[Federal Register Volume 89, Number 87 (Friday, May 3, 2024)]
[Notices]
[Pages 36775-36779]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-09712]
=======================================================================
-----------------------------------------------------------------------
CONSUMER FINANCIAL PROTECTION BUREAU
Supervisory Highlights, Issue 32, Spring 2024
AGENCY: Consumer Financial Protection Bureau.
ACTION: Supervisory Highlights.
-----------------------------------------------------------------------
SUMMARY: The Consumer Financial Protection Bureau (CFPB or Bureau) is
issuing its thirty-second edition of Supervisory Highlights.
DATES: The findings in this report cover select examinations in
connection with credit reporting and furnishing that were completed
from April 1, 2023, through December 31, 2023.
FOR FURTHER INFORMATION CONTACT: Jaclyn Sellers, Senior Counsel, at
(202) 435-7449. If you require this document in an alternative
electronic format, please contact [email protected].
SUPPLEMENTARY INFORMATION:
1. Introduction
Credit reporting is critical to consumers' ability to access credit
and other products and services and often is used as a factor in rental
and employment determinations. Accuracy in consumer reports is of vital
importance to the credit reporting system and to consumers. Inaccurate
information on a consumer report can have significant consequences for
consumers and may, among other things, lead them to receive products or
services on less favorable terms or impede their ability to access
credit or open a bank account.
Inaccuracy in the credit reporting system is a long-standing issue
that remains a problem today. Accordingly, the CFPB continues to
prioritize examinations of consumer reporting companies (CRCs) and
furnishers. CRCs are companies that regularly engage in whole or in
part in the practice of assembling or evaluating information about
consumers for the purpose of providing consumer reports to third
parties.\1\ Furnishers are entities, such as banks, loan servicers, and
others, that furnish information to the CRCs for inclusion in consumer
reports.
---------------------------------------------------------------------------
\1\ The term ``consumer reporting company'' as used in this
publication means the same as ``consumer reporting agency,'' as
defined in the Fair Credit Reporting Act, 15 U.S.C. 1681a(f),
including nationwide consumer reporting agencies as defined in 15
U.S.C. 1681a(p) and nationwide specialty consumer reporting agencies
as defined in 15 U.S.C. 1681a(x).
---------------------------------------------------------------------------
CRCs and furnishers play a crucial role in ensuring the accuracy
and integrity of information contained in consumer reports. They also
have an important role in the investigation of consumer disputes
relating to the accuracy of information in consumer reports. The Fair
Credit Reporting Act (FCRA) \2\ and its implementing regulation,
Regulation V,\3\ subject CRCs and furnishers to requirements relating
to their roles in the credit reporting system, including the
requirement to reasonably investigate disputes and certain accuracy-
related requirements. The FCRA and Regulation V also impose obligations
in connection with, among other things, consumer-alleged identity theft
and--most recently--adverse information resulting from human
trafficking including on consumer reports of human-trafficking victims.
---------------------------------------------------------------------------
\2\ 15 U.S.C. 1681 et seq.
\3\ 12 CFR part 1022.
---------------------------------------------------------------------------
In recent reviews of CRCs, examiners have continued to find
deficiencies in CRCs' compliance with the accuracy and identity theft
requirements of the FCRA and Regulation V.\4\ For example, examiners
found some CRCs were engaged in the practice of automatically declining
to implement identity theft blocks upon receipt of the requisite
documentation based on overbroad disqualifying criteria and without an
individualized determination that there is a statutory basis to decline
the block, in violation of the FCRA. Examiners also found some CRCs
violated Regulation V's human trafficking requirements, effective as of
July 25, 2022, by failing to timely block, or in some cases failing to
block all, adverse items of information identified by the consumer as
resulting from human trafficking.
---------------------------------------------------------------------------
\4\ If a supervisory matter is referred to the Office of
Enforcement, Enforcement may cite additional violations based on
these facts or uncover additional information that could impact the
conclusion as to what violations may exist.
