Documenting Business Policies and Procedures

1
Credit Reports and SSN Trace Products August 27,
2007 Mike Coffey President Imperative Information
Group Fort Worth, Texas
NAPBS Education Series
2
Speaker

• Mike Coffey is president of Imperative
  Information Group, an investigations firm
  specializing a business due diligence.
• He is a frequent speaker on the topic of
  background screening and due diligence. He
  conducts a two-day seminar on background
  investigations for industry peers, police
  agencies, and corporate security professionals.
• Mike is past co-chair of the NAPBS Ethics and
  Accreditation Committee and currently serves on
  the NAPBS Board of Directors.
• He is a Gemini and likes slow dancing, walking
  barefoot on the beach, and old episodes of
  Moonlighting.

3
Topics

• Legal Issues
• Drivers Privacy Protection Act
• Gramm-Leach-Bliley Act
• Fair Credit Reporting Act
• Title VII of the Civil Rights Act of 1964
• Credit Reports
• SSN Trace Products

4
Drivers PrivacyProtection Act (DPPA)

• Restricts sale of drivers personal information
  without a permissible use.
• Federal law with various state implementations
  that are more restrictive.

5
Drivers PrivacyProtection Act (DPPA)

• Personal information may be disclosed as follows

(3) For use in the normal course of business by a
legitimate business or its agents, employees, or
contractors, but only (A) to verify the
accuracy of personal information submitted by the
individual to the business or its agents,
employees, or contractors and (B) if such
information as so submitted is not correct or is
no longer correct, to obtain the correct
information, but only for the purposes of
preventing fraud by, pursuing legal remedies
against, or recovering on a debt or security
interest against, the individual.
6
Drivers PrivacyProtection Act (DPPA)

• Personal information may be disclosed as follows

(13) For use by any requester, if the requester
demonstrates it has obtained the written consent
of the individual to whom the information
pertains.
7
Drivers PrivacyProtection Act (DPPA)

• DPPAs requirements flow down to the end user in
  a variety of products
• Driving records (MVRs), whether purchased
  directly from the state or through a third-party.
• Databases available from third-party data brokers
  who often compile the information from multiple
  sources.

8
Gramm-Leach-BlileyAct (GLB)

• aka The Financial Modernization Act of 1999
• Limits access to personally identifiable
  financial information held by or originating
  from consumer transactions with financial
  institutions.
• Name
• Date of birth
• Address
• Social Security Number

9
Gramm-Leach-BlileyAct (GLB)

• Permissible purposes for accessing PIFI under
  GLB

• As necessary to effect, administer, or enforce a
  transaction requested or authorized by the
  consumer
• With the consent or at the direction of the
  consumer
• To protect against or prevent actual or potential
  fraud, unauthorized transactions, claims, or
  other liability

10
Gramm-Leach-BlileyAct (GLB)

• GLBs requirements flow down to the end user in a
  variety of products
• Credit reports
• Credit bureau-supplied SSN trace products
• Databases available from third-party data brokers
  who often compile the information from multiple
  sources.

11
Fair Credit Reporting Act (FCRA)
Covers consumer reports, which in todays context
would mean any information the screening firm
provides the employer about the applicant
(consumer). See Mary Poquettes excellent
overview of FCRA compliance in the May 2007
webinar materials.
12
Fair Credit Reporting Act (FCRA)

• Examples of Coverage
• Employment-related background checks, including
  provision of criminal records, verification of
  education or licensure, or obtaining references
  from previous employers
• Credit reports
• Databases of employer or institution-supplied
  employment or education history maintained by
  third parties like The Work Number or the
  National Student Clearinghouse
• Public record databases

13
Fair Credit Reporting Act (FCRA)

• What Cant Be Reported?
• Bankruptcies more than 10 years old,
• Civil suits, civil judgments, arrest records, tax
  liens, collection or charge off accounts, more
  than seven years old,
• Any other negative information, with the
  exception of criminal convictions, more than
  seven years old.

