Congressional Documents and Publications

Mr. Chairman, and Members of the Subcommittee, thank you for the opportunity to testify before the Subcommittee. My name is Evan Hendricks, Editor & Publisher of Privacy Times, a Washington newsletter since 1981. For the past 33 years, I have studied, reported on and published on a wide range of privacy issues, including credit, medical, employment, Internet, communications and government records. I have authored books about privacy and the Freedom of Information Act. I have served as an expert witness in litigation, and as an expert consultant for government agencies and corporations.

I am the author of the book, "Credit Scores and Credit Reports: How The System Really Works, What You Can Do." (3rd Edition, Privacy Times 2007).

Testimony

Credit Scores

* Consumers should be entitled to one free credit score per year, and it specifically should be for a credit score that is used by a majority of lenders. (Not a so-called "educational" score.)

* Companies that sell credit scores should prominently disclose whether their score is

(1) used by any lenders; (2) used by a majority of lenders.

* Congress should prohibit contract language that prevents "resellers" (independent credit bureaus) from selling or disclosing directly to consumers the credit scores or specialized credit reports that they compile in the form of "tri-merge" reports or other reports.

* Consumer reporting agencies (CRAs) should be required to disclose publicly how many credit scores they sell and their gross revenues from those sales.

Consumer Reports & Consumer Reporting Agencies (CRAs)

* Experian, Equifax & TransUnion ("The Big Three" CRAs) naturally want to automate their operations to the greatest extent practicable to reduce costs. However, at times the manner in which they automate contravenes the FCRA's central goals of accuracy and fairness. For example, Experian encourages consumers to go online to its Web site to dispute errors in their credit report. But if they do, it's unlikely that any human being at Experian will evaluate the consumer's dispute, no matter how complex or nuanced it is.

* The Big Three sometimes fail to satisfactorily resolve consumers' legitimate disputes because instead of truly reinvestigating disputes, they electronically notify the creditor of the dispute, and then permit the creditor to dictate the results via the creditor's e-response. This helps explain why we continue to see absurd results, like CRAs and creditors "verifying" that a living consumer is "dead," or that a 22-year-old is responsible for a credit card that was opened 10 years ago.

* In the FCRA, Congress declared, "There is a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy." Yet there have been instances in which CRAs, when confronted with their specific failures to ensure accuracy or correct inaccurate disputed data, have argued that they are like "libraries" that passively receive data from creditors similar to the way in which libraries put books on the shelf without screening them. The reality is that the Big Three see their primary duty to faithfully put on consumers' reports what creditors and debt collectors dictate - even when there is compelling evidence to the contrary (e.g., I'm not dead!).

Inaccuracy

* Consequently, inaccuracy continues to be a significant problem. Some of the leading consequences of chronic inaccuracy continue to be mixed files, identity theft or erroneous furnishing by creditors and debt collectors.

* Inaccuracy problems are reflected in the latest FTC complaint statistics. Two of the leading complaint categories - Identity Theft (278,078, 21%) and Debt Collection (119,549, 9%) - are closely tied to credit reporting inaccuracy. Moreover, 31,629 (2%) Americans complained about credit bureaus and information furnishers, and Report Users 41,448 (3%) complained about credit protection/repair or advance-fee loans. This meant that up to 1/3 of complaints to the FTC potentially related to credit report inaccuracies. n1

* As Congress is aware, there have been several studies by non-industry groups finding significant rates of inaccuracy. n2 While the CRAs have criticized these studies, it is absolutely crucial to note that the CRAs themselves have testified that they have not conducted their own accuracy studies - despite the fact that they have all of the data, and despite the FCRA's requirement that they maintain "reasonable procedures for maximum possible accuracy." (The CRAs' trade association did hire Arthur Anderson to do a study in 1992, but it was not well received.)

* Congress recognized this problem in the FACT Act Amendments of 2003, mandating that the FTC conduct accuracy studies. Unfortunately, the FTC's preliminary efforts a few years ago were inadequate in both process and product, at least partly because of the choice of contractors. The FTC currently is about to select a new contractor, but I fear that the effort still lacks the necessary ongoing guidance and expertise, as well as the fundamental understanding that the FCRA is a consumer protection statute and credit report accuracy is first and foremost a consumer protection issue.

Those 'Other CRAs'

* In addition to the Big Three, there are many "specialty" CRAs, specializing in employment background checks, tenants, prescription drugs, retail customers, and utilities. The problem is that we do not know how many. There is no comprehensive list of CRAs. The best list is maintained by the Privacy Rights Clearinghouse. (www.privacyrights.org)

* It is vital that consumers know that CRAs exist so they can see copies of their reports. Accordingly, I recommend that Congress require all CRAs - big and small - to register with the Federal Trade Commission it can publish and update a list of operating CRAs, allowing consumers to know where data on them reside.