---------------------------------------------------------------------------
In recent reviews of furnishers, examiners have continued to find
deficiencies in furnishers' compliance with the accuracy and dispute
investigation requirements of the FCRA and Regulation V. Examiners
found several furnishers violated the FCRA duty to promptly update or
correct information determined to be incomplete or inaccurate,
including, for example, by continuing to report fraudulent accounts to
CRCs as valid (i.e., non-fraudulent) accounts for several years after
determining the accounts were fraudulent. Examiners also found that
some furnishers violated the FCRA, after receiving an identity theft
report from a consumer at the appropriate address, by continuing to
furnish information identified in the report as resulting from identity
theft without the furnishers knowing or being informed by the consumer
that the information was, in fact, correct. The findings in this report
cover select examinations in connection with credit reporting and
furnishing that were completed from April 1, 2023, through December 31,
2023. To maintain the anonymity of the supervised institutions
discussed in Supervisory Highlights, references to institutions
generally are in the plural and related findings may pertain to one or
more institutions.
2. Supervisory Observations
2.1 Consumer Reporting Companies
In recent reviews of CRCs, examiners found deficiencies in CRCs'
compliance with FCRA and Regulation V identity theft block, human
trafficking submission and accuracy requirements.
2.1.1 CRC Duty To Block the Reporting of Information Resulting From an
Alleged Identity Theft
The FCRA requires CRCs to block the reporting of any information in
a consumer's file that the consumer identifies as information that
resulted from an alleged identity theft not later than four business
days after the CRC receives certain documentation relating to the
alleged identity theft. Such documentation includes appropriate proof
of the consumer's identity, a copy of an identity theft report,
identification of the information that resulted from the alleged
identity theft, and a statement by the consumer that such information
[[Page 36776]]
does not relate to any transaction by the consumer.\5\ A CRC may
decline to block, or rescind any block of, information if the CRC
reasonably determines that: the information was blocked in error or a
block was requested by the consumer in error; the information was
blocked, or the block was requested, on the basis of a material
misrepresentation of fact by the consumer relevant to the request to
block; or the consumer obtained possession of goods, services or money
as a result of the blocked transaction(s).\6\
---------------------------------------------------------------------------
\5\ 15 U.S.C. 1681c-2(a); see 15 U.S.C. 1681a(q)(4) and 12 CFR
1022.3(i)(1) (defining ``identity theft report'').
\6\ 15 U.S.C. 1681c-2(c).
---------------------------------------------------------------------------
In recent reviews of CRCs, examiners found that CRCs failed to
timely implement blocks of information after receiving the requisite
documentation relating to an alleged identity theft, without otherwise
making a reasonable determination with respect to one of the statutory
bases for declining to block such information. Examiners found that the
CRCs instead maintained policies pursuant to which the CRCs
automatically declined to block information if the associated
account(s) of the consumer met any one of a set of overbroad
disqualifying criteria that were not sufficiently tailored to support a
reasonable determination regarding any of the statutory declination
bases.
In response to these findings, CRCs were directed to cease the
practice of automatically declining to implement blocks based on
overbroad disqualifying criteria without an individualized
determination that there is a statutory basis to decline. CRCs also
were directed to implement revisions to the CRCs' policies to ensure
compliance with FCRA identity theft block obligations, including any
circumstances in which the CRCs may reasonably request additional
information or documentation to determine the validity of an alleged
identity theft and any circumstances in which there is a valid basis to
decline to block.
