Instructions for Law Enforcement ­Submitting a Request under FCRA Section 609(e)

to Obtain Transaction Records Relating to Identity Theft

Section 609(e) of the Fair Credit Reporting Act provides a way for an identity theft victim to get copiesof transaction records from businesses – such as applications for credit – relating to the theft of hisidentity. With the victim’s authorization or at the victim’s direction, law enforcement can receive theserecords directly from the business on the victim’s behalf. Subject to limited exceptions, businesses mustprovide these records, free of charge and without a subpoena, within 30 days of receiving a properrequest. This Web site includes a model request letter that the victim may complete or modify, asappropriate, to request records under Section 609(e), and also includes a model law enforcement coverletter for your use, as appropriate.

These instructions will guide you in working with identity theft victims to obtain relevanttransaction records under Section 609(e):

1. The victim’s request must be in writing. The victim’s request to a business for recordsrelating to the theft of his identity must be made in writing. Under Section 609(e), businessesare not required to provide records in response to an oral request.

1. The victim’s request must be sent to the address specified by the business, if any.Some businesses may designate a certain address or department to which Section 609(e)requests must be sent; if a business has done so, the request must be sent to that address ordepartment. If you are unable to locate a particular address for Section 609(e) requests,consider contacting the business to ask for the proper address, or send the request to thebusiness’ “fraud” or “billing inquiries” address.

2. If the victim wants you to submit his request to the business on his behalf, or wants youto receive the records directly from the business, make sure this is reflected in thevictim’s request. There are two ways that you may obtain the transaction records directlyfrom the business. First, the victim may submit his written request to the business and include inhis request an instruction that the transaction records should be provided directly to you. Therequest should identify you by name and include your agency and address. Alternatively, youmay submit the victim’s request to the business on the victim’s behalf. The victim’s requestshould state that you are authorized to submit the request and take receipt of the records, andshould identify you by name and include your agency and address. The model victim requestletter includes suggested language that is appropriate under either circumstance.

3. If you submit the victim’s request to the business on the victim’s behalf, explain in acover letter on your law enforcement letterhead that you are authorized by the victim

to submit the request and receive the records. If you submit the victim’s request to thebusiness on his behalf, you should include a cover letter on your letterhead explaining that thevictim’s request includes authorization for you to submit the request and receive the records.See this Web site’s model law enforcement cover letter for suggested language to include.

4. The victim’s request should include as much information as possible about thefraudulent account or transaction, if known. To assist the business in locating the relevantrecords, the request should include as much information as possible about the fraudulent activityin the victim’s name, such as transaction dates and account numbers. If the victim has anyrecords showing the fraudulent activity at the business, such as a credit card statement showingcharges at the business that he did not make, copies of these records should be included withthe request.

5. The victim’s request should include documents that the business is entitled to requirebefore providing you or the victim with records. Documents that the business is entitled torequire before providing the transaction records sought should be enclosed with the victim’swritten request. Providing this information up front may help expedite your receipt of therecords.

a. Enclosures to provide proof of the victim’s identity. Before providing records inresponse to a written Section 609(e) request, the business has the right to require any ofthe following as proof of the victim’s identity:

i. A copy of the victim’s government­issued identification card, such as thevictim’s driver’s license;

ii. Personally identifying information of the same type that was provided to thebusiness by the identity thief; or

iii. Personally identifying information that the business typically requests from newapplicants or for new transactions (including documents listed in (i) and (ii),above).

In order to expedite the receipt of records in response to the victim’s 609(e) request,one of these types of proof of the victim’s identity, such as a copy of the victim’sdriver’s license, should be included with the written request to the business.

b. Enclosures to provide proof of the victim’s identity theft claim. The business alsohas the right to require the following as proof of the victim’s claim of identity theft:

i. A copy of the police report about the victim’s identity theft; and

ii. A completed FTC ID Theft Affidavit or other affidavit that is acceptable to the

business, at the business’s election.

A copy of the police report and the completed FTC ID Theft Affidavit should beincluded with the written request to the business. Many businesses will require thisproof to ensure that they are not improperly sharing information about their customers.Note that businesses may require the victim to submit an affidavit the business hasprepared, instead of the FTC ID Theft Affidavit.

6. Consider including documents to educate the business about its obligations underSection 609(e). Many businesses have policies in place to protect information and recordsconcerning their customers and, therefore, may be unwilling to provide you or the victim withtransaction records unless it is clear to them that they are obligated to do so. It may be helpfulto specifically mention Section 609(e) of the FCRA by name in the victim’s written request andto include a copy of the text of the law, available here. We also recommend including with therequest the FTC’s business education publication on this topic, “Businesses Must ProvideVictims and Law Enforcement with Transaction Records Relating to Identity Theft.” Beprepared to assist the business in complying with other laws to which it may be subject whilehonoring the victim’s Section 609(e) request. Steps you can take may include identifying thebusiness as a victim on your police report or providing additional detail on the police report toallow the business to verify the victim’s claim.

7. Send the request by certified mail, return receipt requested and keep a copy of thewritten request and enclosures for your case file. The victim’s request (and your coverletter, if any) should be sent by certified mail, return receipt requested, so that you and the victimcan document what the business received and when. Include in the case file a copy of thevictim’s request and enclosures, your cover letter, if any, and any follow­up communicationswith the business concerning the victim’s request.

8. Follow up as necessary after submitting the request. You or the victim should receive aresponse from the business within 30 days of the date that the business received the victim’swritten request. The business may request additional information, such as proof of the victim’sidentity or identity theft claim. To increase the likelihood that the requested records will beprovided promptly, such proof should be included with the victim’s written request, along withas much information as the victim has concerning the fraudulent transaction or account.