* The National Consumer Telecom & Utilities Exchange, Inc. (NCTUE) is a stellar example of the lack of transparency. NCTUE is owned by its members, several major utilities and telecom companies, which NCTUE declined to name when asked by Privacy Times. Member utilities and telecoms check applicants against the NCTUE database, which is operated by Equifax, to see if they have unpaid bills. If the check turns up derogatory data, the applicant presumably is rejected or charged a higher deposit or rate. The first problem is that it is not clear whether members were providing "adverse action" notices to consumers so they'd know they were negatively affected by an NCTUE report. The second problem is that Privacy Times and others were unable to learn how and from whom consumers could request copies of their reports. NCTUE simply declined to answer these questions. (Story attached.)

Employment Background Screening

* We are seeing increasing problems with employment background screening companies, in part, because too many of them are willing to sell a report on a job applicant based merely on a match of a name and date-of-birth. They don't even require a match on the Social Security number or the last four digits of the SSN.

* I have seen cases in which hard-working, law abiding Americans were rejected for jobs because this sloppy matching approach caused them to be associated with the crimes of people with similar names. Frankly, I think this is actionable under the FCRA, but there are few, if any, enforcement actions to point to.

* Given the job market, and the inherent inaccuracies in public records, and the reckless approach taken by too many employment background screening companies, better enforcement of existing laws, and more stringent laws are necessary to protect innocent consumers.

Enforcement

* The FCRA is a good law, but one of its biggest shortcomings was assigning enforcement relating to creditors' "data-furnishing" to the federal banking agencies. In the last 12 years, those agencies have not brought a meaningful enforcement action, despite abundance evidence that too many creditors do not exercise adequate care when furnishing data to credit bureaus. Enforcement should be stripped from those agencies and assigned to entity that will live up to its duty to enforce standards of accuracy and fairness.

* The history of the FCRA underscores the importance of private enforcement in achieving the law's goals of accuracy, fairness and privacy. Although time constraints don't permit it here, my hope is that the Subcommittee could be supplied with the impressive list of consumer lawsuits that have improved protections for consumers and/or caused companies to improve their credit reporting policies and practices.

* The debate has raged for sometime about who "owns" personal data. In fact, current law makes at least some companies the "owners" of personal data they collect in the course of business. But most would agree that the intimate details about our private lives are more than just a commodity. The reality is that in the context of the United States' information-age economy, our personal information is a new type of natural or public resource. Defining it as such would seem to have dramatic implications for public policy. At earlier times in history, the conclusion that electricity, or water, or the airwaves were public resources resulted in the development of new infrastructures for administration and enforcement. Those infrastructures in no way ended the debate over how the resources were distributed and used, as new controversies arose through the years. Given the importance of credit reporting data to individual Americans and to our economy as a whole, I believe we should keep in mind the need for closer regulation and enforcement.

Credit Scores & American Consumers: Only Half Way There

This is a very important hearing, as it highlights how far we have come on the issue of credit scores, while at the same time underscoring how far we have to go.

The bottom line is that consumers cannot obtain, prior to applying for credit, the actual credit scores that lenders use to judge them. This is because the three major credit reporting agencies (CRAs) use contracts to prohibit resellers from providing consumers with their "tri-merge reports," the version of credit reports sold to lenders. Tri-merge reports and other creditor-version reports, and the credit scores associated them, are truly where the "rubber meets the road," for American consumers. They remain the "secret sauce" that consumers may not access. Congress can and should change this.

Moreover, the proliferation and sale of credit scores not used by lenders can cause confusion and even mislead consumers in a manner that is patently unfair. At a minimum, Congress can and should provide for greater transparency and fairness.

Credit Score: A History of Secrecy

When use of credit scores first became widespread in the mid-1990s, they were completely secret. First, lenders did not inform consumers that credit scores existed or that they were using them. Despite their importance consumers were not told how they were calculated or who was using them.

