Originally Published in the Quarterly Report of The Conference on Consumer Finance Law (June 2022).

Introduction

The Fair Credit Reporting Act (FCRA) was enacted to promote the accuracy, fairness, and privacy of information maintained by Consumer Reporting Agencies (CRAs).[1]  In addition to imposing duties on the CRAs, it requires furnishers of information to provide accurate and complete information to the CRAs and to investigate any consumer disputes regarding the accuracy of that information.[2]  Increased claims of identity theft by consumers have given rise to more disputes that accounts are not accurately being reported as belonging to those consumers.  These “identity theft” disputes put furnishers in a difficult position.  In order to investigate and respond to these disputes, furnishers must determine whether or not the consumer opened the account, and correspondingly, whether or not to change the reporting on it.

1. Investigating a FCRA Identity Theft

In order to maintain a claim against a furnisher under the FCRA, a consumer must first dispute the reporting on the account to one or more of the credit reporting agencies, the most prominent of which include Equifax, Experian, and Trans Union.[3]  The CRAs are required to transmit the dispute to the furnisher, typically in the form of an Automated Credit Dispute Verification form (ACDV).[4]  If the consumer does not dispute the reporting to the CRA, or if the CRA for some reason does not transmit the dispute to the furnisher, then the furnisher cannot be held liable under the FCRA, regardless of whether or not the reporting is inaccurate.[5]

Upon receiving a dispute from a CRA, the furnisher must conduct a reasonable investigation into the disputed information; “review all relevant information provided by the [CRA]” in connection with the dispute; and “report the results of the investigation to the [CRA] . . . .”[6]  The furnisher must either verify the information as accurate, or if the investigation reveals that the disputed information is “inaccurate or incomplete or cannot be verified,” the furnisher must promptly modify, delete, or “permanently block the reporting of” the information to the CRA.[7]

An investigation of the disputed information “requires some degree of careful inquiry by furnishers of information.”[8]  Importantly, however, what constitutes a reasonable investigation of an identity theft dispute “will vary depending on the circumstances of the case” and “in part on the status of the furnisher—as an original creditor, a collection agency collecting on behalf of the original creditor, a debt buyer, or a down-the-line buyer—and on the quality of documentation available to the furnisher.”[9]  The closer the furnisher is to the original transaction, the more information the furnisher is expected to possess or be able to access to investigate the dispute.  Merely reviewing an internal data file is not sufficient.[10]  If the account level documents are no longer available due to a document retention policy, the Fourth Circuit has held that the furnisher, as the originator of the account, should have “at least informed the credit reporting agencies that [it] could not conclusively verify” the disputed information.[11]

Importantly, however, the information provided in the dispute from the CRA also dictates the level of investigation required.  For example, the Ninth Circuit has held that where the CRA’s notice only stated that there were “fraudulent transactions” but failed to describe them in detail or allege identity theft, the furnisher could not reasonably have been expected to investigate a dispute claiming identity theft.[12]  Similarly, where a consumer disputed an account for identity theft with a CRA, but the CRA’s notice to the furnisher omitted any references to identity theft, the Seventh Circuit held that the furnisher’s investigation was reasonable where it reviewed the internal documents to determine that the personal information on the account was accurate.[13]  However, the court also noted that had the CRA notified the furnisher of the fraud, “then perhaps a more thorough investigation would have been warranted.”[14]

The Ninth Circuit has also held where no new information is provided with a subsequent dispute of an account and there is no indication that the original investigation was inadequate, the furnisher can rely upon its original investigation in responding to the dispute.[15]  The court further held that the requirement to conduct an investigation is procedural and is “not necessarily unreasonable because it results in a substantive conclusion unfavorable to the consumer, even if that conclusion turns out to be inaccurate.”[16]

Courts typically leave the determination of the reasonableness of an investigation to a jury, but courts will decide the issue on a summary judgment motion if there is sufficient evidence.[17]  Importantly, the FCRA is not a strict liability statute, and the consumer has the burden of establishing that the investigation was unreasonable.[18]  In determining the reasonableness of an investigation, among the primary factors courts consider are the amount of time spent on the investigation, whether or not the furnisher contacted the individual directly during the investigation, and whether the furnisher had sufficient information to suspect that the identity theft claim was legitimate.[19]  It’s worth noting, however, that furnishers can only investigate information that was available at the time of the investigation, so evidence provided by the consumer after the fact should not be considered in determining the reasonableness of the investigation, and the furnisher should move to strike any such evidence from consideration.

