New Identity Theft Rules Effective November 1, 2008 Unlikely to Have Substantial Impact on Employers

New rules cornering address discrepancies in consumer credit reports that could help to prevent identity theft go into effect November 1, 2008.  Beyond potentially creating some additional hoops to jump through,  the new rules are not likely as a practical matter to have a great deal of impact on employers and may even help employers avoid hiring someone operating with a stolen identification.

The new rules were written by various federal agencies as a result of provisions in the 2003 Fair and Accurate Credit Transactions Act of 2003 (FACTA), designed to combat identity theft when “Red Flags” were raised in credit reports.  Although employers are affected, the rules go well beyond employment and also regulate financial institutions and creditors.

Since the regulations are new, it is not yet entirely clear how they will be implemented.  However, employers would be impacted if they request a credit report from a background screening firm as part of a background report.  The credit reports are supplied to background firms by one of the three national credit bureaus, which are Experian, Trans Union or Equifax.

It also important to keep in mind that for employment purposes, these regulations only apply to information from a national credit bureau, which will mean as a practical matter it is limited to only those applicants where an employer requests a credit report.  Other types of background reports, such as criminal records, driving records, past employment or educational verification are not impacted.

If the credit bureau finds an address discrepancy which raises a “Red Flag,” the employer would receive a notice from the credit bureaus.  This could occur if the applicant submits an address that the credit bureaus do not find in their records, or it appears that there is a “substantial difference” between the applicant’s address and what the credit bureau has on file.

An employer that utilizes credit reports will need to establish a policy on how it will verify the applicant’s identity through reasonable means, such as confirming information directly with the applicant, using third party sources or utilizing other materials, such as employment application forms.

Once the address and identity of the applicant is clarified, an employer also under certain circumstances must then send back the newly confirmed address to the credit bureaus.  Although there will need to be some clarification in the near future on how this will work exactly,  it would appear reasonable that the background firm providing the credit report may be able to act as the go-between for the employer and the national credit bureau in the administration of this rule.

The important point for employers is that the address discrepancy notices are not likely to be a significant burden on employers or Human Resources professionals. Employers would expect to receive such notices primarily in two situations; First, if an applicant has moved to a new address that has not been picked up by credit bureaus, such a notice may be generated.  Secondly, an employer may get a notice where there is a case of identity theft with an applicant impersonating someone else.  In that event, employers will benefit from the new rules.

Once the actual operations of the regulations become clearer, ESR will provide its clients with a sample policy and will assist clients if and when such a notice is received. ESR will also provide training to all clients that request credit reports as part of their background checking protocol.