14
Fair Credit Reporting Act (FCRA)

• Salary Exception to the Age Limits
• The one employment-related exception to these
  limitations is granted when the consumers annual
  salary equals, or may be reasonably expected to
  equal, 75,000 or more.

15
Fair Credit Reporting Act (FCRA)

• Accuracy of information (all information)
• Whenever a consumer reporting agency prepares a
  consumer report it shall follow reasonable
  procedures to assure maximum possible accuracy of
  the information concerning the individual about
  whom the report relates.

16
Fair Credit Reporting Act (FCRA)

• Public Record Information (all consumer reports)
• The CRA must ensure that the information reported
  matches the status of the item at the time the
  report is requested, or
• The CRA must notify the consumer that the
  negative public record information is being
  reported, along with the name and address of the
  employer to whom the report is being provided.

17
Title VII ofThe Civil Rights Act of 1964

• Prohibits employment discrimination on the basis
  of race, sex, color, national origin, and
  religion.
• Sometimes seemingly color-blind background
  check items such as arrest records and credit
  reports have been found to disproportionately
  exclude minority groups.

18
Title VII ofThe Civil Rights Act of 1964

• United States v. City of Chicago - the court held
  that a police department could use the credit
  reports of applicants only if using the
  information
• does not have an "adverse impact" on a protected
  class or
• is job related and consistent with business
  necessity.

19
Title VII ofThe Civil Rights Act of 1964
EEOC v. United Virginia Bank/Seaboard National
Although the use of credit reports did adversely
impact a protected group, the court concluded
that a bank had a business need to conduct
pre-employment credit checks because employees
handle large amounts of cash.
20
Title VII ofThe Civil Rights Act of 1964

• The safe bet would be for CRAs to encourage
  employer-clients to carefully review their
  business rationale for requesting
  employment-credit reports.
• A good question to ask might be What do you hope
  to learn from employment credit reports? There
  may be a better product offering that will
  provide information more relevant to the
  employers concern and the position applied for.

21
Employment Credit Reports

• A credit report may be pulled for employment
  purposes with existing FCRA-compliant disclosure
  and authorization documents used for background
  investigations.
• No special release is required from the
  applicant.

22
Employment Credit Reports

• Reports may include
• Credit header information
• Accounts turned over to collection agencies
• Account performance history
• Employment history (limited and not always
  reliable)
• Public records database (usually liens and
  judgments)
• Inquiry history (who else has pulled the report)

23
Employment Credit Reports

• Credit reports pulled for employment purposes
  will not affect the consumers credit score. This
  is often a concern for employment applicants.
• The inquiry will be reflected on the consumers
  credit report, typically listing both the
  end-user (employer) and the CRA. A current
  employer who routinely pulls credit on employees
  may see the inquiry of another employer.

24
Typical Know Your Customer Requirements

• Membership Application detailing information
  about the employers business lines, ownership,
  banking relationships, and leadership.
• Proof of business legitimacy (phone book list,
  corporate records, bank account verification,
  etc.)
• On-site visit by bureau-approved firm (they
  basically look around to see if the company seems
  legit and may ask to see where reports will be
  stored).

25
Typical Uses forEmployment Credit Reports

• Measure the fiscal responsibility of those with
  fiduciary decision-making responsibility.
• Evaluate the risk associated with placing someone
  in a cash handling position or with access to
  significant assets.

26
Pitfalls in the Use ofEmployment Credit Reports

• The existence of multiple medical/ hospital liens
  or related collection items may put unwanted
  medical information in employers hands.
• Explaining negative credit report information may
  necessitate that the applicant reveal personal
  information regarding marital status or other
  life issues, opening the employer up to other
  Title VII claims.