2.1.2 CRC Duty To Promptly Notify Consumers After Declining To
Implement, or Rescind, an Identity Block
The FCRA requires CRCs to promptly notify the affected consumer if
the CRC declines to block, or rescinds a block of, information that the
consumer identifies as information resulting from an alleged identity
theft.\7\ CRCs must notify the consumer in the same manner as CRCs are
required to notify consumers of a reinsertion of information into a
consumer's file--i.e., in writing within five business days and by
providing certain information, including the name and address of the
furnisher of the identified information if reasonably available and a
notice that the consumer has the right to add a statement to the
consumer's file disputing the accuracy or completeness of such
information.\8\
---------------------------------------------------------------------------
\7\ 15 U.S.C. 1681c-2(c)(2).
\8\ Id. (referencing the notice requirements of 15 U.S.C.
1681i(a)(5)(B)).
---------------------------------------------------------------------------
In recent reviews of CRCs, examiners found that CRCs failed to
provide the requisite notice within five business days of declining to
block information--in some instances due to system issues and in others
due to human error. Examiners also found that CRCs systematically
failed to timely provide consumers with the relevant furnisher's
contact information and/or notice regarding the consumer's right to add
a statement to the consumer's file disputing the accuracy or
completeness of the furnished information.
In response to these findings, CRCs were directed to revise their
policies to ensure compliance with FCRA identity theft block notice
obligations and update notice templates to include the requisite
information for consumers.
2.1.3 CRC Duty To Provide Victims of Identity Theft With Summaries of
Rights
The FCRA requires CRCs, upon a consumer contacting the CRC and
expressing a belief that they are a victim of fraud or identity theft,
to provide the consumer with a summary of rights containing all of the
information required by the CFPB in its model summary of rights,\9\
along with information about how to request more detailed information
from the CFPB.\10\ In recent reviews of CRCs, examiners found that CRCs
failed to comply with this provision, either by failing to include
required information in summaries of rights or by failing to provide
the summary of rights to eligible consumers entirely.
---------------------------------------------------------------------------
\9\ Consumer Fin. Prot. Bureau, Appendix I to part 1022--Summary
of Consumer Identity Theft Rights, https://www.consumerfinance.gov/rules-policy/regulations/1022/i.
\10\ 15 U.S.C. 1681g(d)(2).
---------------------------------------------------------------------------
In response to these findings, CRCs are updating their systems to
ensure that they provide the required summary of rights.
2.1.4 CRC Duty To Block Adverse Information Resulting From Human
Trafficking
Regulation V requires CRCs to block adverse items of information
identified by a consumer or their representative as resulting from a
severe form of trafficking in persons or sex trafficking, as defined in
the regulation.\11\ CRCs must block such items within four business
days of receiving a consumer's submission, except in limited
circumstances where additional information is necessary to complete the
submission.\12\ In recent reviews of CRCs, examiners found that CRCs
failed to timely block identified adverse items of information within
the applicable four business days. CRCs blocked some but not all items
identified in a qualifying consumer submission and in other instances
failed to implement a block entirely.
---------------------------------------------------------------------------
\11\ 12 CFR 1022.142(c).
\12\ 12 CFR 1022.142(e)(1).
---------------------------------------------------------------------------
In response to these findings, CRCs were directed to revise their
compliance processes to ensure that they process all human trafficking
block requests in accordance with the requirements of Regulation V.
2.1.5 CRC Duty To Follow Reasonable Procedures To Assure Maximum
Possible Accuracy
The FCRA requires that, wherever a CRC ``prepares a consumer report
it shall follow reasonable procedures to assure maximum possible
accuracy of the information concerning the individual about whom the
report relates.'' \13\ In recent reviews of CRCs, examiners found that
CRCs' accuracy procedures failed to comply with this obligation because
the CRCs (1) failed to adequately monitor dispute metrics that would
suggest a furnisher may no longer be a source of reliable, verifiable
information about consumers, and (2) continued to include information
in consumer reports that was provided by unreliable furnishers without
implementing procedures to assure the accuracy of information provided
by unreliable furnishers. Specifically, the CRCs did not monitor
metrics and thresholds tied to objective measures of inaccuracy or
unreliability. Moreover, the CRCs maintained data from furnishers that
responded to disputes in ways that suggested that the furnishers were
no longer sources of reliable, verifiable information about consumers.