When people began learning that credit scores existed, and would ask to see them, lenders and the credit reporting agencies (CRAs) refused to provide them. n3

In fact, the Federal Trade Commission (FTC) put out an opinion stating that federal law did not require the credit bureaus to reveal credit scores to consumers who requested their credit reports. This was in part, because the 1996 revisions to the Fair Credit Reporting Act (FCRA) specified disclosure was not required of "any information concerning credit scores or any other risk scores or predictors relating to the consumer." n4

Public criticism of this policy mounted as the vital role of credit scores in credit and insurance decision-making became evident. The changing environment was best illustrated by a situation that arose in February 2000 at E-Loan, an Internet lender that could quickly approve mortgage and auto loans, in part because credit scores facilitated automated decision-making. To better advise consumers where they stood, E-Loan decided to tell prospective loan applicants their FICO scores--a radical move at the time. Within a month, thousands of people took advantage of the service. n5

But the move sparked an uproar in the credit industry, as two of the three national credit reporting agencies (CRAs) moved to cut off E-Loan's use of credit scores. E-Loan ultimately prevailed when California passed a state law, sponsored by State Senator Liz Figueroa, requiring lenders to provide California mortgage and home equity applicants with the score used in their loan decision. The law also required Equifax, Experian and Trans Union to disclose credit scores to consumers who requested them.

"The passage of this law is a giant step forward for California consumers, but there's still more that needs to be done," said Chris Larsen, E-Loan's Chairman and CEO. "This is information that should be readily and freely available to consumers nationwide. There should be very little difference between getting information about a stock or mutual fund and finding out your credit score. Just like consumers can research an investment before they commit their money to it, consumers should have free access to information about their credit score before they apply for a loan." n6

FACT Act: Another Step Forward

In 2003, Congress took a major step forward in fulfilling Larsen's plea.

The Amendments to the FCRA, known as the FACT Act, require credit bureaus, for a "fair and reasonable" fee, to disclose to consumers their credit scores and how those scores are determined. Moreover, the Act for the first time required mortgage lenders and brokers to provide scores that were pulled in connection with their mortgage or re-financing applications. This was important because the CRAs by contract prohibited lenders from giving consumers the actual scores by which they were being judged.

However, the FACT Act does not require CRAs to provide consumers with the scores that lenders actually use. Instead, CRAs can disclose "educational scores," meaning FICO "knock-offs" or "FAKOs," that approximate scores used by lenders, but which can differ significantly.

This means that a consumer, who is trying to be diligent and find out what his or her credit score is before applying for credit, will pay for a "FAKO" score that might be higher than the one ultimately pulled by the lender. When the consumer applies for credit, she learns that she was not as creditworthy as she thought, and doesn't qualify for the interest rate she expected. We have heard of several such anecdotal cases.

Two of the major CRAs - Experian and TransUnion - prominently push their own knock-off scores - the Experian Plus score and the TU TrueCredit score. The Plus score is also pushed at the notorious FreeCreditReport.com, which is run by Experian subsidiary ConsumerInfo.com. While the traditional FICO score on which consumers are judged uses a range of 350-850, TrueCredit Score uses a different range, going up to 950. Neither Experian nor TransUnion prominently inform consumers that the scores they are selling are not used by lenders and may differ significantly from the FICO scores used by lenders. n7

To top it off, the three CRAs joined forces to create the "VantageScore," which features a range of 501 to 990. Although it was unveiled with great fanfare in March 2006, it does not appear that VantageScore has achieved significant market penetration. However, it has added to the confusion that uninitiated consumers experience when they try to understand what their actual score is.

At a minimum, fundamental fairness dictates that sellers of knock-off scores clearly and conspicuously disclose that their scores are not used by lenders and may differ significantly from the ones that are.

Epitome of Unfairness: No Consumer Access To Actual Credit Scores

Consumers can purchase their FICO scores through Equifax or through Fair Isaac's Web site, www.myfico.com. These are likely to be the closest to the actual scores pulled by lenders when the consumer applies for credit. Moreover, knowledgeable consumers who know to ask can obtain, after-the-fact, their actual FICO scores that were pulled by lenders - thanks to the FACT Act Amendments.

However, consumers, prior to a major credit application, still cannot even purchase the actual scores that lenders pull.

Why? It is an artificial barrier unilaterally imposed by the three CRAs through their contracts with "resellers," i.e., which include the small, independent credit bureaus that compile "tri-merge" reports for the mortgage industry. Tri-merge reports are the "subscriber" (i.e., creditor) versions of the credit report. They can have more information because the CRAs attempt to include in them the maximum possible information that might relate to the consumer - in essence, so no negative item is missed. Thus, Tri-merge reports and "subscriber" versions of credit reports are the "secret sauce" to which consumers still do not have access in advance of applying for credit.