27
SSN Trace Products

• The purpose of identity development is to
• Substantiate (not verify) the identity
  information provided by the applicant
• Determine what research to conduct on the
  applicant
• Identify potential landmines

28
SSN Trace Products

• Credit bureau headers will provide the names and
  addresses associated with an SSN. They sometimes
  provide full or partial dates of birth. Most
  entries will have first/last reported dates.
  Often the most up to date records (within last
  thirty days).
• Aggregate databases (e.g., Accurint, NBDs AIM
  product) will often contain the records of
  multiple credit bureaus headers along with
  information from some states drivers license
  records and other proprietary sources. Typically
  more robust list of names and addresses.

29
Where Credit HeaderInformation Comes From

• Information is reported by merchants, banks, and
  others when retrieving a consumers credit report
  (the information was typically initially provided
  by the consumer on an application)
• Financial institutions often dump their
  historical consumer data into the credit bureaus
  records.

30
Where Credit HeaderInformation Comes From

• The data provided by credit bureau subscribers is
  full of typographical errors, misspellings of
  names and addresses, miskeyed ZIP codes
  (sometimes leading to entirely incorrect cities
  and states), and miskeyed SSNs (leading to new
  names being associated with an SSN).
• It cannot be assumed to be accurate and reliable.

31
Where Credit HeaderInformation Comes From

• The dates on the credit header records are those
  on which the records were first and last reported
  to the credit bureau by a bureau subscriber.
• These ARE NOT necessarily the dates the consumer
  first or last used the name or address.

32
How SSN Trace Products Are Used

• Identify names strongly associated with an SSN to
  determine what names should be researched.
• Identify locations strongly associated with an
  SSN to determine what jurisdictions should be
  researched.
• Because of erroneous data, the data should be
  evaluated prior to use.

33
Common Issues with SSN Trace Products

• No records found for the SSN due to
• The applicants limited credit history, often due
  to their young age
• Data entry error by the client
• Reporting error by the applicant
• Fraud by the applicant

34
Common Issues with SSN Trace Products

• Incorrect names in the results due to
• Typos by those providing information to the
  credit bureau
• Identity fraud by the applicant or against the
  applicant
• Client or applicant error in providing the SSN

35
Common Issues with SSN Trace Products

• Incorrect addresses in the results due to
• Typos by those providing information to the
  credit bureau (transpose two numbers in a ZIP
  code and get a different city and state)
• Failure in logic in the credit bureaus or data
  aggregators database

36
Who Should Evaluate the SSN Trace Results?

• Option 1 The employer client
• Gives client full control of what is researched
• Assumes (often incorrectly) that the client is
  savvy enough to understand the nuances in the
  data and determine which records can be strongly
  associated with the applicant.

37
Who Should Evaluate the SSN Trace Results?

• Option 1 The employer client
• Once provided to the employer, the SSN Trace now
  becomes a part of the consumer report, making
  any errors disputable. See Vincent Pascarellas
  excellent white paper on handling consumer
  disputes of SSN Traces on the NAPBS website.
• By providing information known to often contain
  incorrect information, the CRA may not be in
  compliance with the FCRAs requirement of
  reasonable procedures to assure maximum possible
  accuracy.

38
Who Should Evaluate the SSN Trace Results?

• Option 2 Software
• Might automatically order research on names or
  addresses obviously not related to your applicant
  (clients love that)
• If there is some filtering logic in the software,
  it might miss questionable records (e.g., an SSN
  trace with ten records, five for John Smith and
  five for Carole Jones).

39
Who Should Evaluate the SSN Trace Results?

• Option 3 The Well-Trained CRA Staff
• Ensures that proper aliases and jurisdictions are
  identified.
• Gives CRA opportunity to flag any obviously
  questionable applicant identity information to
  the client prior to initiating research
• Probably increases the average number of
  jurisdictions researched, resulting in more
  thorough results

40
CRA Policy Considerationswith SSN Trace Products

• What constitutes a strong association vs. weak
  association with the applicant?
• When are aliases (first and last names) used in
  research?
• How are identity issues flagged to the client?
• How is this policy communicated to the client?

41
Whew! Coffey sure can talk!

• QUESTIONS?