For example, CRCs received furnisher dispute response data indicating
that, for several months, furnishers failed to respond to all or nearly
all disputes, or responded to all disputes in the same manner. Despite
observing this dispute response behavior by these furnishers, CRCs
continued to include information from these furnishers in consumer
reports.
---------------------------------------------------------------------------
\13\ 15 U.S.C. 1681e(b).
---------------------------------------------------------------------------
In response to these findings, CRCs were directed to revise their
accuracy
[[Page 36777]]
procedures to identify and monitor furnishers and take corrective
action regarding data from furnishers whose dispute response behavior
indicates the furnisher is not a source of reliable, verifiable
information about consumers.
2.2 Furnishers
In recent reviews of furnishers, examiners found deficiencies in
furnishers' compliance with FCRA and Regulation V accuracy, dispute
investigation and identity theft requirements.
2.2.1 Furnisher Duty to Promptly Correct and Update Information
Determined To Be Incomplete or Inaccurate
Examiners are continuing to find that furnishers are violating the
FCRA duty to promptly correct and update furnished information after
determining that such information is incomplete or inaccurate.\14\
Specifically, in recent reviews of auto loan furnishers, examiners
found that furnishers continued to furnish incomplete or inaccurate
information for several months, and in some cases years, after the
furnishers determined, through either dispute handling or
identification of systemic issues, the information was furnished
incompletely or inaccurately. For example, examiners found that
furnishers continued to report dates of first delinquency inaccurately
for several months after determining that they were reporting
inaccurately due to various system coding issues. Examiners also found
that after determining accounts were in a bankruptcy status and
therefore should have been reported as current with dates of first
delinquency that reflect the bankruptcy filing dates, furnishers failed
to update the dates of first delinquency for the accounts to the
bankruptcy filing dates. By failing to update the dates of first
delinquency for the accounts in bankruptcy when they determined the
accounts were in bankruptcy, the furnishers failed to promptly update
or correct information they had determined to be incomplete or
inaccurate. In response to these findings, furnishers are updating
their internal controls related to promptly correcting or updating
furnished information after determining it is incomplete or inaccurate
and engaging in lookbacks to remediate the furnishing of the previously
impacted accounts.
---------------------------------------------------------------------------
\14\ 15 U.S.C. 1681s-2(a)(2).
---------------------------------------------------------------------------
Examiners also found that auto loan furnishers did not promptly
send corrections or updates to CRCs after determining that accounts
with lease returns were paid-in-full. When leased cars were returned to
dealerships, furnishers updated their systems of record to reflect that
the accounts had been paid-in-full. However, examiners found that the
furnishers failed to update the information furnished to CRCs to
reflect that the accounts were paid-in-full. In response to these
findings, furnishers are conducting lookbacks to ensure that
corrections or updates are furnished for impacted accounts and are
implementing internal controls to ensure they promptly correct or
update furnished information after determining it is incomplete or
inaccurate.
In addition, in reviews of deposit furnishers, examiners found that
furnishers continued to report fraudulent accounts to CRCs for several
years after determining the accounts were fraudulent. While, in some
instances, furnishers closed the accounts determined to be fraudulent,
they continued to furnish the accounts as valid (i.e., non-fraudulent)
accounts and failed to notify CRCs that the accounts should be deleted
because they were fraudulent. By not instructing CRCs to delete the
accounts promptly after determining they were fraudulent, the
furnishers failed to promptly correct or update furnished information
determined to be inaccurate or incomplete.
In response to these findings, furnishers conducted lookbacks to
ensure they deleted all accounts they determined to be opened
fraudulently and updated their policies and procedures related to
notifying CRCs when accounts are determined to be fraudulent to ensure
the accounts are deleted.