Because reasonableness is largely a question of fact, the more a furnisher does to investigate a dispute, the better positioned it will be to defend its investigation.  The furnisher should not conduct a conclusory investigation taking little to no time or effort.  Rather, the furnisher must at least review the account level documentation to which it has access and attempt to contact the consumer.  Moreover, the furnisher should train its employees who are conducting investigations about the factors to consider as set forth above, and to the extent possible, the factors set forth in more detail below.

1. Defending a FCRA Identity Theft Case Based on Accuracy of the Information

Aside from defending a FCRA identity theft claim based upon the reasonableness of the investigation, another avenue for defending the case arises from the requirement that the consumer establish the inaccuracy of the reported information.[20]  If the consumer cannot fulfill that burden, either because the furnisher can show that the account does in fact belong to the consumer or at least present enough evidence to bring the question into doubt, the furnisher can potentially prevail on a FCRA identity theft claim.[21]  The furnisher is not limited to the information the furnisher reviewed in connection with the investigation in order to prevail on this defense because at issue in the defense is not the furnisher’s actions in making its determination but whether the consumer can show that the account does not actually belong to him or her, thereby rendering the reporting inaccurate.

In pursuing this defense, the first step is to check the Personal Identifying Information (PII) of the consumer in the furnisher’s files, such as the consumer’s name, address, Social Security number, and telephone numbers.  If that information is correct, then it shows that the furnisher at least had the correct information for the consumer.  Conversely, if any of the PII is incorrect, it could be a red flag that the identity theft claim is legitimate and the reporting is inaccurate.  In addition, if the consumer provided additional information in the application, such as monthly income or housing expense, and that information proves to be correct, it will help establish that the account belongs to the consumer because that type of information is more difficult for a fraudster to obtain.

Furthermore, if the application includes a confirmed address for the consumer and documents or other items, such as a credit card or monthly statements, were sent to the address, then the consumer likely received those items.  If the consumer did not dispute the account upon receipt of them, it could indicate the account belongs to the consumer.  With regard to credit cards, if the card was delivered to the correct address and the card was then used to make purchases then the account likely belongs to the consumer, unless the fraudster intercepted the credit card after it was delivered, which would be difficult to do, essentially requiring the fraudster to monitor the consumer’s mail delivery in order to commandeer the card.

If the consumer submitted a signed application to open the account, the furnisher should consider obtaining other examples of signatures by the consumer to determine whether or not the signatures match.  If they do match, the account undoubtedly belongs to the consumer.  If the application was submitted in person and the furnisher used cameras to document the transaction, the furnisher should check the photographs or video of the transaction to determine whether or not the applicant is the consumer.  Correspondingly, in-person applications often require photographic identification and, if there is a copy of the identification card in the file, the determination as to whether or not the consumer submitted the application becomes much easier.

With claims involving credit card accounts, information regarding specific charges on the account should also be analyzed.  If a merchant cooperates with the furnisher’s inquiry and provides evidence that the charge was in fact incurred by the consumer, such as a signed receipt that matches a known signature of the consumer, then the furnisher can reasonably conclude that the consumer did in fact incur the charge and that the account belongs to the consumer.  If there is something unusual about the charges, such as purchases at geographically remote locations from where the consumer resides, then that brings into question whether or not the account is legitimate.

An additional factor to consider is whether or not the consumer submitted a police report in connection with the alleged identity theft.  If the consumer did not do so, it could indicate the account belongs to the consumer, for it is difficult to support a claim of identity theft without reporting it to the police.  Conversely, if the consumer did submit a police report and the police concluded identity theft occurred, the furnisher will have a more difficult time contending the account is legitimate, particularly if the thief has been identified.

If the consumer disputed the account on multiple occasions, a key question will be whether the consumer was consistent in those disputes.  Self-evidently, if the consumer submitted different claims about what happened, then the claims are likely untruthful.  Also important is whether or not the consumer informed the furnisher directly, independent of the CRAs, that the account did not belong to the consumer, particularly if the furnisher originated the account.  If the first notice a furnisher receives about identity theft is a dispute from a CRA, then the furnisher is entitled to question whether or not that dispute is legitimate.  Correspondingly, if the furnisher attempted to contact the consumer in an effort to determine the basis for the consumer’s contention that the account was fraudulently opened and the consumer did not respond or refused to cooperate with the furnisher, then that also brings into question the veracity of the consumer.

In addition, a red flag arises when payments were made on the account, which indicates the account belongs to the consumer because fraudsters typically do not make payments after opening an account.  If an initial invalid payment was tendered followed by no further payments, it could indicate a fraudster at work, particularly if a request is also made for a credit line increase.  Moreover, if the consumer only recently went into default on the account, it could indicate the consumer is looking for a way to escape the debt.

