The scenario is all too familiar. A person claims to be from a mortgage company and requests credit reports and other information to conduct business. On the surface, everything seems OK. However, upon closer inspection, we find that the firm is bogus. It is being operated out of a run-down office being rented by the hour. Unless steps are taken, the fake company will gain access to sensitive data that could be used to perpetrate scams and identity theft that could cost unwary consumers millions of dollars.
To prevent this kind of fraud and protect valuable data, credit reporting companies have been required to conduct physical inspections of properties and verifications of business licenses. New repository requirements enacted late last year have shifted responsibility for inspections to third-party vendors.
Protecting information is vital
While physical inspections and verifications are seen by some in our industry as time consuming and bureaucratic, such actions play a vital role in ensuring greater security for the data we provide. Loose handling of credit reports, improper disposal practices and password sharing are major security issues. We must ensure that we are not providing credit files and other information to businesses that are not legitimate. In fact, we must take very seriously our responsibility to scrutinize end users and educate them in the proper procedures for handling sensitive credit reporting data.
Starting on Nov. 1, 2005, the three major credit repositories (Equifax, TransUnion and Experian) began to require third-party vendors to perform inspections rather than relying on credit reporting agencies. Every credit reporting firm must use the same handful of vendors. Technically, we cannot allow a client to pull its first credit report until a physical inspection is completed - a responsibility we should all take very seriously.
Origins in FCRA
The question, of course, is, “How did we come to need physical inspections in the first place?” A partial answer can be found in the Fair Credit Reporting Act (FCRA), which was passed into law in 1970 and amended in 1994 and 2004. Section 607 of the FCRA says:
Every consumer reporting agency shall maintain reasonable procedures that require prospective users of information to identify themselves, certify the purposes for which the information is sought and certify that the information will be used for no other purpose. Every consumer reporting agency shall make a reasonable effort to verify the identity of a new prospective user and the uses certified by such prospective user prior to furnishing such user a consumer report.
Moreover, the widespread media attention regarding data breaches, identity theft, fraud and so on has caused great concern among consumers and legislators alike. Although the physical inspections done by third-party vendors, rather than the credit firms’ own employees, are not government mandated, the credit repositories are requiring them as added security. The credit bureaus want to make certain that current end-user sites are being thoroughly inspected to ensure compliance with FCRA. The ultimate goal, of course, is to protect the integrity of the data provided, and certifying the end user is the first step in doing that.
Along with obtaining a photo of the business taken by an approved third-party vendor, here are some of the requirements:
- For mortgage brokers in a residential space, the residence must be a house. A copy of the principal’s current driver’s license is required, as well as a copy of a broker’s license, business license, articles of incorporation, articles of partnership or federal or state ID tax certificate. A copy of the current lease of the business also is needed.
- For brokers or lenders in a commercial space, all of the above requirements apply. A copy of a real estate license can also be used.
- For branch offices of corporate accounts, there must be documentation showing either corporate approval or a copy of the broker’s license. If the license is not required by the state, then a copy of a business license, articles of incorporation, articles of partnership or federal or state ID tax certificate is required, as well as a copy of the current lease of the business.
Inspection volume requires follow-up
While physical inspections are necessary, timeliness of execution has become a concern. At present, there are only four physical inspection companies that are approved by the three credit repositories, and one of those companies is not taking any new clients because it is too busy. The fact is that none of the inspection companies were ready for the volume they experienced when this requirement was put in place. Although they are doing their best to accommodate the industry, these firms need to improve their efficiency and reduce turnaround times, and more companies need to be approved.
On occasion, requests for inspections have fallen through the cracks. Therefore, follow-up is necessary to make sure that a fax didn’t get misplaced or that a request is reassigned in the event that an inspector couldn’t get to it.
It is important, therefore, to work with a credit reporting company that has a compliance department in place to provide superior follow-up, support and keen attention to details when it comes to the approval process.
Fake inspection problems
Although speed is important, thoroughness is essential in the inspection process, and spot checks are absolutely vital. For example, Credit Plus recently ordered an inspection of a home-based company in Colorado. The inspection, performed by an accredited third-party vendor, came back complete with a photo of the premises. When the firm received an invoice for the inspection, it disputed the charge, saying that no one had been to its office. After further checking and doing our own inspection, we found that the inspector had never been there and that the photos were fake. We took our own photos and notified the inspection company of the fraudulent report. While this sort of thing is not common, it does happen occasionally, and third-party vendors and credit firms must do their best to remain vigilant and remedy problems when they arise.
As credit reporting professionals, we should all make a commitment to excellence and integrity in data security and the handling of highly sensitive information. Physical inspections serve an important purpose in safeguarding information and making the credit process work for everyone.