2.2.2 Furnisher Duty To Notify CRCs of Direct Disputes
Examiners are continuing to find that furnishers are violating the
FCRA duty to notify CRCs that the accuracy or completeness of items
being furnished by them are subject to dispute.\15\ Specifically, in
recent reviews of deposit furnishers, examiners found that furnishers
who received direct disputes from consumers were continuing to furnish
the disputed information to CRCs without notifying the CRCs that the
information was subject to dispute.
---------------------------------------------------------------------------
\15\ 15 U.S.C. 1681s-2(a)(3).
---------------------------------------------------------------------------
In response to these findings, furnishers are updating their
policies to make clear that they will provide notices of direct
disputes to CRCs.
2.2.3 Furnisher Duty To Conduct Reasonable Investigations of Direct
Disputes
Examiners are continuing to find that furnishers are violating the
Regulation V duty to conduct a reasonable investigation of direct
disputes.\16\ Specifically, in recent reviews of auto loan furnishers,
examiners found evidence that furnishers failed to investigate direct
disputes that did not satisfy those furnishers' extraneous identity
verification requirements. Regulation V specifically defines what a
consumer must include in a dispute notice to trigger a furnisher's duty
to investigate. Although these disputes met the Regulation V
requirements for a direct dispute, examiners found evidence that the
furnishers did not investigate the disputes because the consumer had
not satisfied additional identity verification requirements of the
furnisher. However, Regulation V does not permit a furnisher to
establish additional requirements beyond what the regulation requires
in order to initiate a direct dispute investigation by the furnisher.
---------------------------------------------------------------------------
\16\ 12 CFR 1022.43(e)(1).
---------------------------------------------------------------------------
Also, in recent reviews of debt collection furnishers, examiners
found that when the furnishers received a direct dispute, they simply
deleted the tradeline, rather than conducting an investigation. As the
Bureau has previously explained, simply deleting tradelines in response
to a direct dispute does not satisfy furnishers' responsibility to
conduct a reasonable investigation with respect to the disputed
information.\17\ After identification of these issues, furnishers were
directed to update their policies and procedures to ensure they conduct
reasonable investigations of direct disputes.
---------------------------------------------------------------------------
\17\ CFPB Bulletin 2014-01 (Feb. 27, 2014).
---------------------------------------------------------------------------
2.2.4 Furnisher Duty To Provide Notice of Delinquency of Accounts
Examiners are continuing to find that furnishers are violating the
FCRA duty to notify CRCs of the dates of first delinquency on
applicable accounts.\18\ Specifically, in recent reviews of auto loan
furnishers, examiners found that furnishers inaccurately reported dates
of first delinquency to CRCs due to various coding issues. For example,
examiners found that coding errors resulted in furnishers inaccurately
reporting dates of first delinquency as the first day of the statement
cycle following the consumer's missed payment, rather than 30 days
after the missed payment due date. Examiners also found that auto
[[Page 36778]]
loan furnishers reported inaccurate dates of first delinquency for
accounts by reporting the dates of first delinquency as more recent
than they should have been, including by changing the dates of first
delinquency for accounts that remained delinquent month after month
(i.e., accounts for which the dates of first delinquency should not
have been changed).
---------------------------------------------------------------------------
\18\ 15 U.S.C. 1681s-2(a)(5).
---------------------------------------------------------------------------
In response to these findings, furnishers are conducting lookbacks
to identify and remediate impacted accounts and updating their policies
and procedures to ensure that they report dates of first delinquency
accurately.
2.2.5 Furnisher Duty Not To Furnish Information That Purports To Relate
to a Consumer Upon Receipt of an Identity Theft Report
Examiners are continuing to find that furnishers are violating the
FCRA's requirement that if a consumer submits an identity theft report
at the address specified by the furnisher for receiving such reports
stating that information maintained by that furnisher that purports to
relate to the consumer resulted from identity theft, the furnisher may
not furnish such information to any CRC, unless the furnisher
subsequently knows or is informed by the consumer that the information
is correct.\19\ Specifically, in recent reviews of auto loan
furnishers, examiners found that furnishers who received identity theft
reports at a qualifying address continued to furnish information
identified in the report before knowing or being informed by the
consumer that the information was correct.