This is unconscionable, in my opinion. Congress should make it illegal for CRAs to prohibit by contract or any other means the sale or purchase of tri-merge reports or subscriber versions, and the actual credit scores associated with them. This is not only patently unfair to consumers, it is an unacceptable barrier to commerce. Not only would some educated consumers be interested in buying their actual scores, but enterprising companies that base their business model on serving as the consumer's advocate would also greatly expand the market.

It is important to understand that even if a consumer buys his FICO score, it could differ significantly from the FICO score pulled by the lender.

This is because the CRAs use "partial matching" algorithms in determining what information to sell to lenders, but use more exact matching of identifiers when determining what information to include on a report disclosed directly to a requesting consumer.

The following passage from my book, Credit Scores & Credit Reports: How The System Really Works, What You Can Do, helps explain:

The three CRAs each store this information in their own massive database. The CRA databases include data on virtually all American adult users of credit-- an estimated 205 million people. n8

A credit report is not fully assembled until the CRAs have a reason to assemble one. For instance, when a consumer applies for credit, the credit grantor or "subscriber" relays to the CRA identifying data from the consumer's credit application, at a minimum, name and address, often the SSN, and sometimes date of birth. (It's worth noting that the CRA can return a credit report to the credit grantor without an SSN.)

This is when the key moment occurs. Applying this identifying or "indicative" data, the CRA's algorithm then decides which information in the database relates to or "matches" that consumer, and then "returns" to the credit grantor (subscriber) a consumer credit report consisting of this information. Thus, it is the algorithm, or "business rule," that decides which data go into your credit report.

The Search Logic/Algorithm

In the Matthew Kirkpatrick trial cited in the previous chapter, Equifax Vice President Phyllis Dorman said that when "building a file" after receiving data from a creditor, or when deciding what data to include on a credit report that will be disclosed to the creditor, the first factor considered by the Equifax system is geographic region.

Then its "matching algorithm," known as L90, relies on 13 matching elements. Two of the elements that constitute a distinct category are: (1) exact Social Security number (SSN) and (2) partial SSN (meaning that most, but not all digits are the same). n9

The remaining elements are (3) last name, (4) first name, (5) middle name, (6) suffix, (7) age, (8) gender, (9) street number, (10) street name, n10 (11) apartment number, (12) City, state and zip, and (13) trade account number.

There is a very important difference in how the system works when you ask to see a copy of your own credit report as opposed to how it works when a subscriber asks the CRA for your credit report. One reason for this is that the CRAs have a duty to ensure that they do not give your credit report to anyone who does not have a permissible purpose to see it--particularly someone who is trying to impersonate you or otherwise do you harm. Accordingly, when you ask for your own report, you are required to give extensive identifying information to authenticate yourself--to prove that you are really you. This also enables the CRA's algorithm to more concisely assign the proper accounts to your credit report.

However, it can be a very different story when a credit grantor or other subscriber asks for your credit report. For starters, the setting is different. To have instant access to credit reports, subscribers must sign contracts pledging to only use credit reports for permissible purposes, to abide by other restrictions, and comply with the FCRA. CRAs look at their subscribers as members of a trusted circle who know and play by the rules.

More importantly, the priorities are different. Since the subscriber is buying the credit report in order to decide whether or not to grant you credit, the CRA wants to ensure that it does not leave out anything that could be relevant to that decision. After all, if the CRA failed to include evidence of late payments in your credit report, and you default, the credit grantor is going to blame the CRA. Another factor is the credit grantor might only have limited information about the consumer, like name and address, and no SSN, or its employee might have written down the SSN incorrectly. Therefore, the CRA seeks to maximize disclosure of any possible information that might relate to the consumer about whom a subscriber inquires. This becomes trickier when the CRA conducts the search based upon very limited, or even imperfect, identification information.

To accomplish this, the CRAs' algorithms are designed to accommodate such errors as transposed digits within SSNs, misspellings, nick names, and changed last names (women who marry), and different addresses (people who move), by accepting "partial matches" of SSNs and first names, and in some circumstances, assigning less importance to last names.

Thus, while you must provide an exact match of your SSN to obtain your own credit report, a subscriber can still obtain your credit report even if there is a match of only seven of the nine digits in your SSN. What's more: if the SSN on the credit application exactly matches yours, the CRAs' algorithms often will tolerate major discrepancies in last name, street address, city, and state.

Accordingly, it's quite possible that the "subscriber" credit report sent to the company holding your credit application will have more data than the credit report you obtained directly from the credit bureau. There have been occasions when a subscriber will reject an application for credit based on information in a credit report, but when the consumer gets her own report, the information isn't there. It was only in the subscriber report.