Furnishers typically keep records of their communications with consumers, often in the form of internal memos.  When that documentation exists, the furnisher should check whether the consumer has communicated with the furnisher from a telephone number that belongs to the consumer.  If so, and the consumer doesn’t dispute the validity of the account during those conversations, then it hurts the consumer’s claim that the account doesn’t belong to him or her.  Alternatively, if the consumer disputes certain charges on the account but not the validity of the account itself, it can be deemed an implicit admission that the account belongs to the consumer.  The account notes should also be checked for telephone numbers from any inbound calls or those provided by the purported accounted holder, to see if they tie back to the consumer.  In addition, any addresses or email addresses provided by the account holder should be researched to see if they tie back to the consumer.

Finally, furnishers often keep recordings of conversations with consumers, and if such recordings exist, they should be examined to determine whether or not the recording is of the consumer.  If so, it will be difficult for the consumer to dispute any admissions made during those conversations, particularly if the consumer never disputed the validity of the account.

Engaging in this type of in-depth fact finding is not required to render an investigation reasonable (though it would certainly do so), but it can later be used to defend the lawsuit by establishing or at least bringing into question the consumer’s claim that the account is fraudulent.

• General Strategies for Defending a FCRA Identity Theft Claim

If and when the consumer files an action against the furnisher, the furnisher should ensure that the case is litigated in the proper forum.  If the consumer filed the action in state court, the furnisher should remove it to federal court based on federal question jurisdiction because federal courts are normally better equipped to adjudicate cases under the FCRA.  In addition, most originators of accounts include an arbitration agreement in their account documents, but it is difficult to compel arbitration of identity theft claims given the consumer’s contention that he or she did not enter into the account agreement.

The furnisher should also determine whether the statute of limitations bars the claim.  The statutory period under the FCRA is two years after discovery of the alleged violation, or five years after the alleged violation occurred.[22]  For furnishers, the five year statute begins to run when it receives the dispute, and the two year statute commences when the consumer knew or reasonably should have known that the investigation was complete, typically upon receiving notice of the results of the investigation.[23]  Thus, the five year statute rarely comes into play, as long as the furnisher responds to the dispute, but the two year statute is relatively short and should be analyzed.

It should be noted, however, that courts are split on whether a new dispute refreshes the statute of limitations.  No federal circuit courts have addressed the issue, but some district courts have held that the entire limitations period restarts with each dispute, even if it relates to the same credit report or same information on subsequent reports.[24]  Other districts have held, however, that the limitations period runs from the first dispute and investigation regarding the disputed information because otherwise it would “allow plaintiffs to indefinitely extend the limitations period and render it a nullity.”[25]  Alternatively, at least one district court has held that the limitations period can restart for a new dispute on the same reported information, but only if it is based on new information that the plaintiff discovers much later.[26]

Damages are also critical to a FCRA identity theft claim.  For a negligent violation, a consumer can recover actual damages, plus attorney’s fees.[27]  Actual damages can be difficult to prove, and most often involve claims of loss of credit due to the reporting, or emotional distress suffered by the consumer.  However, if the consumer has not been denied credit since the reporting on the account, or already had a bad credit rating, that aspect of the actual damages is more difficult to prove.  Similarly, recovery of damages for emotional distress typically requires some type of compelling evidence, such as medical records or evidence of counseling, not just conclusory testimony, so it too is difficult to establish.[28]

For a willful violation, which requires a finding that the furnisher knowingly or recklessly violated the statute, the consumer can recover either actual damages or statutory damages between $100 to $1,000, plus punitive damages and attorney’s fees.[29]  Punitive damages should be difficult to recover in identity theft cases because the furnisher is itself a victim of the fraud.[30]  If the court determines that punitive damages are warranted, the court will consider the ratio of compensatory damages to punitive damages, as well as the degree of reprehensibility of the furnisher’s actions.[31]

Given the availability of attorney’s fees for a prevailing plaintiff, which is often the driving force behind claims under the FCRA, the prospect of defending a case in the face of mounting attorney’s fees by plaintiff’s counsel can be daunting.  As a result, if the furnisher believes it has no other viable defense and the trier of fact will likely determine that its investigation of the dispute was not reasonable, then the furnisher should consider making an offer of judgment, which can potentially cut off the right to attorney’s fees for the plaintiff’s counsel.

Conclusion

With the increasing number of FCRA identity theft claims, furnishers must be aware of their responsibilities under the statute, and in particular, investigate the dispute as thoroughly as reasonably possible.  If the furnisher verifies the reporting as accurate to the CRA, and the consumer files suit, the furnisher and its counsel should conduct an intensive review of the facts to determine whether or not the account does in fact belong to the consumer.  The reasonableness of the investigation and whether the consumer can establish that the account did not belong to the consumer will be critical to defending the lawsuit.