---------------------------------------------------------------------------
\19\ 15 U.S.C. 1681s-2(a)(6)(B).
---------------------------------------------------------------------------
In response to these findings, furnishers are updating their
policies and procedures to ensure that information subject to this
requirement is not furnished prior to the completion of an
investigation and determination of validity.
3. Supervisory Program Developments
3.1 Recent CFPB Supervisory Program Developments
Set forth below are select supervision program developments
including advisory opinions, that have been issued regarding credit
reporting since our last regular edition of Supervisory Highlights.
3.1.1 CFPB Issued Advisory Opinion on Fair Credit Reporting: Background
Screening
On January 11, 2024, the CFPB issued an advisory opinion to affirm
that, when preparing consumer reports, a CRC that reports public record
information is not using reasonable procedures to assure maximum
possible accuracy under the FCRA if it does not have procedures in
place that: (1) prevent reporting information that is duplicative or
that has been expunged, sealed, or otherwise legally restricted from
public access; and (2) include any existing disposition information if
it reports arrests, criminal charges, eviction proceedings, or other
court filings.\20\ The advisory opinion also highlights that, when CRCs
include adverse information in consumer reports: (1) the occurrence of
the adverse event starts the running of the reporting period for
adverse items under FCRA section 605(a)(5); (2) that period is not
restarted or reopened by the occurrence of subsequent events; and (3) a
non-conviction disposition of a criminal charge cannot be reported
beyond the seven-year period that begins to run at the time of the
charge. CRCs thus must ensure that they do not report adverse
information beyond the reporting period in FCRA section 605(a)(5) and
must at all times have reasonable procedures in place to prevent
reporting of information that is duplicative or legally restricted from
public access and to ensure that any existing disposition information
is included if court filings are reported.
---------------------------------------------------------------------------
\20\ The advisory opinion is available at: cfpb_fair-credi-
reporting-background-screening_2024-01.pdf (consumerfinance.gov).
---------------------------------------------------------------------------
3.1.2 CFPB Issues Advisory Opinion on File Disclosures
On January 11, 2024, the CFPB issued an advisory opinion to address
certain obligations that CRCs have under section 609(a) of the
FCRA.\21\ The advisory opinion underscores that, to trigger a CRC's
file disclosure requirement under FCRA section 609(a), a consumer does
not need to use specific language, such as ``complete file'' or
``file.'' The advisory opinion also highlights the requirements
regarding the information that must be disclosed to a consumer under
FCRA section 609(a). In addition, the advisory opinion affirms that
CRCs must disclose to a consumer both the original source and any
intermediary or vendor source (or sources) that provide the item of
information to the CRC under FCRA section 609(a).
---------------------------------------------------------------------------
\21\ The advisory opinion is available at: cfpb_fair-credit-
reporting-file-disclosure_2024-01.pdf (consumerfinance.gov).
---------------------------------------------------------------------------
4. Remedial Actions
4.1 Public Enforcement Actions
The CFPB's supervisory actions resulted in and supported the below
enforcement actions related to credit reporting or furnishing.
