Congress, along with many government agencies, including the Federal Trade Commission, has taken measures to curb the rising tide of identity theft cases.  Recent regulations issued by the FTC and mandated by the Fair and Accurate Credit Transactions Act of 2003 (“FACTA”) include specific directives for users of consumer information that are aimed at uncovering and preventing identity theft.  These regulations go into effect on November 1, 2008 and some will have significant implications for employers who obtain consumer reports, such as applicant or employee background checks, for the purposes of making employment decisions.

Generally speaking, these FACTA regulations require companies to identify and respond to account activities that are possible indicators (“red flags”) of identity theft.  One of the regulations directly applicable to employers requires credit report users that receive a notice of address discrepancy from a consumer reporting agency to take additional steps to verify the identity of the person on the report.  A notice of address discrepancy is a notice that the address included in the user’s request for a consumer report and the address in the consumer reporting agency’s files are substantially different.

Under this provision, employers must have policies and procedures in place to enable them to form a reasonable belief that the consumer report they have received relates to the applicant or employee for whom they requested the report.  Additionally, this regulation requires the employer to take the extra step of reconciling the report’s address with the provided current address if the employer regularly furnishes information to a consumer reporting agency.

Examples of procedures for address discrepancies include verifying the address with the person to whom the consumer report pertains, reviewing the employer’s own records of the address provided to request the consumer report, or verifying the address through third-party sources.  Finally, if the employer regularly furnishes information on an employee to a consumer reporting agency, the employer must also provide the consumer reporting agency with the address it has reasonably confirmed is accurate.

While the new rules require companies to take reasonable measures to detect and prevent identity theft, they do not require employers to adopt any one particular policy or procedure.  Accordingly, employers should evaluate what verification procedures provide the most cost-effective way to verify and provide this information.