[1] 15 U.S.C. § 1681.

[2] Id. § 1681s-2.

[3] Id. § 1681i(a)(1).

[4] Id. § 1681i(a)(2).

[5] Id. § 1681s-2(c)(1).

[6] Id. § 1681s-2(b)(1).

[7] Id. § 1681s-2(b)(1)(E).

[8] Hinkle v. Midland Credit Mgmt., Inc., 827 F.3d 1295, 1303 (11th Cir. 2016).

[9] Id. at 1302 (distinguishing the reasonability of an investigation by a down-the-line buyer from that of an original furnisher); see also Johnson v. MBNA Am. Bank, NA, 357 F.3d 426, 431–32 (4th Cir. 2004) (assessing evidence to determine whether an investigation of a consumer’s dispute was reasonable).

[10] See Johnson, 357 F.3d at 431 (finding a jury could reasonably conclude an investigation, comprised only of reviewing information in a data file, was unreasonable).

[11] Id. at 432.

[12] Gorman v. Wolpoff & Abramson, LLP, 584 F.3d 1147, 1159 (9th Cir. 2009).

[13] Westra v. Credit Control of Pinellas, 409 F.3d 825, 827 (7th Cir. 2005).

[14] Id.

[15] Gorman, 584 F.3d at 1160.

[16] Id. at 1161.

[17] See Wood v. Credit One Bank, 277 F. Supp. 3d 821, 851 (E.D. Va. 2017) (granting summary judgment where no genuine issue about the reasonableness of the investigation exists); see also Hudson v. Babilonia, 192 F. Supp. 3d 274, 301 (D. Conn. 2016) (noting summary judgment is appropriate where the reasonableness of the instigation is “beyond question”).

[18] Gorman, 584 F.3d at 1157.

[19] See Wood, 277 F. Supp. 3d at 852;  see also Hudson, 192 F. Supp. 3d at 302.

[20] See Felts v. Wells Fargo Bank, N.A., 893 F.3d 1305, 1313 (11th Cir. 2018) (“[A] plaintiff asserting a claim against a furnisher for failure to conduct a reasonable investigation cannot prevail on the claim without demonstrating that had the furnisher conducted a reasonable investigation, the result would have been different; i.e., . . . that the information it reported was inaccurate or incomplete . . . .”).

[21] See id.

[22] 15 U.S.C. § 1681p.

[23] Id. § 1681p(2).

[24] See, e.g., Young v. LVNV Funding LLC, No. 4:12CV01180 AGF, 2013 WL 4551722, at *3 (E.D. Mo. Aug. 28, 2013) (“[E]ach re-report of inaccurate information, and each failure to conduct a reasonable investigation in response to a dispute, is a separate FCRA violation subject to its own statute of limitations.”).

[25] Blackwell v. Capital One Bank, No. 606CV066, 2008 WL 793476, at *3 (S.D. Ga. Mar. 25, 2008).

[26] Anderson v. Equifax Info. Services LLC, 292 F. Supp. 3d 1211, 1219 (D. Kan. 2017) (allowing Plaintiff to “amend as to the timeliness” of her claims because “Plaintiff disputed her account in 2015 on the basis of new information that was brought to her attention when she refinanced her mortgage”).

[27] 15 U.S.C. § 1681o.

[28] See Sloane v. Equifax Info. Servs., LLC, 510 F.3d 495, 503-04 (4th Cir. 2007) (“[A]lthough specifically recognizing that a plaintiff’s testimony can provide sufficient evidence to support an emotional distress award, we have required a plaintiff to ‘reasonably and sufficiently explain the circumstances of [the] injury and not resort to mere conclusory statements.’”);  see also Pinner v. Schmidt, 805 F.2d 1258, 1265–66 (5th Cir. 1986) (remitting damages to $25,000 where plaintiff produced no evidence of monetary damages and only testified claiming embarrassment, humiliation, and “deep emotional distress”).

[29] 15 U.S.C. § 1681n(a)(1)(A)–(2).

[30] See, e.g., Bach v. First Union Nat’l Bank, 149 F. App’x 354, 364–66 (6th Cir. 2005) (reversing and remanding an award of punitive damages in a FCRA identity theft case where there was no evidence of “intentional malice, trickery, or deceit” by the furnisher).

[31] Id.; see also Williams v. First Advantage LNS Screening Sols. Inc., 947 F.3d 735, 754–55 (11th Cir. 2020) (determining first that the defendant’s conduct was sufficiently reprehensible to justify punitive damages before engaging in an analysis of the ratio of punitive damages to actual damages to determine whether the defendant’s constitutional rights were violated).