investigation because it can point to or point away from fraud. And then the last thing I'll add for the internal documents is consider pulling call recordings if you've got them, if you're that type of institution. There've been a lot of ID theft cases where we've pulled recordings and you've got the consumer, the same consumer making the dispute, talking about the account before the disputed transactions and after the disputed transactions, which may, in certain instances, suggest the transactions weren't fraudulent. So again, Kim, that's number three on my list. I've got five, but I'm going to pause again to see if you've got any questions.
Kim Phan:
Quick question about that, Dave. As a process person, I want to make sure that to fully document on the back-end, it's important to have processes in the front-end to help make all of this happen. Would you recommend that companies methodically think about every possible location within their corporate environment where helpful data could reside and list this so that their dispute agents can work their way essentially through a checklist, to try to work through all of these? Or do you think that relying on folks' common sense is enough?
Dave Gettings:
It's a double-edged sword. I always like having checklists because it helps facilitate the investigation and helps make sure investigators are following a rigorous process. The downside is if they don't follow the process and you've got the checklist and then the consumer's counsel can point to glaring omissions where people did not follow the checklist that lays out the reasonable investigation. So if you can police the ability to follow the checklist, then I think it's certainly valuable to have a checklist. If there's genuine concern in your organization that it's not going to be followed, then it's sometimes better to have a little bit vaguer policy that you can just fill in the blank if you ever get in litigation.
Kim Phan:
Makes sense.
Dave Gettings:
So moving on to number four. Something we've seen a lot of is don't forget to consider family members. There's a lot of instances where if it is arguably not the consumer who processed a transaction, it was a family member who the consumer either gave account access or provided their passport or driver's license to. There's all sorts of innumerable situations. But it's really important to consider whether a family member using the account is an option because we do see it an awful lot. And then the fifth thing I would say is do not be afraid to use third parties in your investigation and certainly in your subsequent litigation. A lot of consumer's councils say that in an investigation you have to contact third parties. I don't think the language in the statute requires a furnisher or a CRA to contact third parties necessarily. I think you can conduct a reasonable investigation in situations without that. But it certainly doesn't hurt.
So if there's other merchants you can reach out to try to trace down transactions, the gold standard is always an airline ticket. Did the person buy an airline ticket? Whose name was that airline ticket in? What accounts was the money transferred to, if that's applicable? And whose name are those accounts in? Really the lesson is, both during the investigation and during the subsequent litigation, do not be afraid to reach out to third parties to either bolster your investigation or to find your investigation has holes and maybe you need to reach a different conclusion. So Kim, that's my soap box of what's kept me up recently in FCRA identity theft litigation.
Kim Phan:
And it's a good segue way actually to what's going on with the CFPB, which, hot off the presses, have started up their supervision again. The CFPB, as we all know, has been going through quite a bit of flux, up and down with regard to who's still there, what can they do if they are there. And there is a judicial order now in place that requires that the CFPB leadership not stop CFPB staff for moving forward with statutorily required activity, which includes supervision. So we've seen that there was a recent memo that just came out from CFPB leadership indicating that supervision will start up again and that they're going to focus on specific consumer harms without being what they characterize as overly burdensome to industry with and list series of exams. And one of those areas is with regard to FCRA and furnisher obligations. So Dave, what you were talking about with regard to identity theft is just one thing that companies need to be thinking about shoring up with regard to their FCRA compliance.
They need to be thinking about all of their furnisher obligations and how they could ensure that they are fully compliant should the CFPB come knocking on their door. And the CFPB, while we're seeing that they are going to be starting up supervision again, I think we're still a little bit away from the CFPB starting any rulemaking in the FCRA area again, or enforcement. I think we know that the data broker proposed rule was pretty much dead in the water in its current form. Though interestingly, McKernan, at the time that he had his confirmation hearing before the Senate Banking Committee, indicated that he did support Chopra's efforts to do something about the mass collection of consumer information, whether or not with data brokers or data aggregators. The coerced debt rule, which also touches on identity theft, expanding the definition of identity theft to individuals who did use their actual name to open new trade lines or take out new credit, but with the reality that they may have been coerced into engaging in that activity by an abuser.
Unclear where that one is going, if anywhere at all. And the medical debt rule, while finalized, is subject to a Congressional Review Act challenge as well as other litigation in court. So all of that to say that the CFPB is unlikely to move forward with any specific action until they figure out what they're going to be doing with some of those outstanding FCRA rules. And as far as FCRA litigation, we already saw that the CFPB withdrew their litigation against TransUnion and the alleged practice of digital dark patterns that TransUnion was engaged in as well as some other activities that are happening on the enforcement front. Again, I think we'll see a pullback from the CFPB in those areas. Dave, anything that you're hearing amongst your clients with regard to not just litigation, but how they're thinking about their interactions with the CFPB right now?
Dave Gettings:
We've had to question a little bit about whether they think they can push the envelope in certain aspects because the CFPB is less likely to be heavy-handed on enforcement. But what we keep coming back to there is, even if the CFPB does take a lighter touch in enforcement, I think the state AGs are really going to fill the gap. Generally speaking, while one regulator may step back, I think there's a genuine concern that state regulators are going to increase their enforcement.
Kim Phan:
Yeah, and whether or not the CFPB continues as an agency, and I think the broad consensus is that it will continue in some form or another. The FCRA is one of those statutes that can be enforced by just about everybody. So the Federal Trade Commission, the other Prudential financial regulators on a federal level, the State Attorney General, in certain provisions, consumers can bring private rights of action. It's just not a statute that I would ever think that businesses should think about taking their compliance obligations lightly.
Dave Gettings:
Totally agree. So Kim, you did the intro. Should I do the outro since we're co-hosting this podcast?
Kim Phan:
I believe that you should, Dave.
Dave Gettings:
Your intro was way better than mine, so I'm going to crib it for my outro.
Kim Phan:
I'm waiting to hear what you do for your outro. I'm waiting with bated breath.
Dave Gettings:
I'm going to deepen my voice. We'd like to thank everybody for listening to today's podcast. And again, what Kim said on the intro, don't forget to visit our blogs ConsumerFinancialServicesLawMonitor.com and TroutmanFinancialServices.com. And please also subscribe to the podcast at all your favorite podcasting channels. How's that?
Kim Phan:
I love it.
Dave Gettings:
Love it?
Kim Phan:
And make sure to leave us glowing reviews so that others will listen into the FCRA Focus and hear our insights. Whether or not they're as good as the sheriff in My Cousin Vinny is for you to decide.
Dave Gettings:
And if you haven't seen My Cousin Vinny, go watch the movie. I watched it with my kids. I'm not sure that was the best advice from a dad, but they loved it. So go watch it. Thanks everybody.
Copyright, Troutman Pepper Locke LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper Locke. If you have any questions, please contact us at troutman.com.