FRAMINGHAM, Mass. – The impact of the new Fair and Accurate Credit Transactions (FACT) Act remains to be seen, but the rules-making that follows such sweeping federal lawmaking could well have an impact on financial institutions, credit reporting agencies and IT vendors alike Sophie Louvel, an analyst with Financial Insights, says the FACT Act's effects could go well beyond the headlines when its most publicized provisions became law in December: the requirement that America's three national credit reporting agencies allow consumers one free credit report every 12 months. There are other parts of the law that stand out to those involved in IT security and protecting consumers for identity theft. "One of the more specific rules requires credit card issuers to withhold the granting of a customer's request for a replacement or additional card" if the request is made within 30 days of an issuer, such as a credit union, getting a change of address request, Louvel points out. And while the Federal Trade Commission will be writing and refining the rules, "another identity theft protection rule that is expected to become more specific is Section 114, which requires financial institutions to develop guidelines for identifying possible identity theft," Louvel says. The Financial Insights analyst predicts "moderate to significant change" to how credit unions, banks and their IT vendors are handling such things as "red flag guidelines and regulations against identity theft," studying biometrics to combat the problem, and improving the accuracy of information furnished to credit bureaus. For the big credit bureaus themselves, the costs will include providing for free a service that used to cost about $9 a report, Louel observes, but also notes this IT security consideration for the likes of TransUnion, Experian and Equifax: "Another cost that is not as apparent today is that to protect a potentially popular Web site from security attacks such as phishing." Louvel also predicts the FTC rules to come will "give consumers the ability to dispute information with the furnisher directly." The dispute process is at the heart of the FACT Act, and will see much of the rules and regulations activity aimed at eliminating possible discrimination in how credit is offered and priced based on credit reporting agency reports. While how to implement the complex new laws is under study by the FTC, Louvel says, market forces will be in effect as reports from the three agencies are compared side-by-side by consumers, consumers gain a greater understanding of what's in their reports, and financial institutions that supply the information to the credit bureaus improve the quality and accuracy of their data. In fact, "as the credit report industry learns more about the importance of errors in credit reports through greater consumer involvement, participants may precede regulators and implement industry guidelines for improving accuracy," Louvel says. "Identity theft, by contrast, is an area that warrants further rulemaking," the Financial Insights analyst says. "If the FTC can show that greater accuracy can improve the ability to detect and prevent identity theft, new accuracy rules are highly likely." That's already happening in California, Louvel notes, where the state's Senate has passed a rule that would require credit reporting agencies to match at least three points of identifying information before a report could be provided. "We could soon see a similar rule implemented on the federal level," Louvel says. "Another more racial approach might be to recommend the implementation of a new customer identification number to replace the Social Security number as a key identifier." -

[email protected]