4.1.1 Toyota Motor Credit Corporation
On November 20, 2023, the CFPB issued an order against Toyota Motor
Credit Corporation (Toyota Motor Credit), which is the United States-
based auto-financing arm of Toyota Motor Corporation and one of the
largest indirect auto lenders in the country. Toyota Motor Credit
provides financing for vehicles and optional ``add-on'' products and
services sold with the vehicles. These add-ons include Guaranteed Asset
Protection, which can waive some of a consumer's remaining loan balance
if their car is totaled, stolen or damaged when they still owe money on
the loan even with car insurance, and Credit Life and Accidental
Health, which is designed to pay a remaining balance if the consumer
dies or becomes disabled. The CFPB found that Toyota Motor Credit
violated the Consumer Financial Protection Act of 2010 by: (1) unfairly
and abusively making it unreasonably difficult for consumers to cancel
unwanted add-ons, including when consumers complained that dealers had
forced add-ons on consumers without their consent; (2) unfairly failing
to ensure consumers received refunds of unearned Guaranteed Asset
Protection and Credit Life and Accidental Health premiums when they
paid off their loans early or ended lease agreements early, making the
products no longer of any value to consumers; and (3) unfairly failing
to provide accurate refunds to consumers who canceled their vehicle
service agreements as a result of flawed system logic. The CFPB also
found that Toyota Motor Credit violated the FCRA and its implementing
Regulation V by (1) failing to promptly correct negative information it
had sent to CRCs, where the negative information was falsely reporting
customer accounts as delinquent even though customers had already
returned their vehicles; and (2) failing to maintain reasonable
policies and procedures to ensure related payment information it sent
to CRCs was accurate. The order requires Toyota Motor Credit to pay $48
million in consumer redress and a $12 million civil money penalty.\22\
The order also requires Toyota Motor Credit to stop its
[[Page 36779]]
unlawful practices and come into compliance with the law and prohibits
incentive-based employee compensation or performance measurements in
relation to add-on products.
---------------------------------------------------------------------------
\22\ The Order is available at: cfpb_toyota-motor-credit-
corporation-consent-order_2023-11.pdf (consumerfinance.gov).
---------------------------------------------------------------------------
4.1.2 TransUnion, Trans Union LLC, and TransUnion Interactive, Inc.
On October 12, 2023, the CFPB issued an order against TransUnion,
parent company of one of the three nationwide CRCs, and two of its
subsidiaries, Trans Union LLC, and TransUnion Interactive, Inc.
(collectively, TransUnion), which are headquartered in Chicago,
Illinois. Security freezes and locks block certain third parties, such
as lenders, from accessing consumers' credit reports to prevent a
potential identity thief from obtaining new credit in those consumers'
names. Starting in September 2018, Federal law has required nationwide
CRCs to provide security freezes as a free service, whereas locks are a
feature of certain paid products. The CFPB found that TransUnion, from
as early as 2003, failed to timely place or remove security freezes and
locks on the credit reports of tens of thousands of consumers who
requested them, including certain vulnerable consumers; in some cases,
those requests were left unmet for months or years. The CFPB found
TransUnion's failure to place or remove security freezes in a timely
manner occurred as a result of problems, including systems issues, that
TransUnion knew about but failed to address for years. The CFPB found
that TransUnion's failure to place or remove security freezes in a
timely manner violated the FCRA, and TransUnion's failure to place or
remove both security freezes and locks in a timely manner was unfair in
violation of the Consumer Financial Protection Act of 2010. Further,
the CFPB found that TransUnion engaged in deceptive acts and practices
by falsely telling certain consumers that their requests had been
successful when they had not. In addition, the CFPB found that from
about 2016 to 2020, TransUnion failed to exclude certain consumers,
including active-duty military and other potential victims of identity
theft, from pre-screened solicitation lists in violation of FCRA. The
CFPB's order requires TransUnion to pay $3 million to consumers in
redress and $5 million in civil penalties.\23\ TransUnion must also
take steps to address and prevent unlawful conduct, including convening
a committee to identify and address technology problems that can affect
consumers.
---------------------------------------------------------------------------
\23\ A copy of the Consent Order is available at:https://www.consumerfinance.gov/enforcement/actions/transunion-trans-union-llc-and-transunion-interactive-inc/.
Rohit Chopra,
Director, Consumer Financial Protection Bureau.
[FR Doc. 2024-09712 Filed 5-2-24; 8:45 am]
BILLING CODE 4810-AM-P