Conclusion

Again, thank you for the honor and privilege of testifying before the subcommittee. Although the FCRA is one of the best information-privacy laws on the books, the nature of credit scoring and reporting requires ongoing modernization and vigilant enforcement.

I look forward to working with the subcommittee. I am happy to answer your questions.

n1 http://www.ftc.gov/opa/2010/02/2009fraud.shtm

n2 See discussion of credit report errors in "Consumer Reporting Reform Act of 1994," Report of the House Committee on Banking, Finance & Urban Affairs, (Rpt. No. 103-486, 103rd Congress, 2nd Session), "Consumer advocates, state law enforcement officials, and federal regulators all testified that the number of errors in consumer reports was unacceptably high and that the process for reinvestigating consumer disputes was lengthy and inefficient. The FTC testified that the number of complaints about the credit reporting industry exceeded the number of any other category of complaints in both 1991 and 1992... " The committee report also cited several studies, starting with (1) James Williams (CIS), "Credit File Errors, A Report," August 7, 1989 --A survey of 1,500 consumer reports and found serious error rate of 42% to 47%; and (2) Consumers Union, "What Are They Saying About Me? The Results of a Review of 161 Credit Reports From The Three Major Credit Bureaus, April 29, 1991 -- 48% contained "serious errors," defined as meaning those that could, or did, cause the denial of credit, employment or insurance. [I currently do not have copies of these two studies.] The committee report also cited the three U.S. PIRG studies listed below, as well as various consent agreements, discussed below, between the three major credit bureaus and/or the FTC and/or State Attorneys General. U.S. Public Interest Research Group (US PIRG), "Nightmare On Credit Street (Or How The Credit Bureau Ruined My Life): Case Studies Documenting Consumer Complaints and Recommendation For Amending the FCRA," June 12, 1990. U.S. Public Interest Research Group (US PIRG), "Don't Call; Don't Write; We Don't Care." 1991 -- Review of 156 consumer report complaints on file at the FTC revealed that the average duration of complaints against a CRA was 22.5 weeks, or almost 6 months U.S. Public Interest Research Group (US PIRG), "Public Enemy #1 At The FTC " October 1993, Based upon a Freedom of Information Act request, the 1993 report found that between 1990-93, problems with credit bureaus was the leading cause of complaints to the FTC (30,901, 20.6%). The 1993 PIRG found that 44% of complaints concerned mixed files, and that among those, 64% involved the mixing of data with total strangers. U.S. Public Interest Research Group (US PIRG), "Mistakes Do Happen: Credit Report Errors Mean Consumers Lose," March 1998 "Credit Reports: How Do Potential Lenders See You?" ConsumerReports.org, July 2000. Consumer Federation of America and National Credit Reporting Association, Credit Score Accuracy and Implications for Consumers, December 2002. Robert Avery, Paul Calem, Glenn Canner, and Raphael Bostic, "An Overview of Consumer Data and Credit Reporting," Federal Reserve Bulletin, February 2003. U.S. Public Interest Research Group (US PIRG), "Mistakes Do Happen: A Look at Credit Report Errors," June 2004

n3 One of the first to report on credit scores and their importance was Michelle Singletary of the Washington Post in the mid-1990s.

n4 15 U.S.C. Sect. 1681g(a)(1)

n5 E-Loan Opens Over 10,000 Personalized Loan Management Accounts In First Month," E-Loan Press Release, March 23, 2000

n6 E-LOAN, Inc., A Full Credit Score Disclosure Pioneer, Calls For National Legislation," E-Loan Press Release, June 27, 2001

n7 In its terms and conditions, Experian and its subsidiary ConsumerInfo.com, which runs FreeCreditReport.com, states, "The PLUS Score(R), developed by Experian, and the different risk levels presented by it, are for educational use only. The PLUS Score(R) is not currently sold to lenders, and is not an endorsement or guarantee of your credit worthiness as seen by lenders. Please be aware that there are many scoring models used in the marketplace. Each scoring model may have its own set of factors and scale. The information and credit scoring model may be different than that used by a lender. The PLUS Score(R) may not be identical in every respect to any other credit score produced by another company or used by your lender. The PLUS Score(R) is not a so-called FICO score, and may differ for a variety of reasons."

n8 www.experian.com/small_business/knowledge.html, visited 9/14/07.

n9 Testimony of Phyllis Dorman, Matthew Kirkpatrick v. Equifax Credit Information Services, U.S. Dist. Ct., Oregon, CV-02-1197-MO; 1/20/05

n10 Some algorithms may only use the first 4-to-6 characters of the number-address field, which would mean that "123 Main Street" would match "123 Mainwright Street."

#DAL1234#