Identity theft brings new security duties for owners: with careful attention to consumer rights and data legislation, apartment owners will be better equipped to protect resident information, detect fraud and limit identity theft.

Recent scrutiny of "fraudsters'" success in creating fictitious companies to obtain consumer data has drawn greater attention to the problem of identity theft, one of the country's fastest growing crimes. Apartment firms' heightened privacy and security obligations and consumers' new rights raise a number of issues for site, regional and executive management.

At the outset, 2005 was expected to be a busy year for consumer privacy. The most significant changes to the Fair Credit Reporting Act (FCRA)--the dominant law that governs the use of personal information in resident and employee screening--will continue to be phased in throughout the year. These amendments to the FCRA--called the Fair and Accurate Credit Transactions Act (FACTA)--will affect every consumer in America by the end of the year.

Despite government attempts to curb identity theft, revelations early in the year that identity thieves had accessed private consumer data at thousands of accounts sparked a firestorm over consumer privacy that shows no sign of abating. Greater public awareness and discussion over breaches in companies' nonpublic data by hackers, "dumpster divers," "phishers" and other identity thieves can be expected to be part of the public debate going forward.

Increased awareness of identity theft's cost and significance in today's Internet economy drove the need for the new FACTA statute. While the problem is particularly pernicious in many major Sunbelt cities, reported identity theft is a growing national issue. As the Federal Trade Commission has reported, 10 million Americans are affected by identity theft or fraud annually, resulting in $50 billion in damages to consumers and creditors alike by fraudsters.

FACTA: ID Theft Antidote 

The FCRA, as amended by FACTA, contains many new provisions that affect apartment owners and their residents, employees and applicants:

* By Sept. 1, for the first time, every consumer in America will be entitled to see, for free, the credit and other information that is the basis for a decision about their rental, mortgage, insurance or employment application. As a result, apartment owners are experiencing more consumer questions about how information from reports are used to set rents and deposits and accept or reject applicants.

* Identity theft alerts, file blocks, file freezes and victim passports give consumers new tools to show they were victims of identity theft. Medical information that had been provided before is now masked to protect the consumer's identity. Apartment firms have begun to see these indicators in their consumer reports and decision pages.

* Apartment firms furnishing data about skips and eviction histories have found that standards for updating and maintaining such data are becoming more rigorous. Some consumer reporting agencies have put new restrictions on the data they accept from furnishers.

* A new records disposal regulation requires apartment firms and other data users to take reasonable procedures to dispose of hard copy and downloaded consumer data. As a result, apartment firms have limited access to old and new applicant files and have reviewed their operations to see if record retention policies were filly implemented.

* Management also is ensuring its collection representatives understand that collection of certain identity theft-related debts is now prohibited.

* Consumers can now go directly to an apartment firm and ask to see file information related to a fraudulent transaction committed in the identity, of the consumer. Well-run apartment firms thus have begun to establish clear procedures to escalate such requests to appropriate management representatives to ensure that data actually is provided to victims and their representatives and not to fraudsters.

The Call for More Change

But as the first quarter of 2005 came to a close, it was clear that the year ahead held the prospect for additional regulation related to identity theft. Disclosures of unauthorized access of more than 1 million consumer files from database companies and prominent banks, retail stores and education institutions, drew renewed attention to consumer data privacy legislation. Mutual fund companies also faced wide coverage of their over-disclosure of account and other personal identifying information.

Disclosures provoked a legislative response, with members of Congress calling for broader disclosure obligations--among other remedies--in the event of data access by unauthorized persons. Affected companies pulled back from providing data to small businesses and restricted the availability of Social Security number information used to verify applicant identities. Apartment owners questioned how their residents' data would be used by screening firms: Would it be resold for marketing or other purposes, and if so, how?

While the outlook for legislation is still unclear, businesses and consumers are asking more and more sophisticated questions of their reporting agencies about the use of consumer data in the screening process. It is reasonable to expect that this Congress will enact, and the president may sign, national disclosure obligations that could extend to CRAs and their apartment firm customers in the event of a security breach.

Fraud Detection

Not all security-related screening obligations were new this year, however. Detecting application fraud in consumers who submit limited application information continues to be an area of interest for well-run apartment firms.

Consumers may not provide certain important personal information in their application for a variety of reasons. As recent immigrants to the country, they may not have valid Social Security numbers (SSNs) or Individual Taxpayer Identification Numbers (ITINs). Rule changes by the Internal Revenue Service have made it more difficult for a consumer to obtain an ITIN without a tax purpose (e.g., for identification purposes only).

Or, applicants may have SSNs but opt not to provide them out of concern for privacy. At least one jurisdiction has extended fair housing protections to applicants who opt not to provide their SSNs.

Where an applicant does not provide a SSN, the ability to identify and properly return matching data about a consumer is increasingly difficult. Though resident screening firms can process these applications, SSNs are one of the most valuable identifiers to enhance search accuracy and completeness. This is particularly true in matching applicant information against criminal history data, from which the courts frequently redact identifying information. Thus, well-run apartment firms make every effort to obtain SSNs and other identifying information to ensure maximum accuracy in the returned match.

Growing incidents of identity theft, along with increased consumer awareness and media coverage of identity theft and fraud, will likely prompt additional legislation regarding consumer credit rights.

This year will continue to be a busy one for consumer privacy obligations affecting all businesses, including apartment firms and a wide range of their business partners. With careful attention to consumer rights and adherence to legislation that controls the use of consumer data, apartment owners will be better equipped to protect consumer information, detect fraud and limit identity theft.

Terrorist Suspect Screening: Follow the Law

Many companies have been alerted to their obligations to verify that an applicant or resident is not a known or suspected terrorist listed on the Office of Foreign Assets Control's list of Specially Designated Nationals and Blocked Persons (SDNs).

Under Presidential Executive Order 13224, issued by President Bush in October 2001, real property transactions, including apartment leases, with these SDNs are "blocked" or prohibited. Even though the prohibition on renting to known or suspected terrorists is not new, many apartment firms have yet to implement this screen. Further, many apartment investor agreements require that management screen each resident against a broad list of known violators that goes well beyond the OFAC SDN list.

Is Your Area High-Risk?

Top 10 major metropolitan areas where identity theft occurred in 2004:

1. Phoenix

2. Riverside-San Bernadino

3. Las Vegas 

4. Dallas-Fort Worth

5. Houston

6. Los Angeles-Long Beach

7. Miami-Fort Lauderdale

8. San Antonio 

9. San Francisco-Oakland

10. San Diego-Carlsbad

Source: Consumer Sentinel's Identity Theft Data Clearinghouse

Questions to Ask A Screening Provider

1. Do you resell to other companies personally identifiable data about residents provided by a customer? If yes, for what purposes is it resold?

2. How do you disclose this resale to consumers?

3. What safeguards do you have in place for setting up accounts before giving data to a customer?

4. What notification procedures do you have in place in the event of a security breach?

5. What lists are in your terrorist suspect screening product?

Jay Harris is Vice President of Business Services for Registry-SafeRent, a First Advantage company. He can be reached at [e-mail].