A consumer reporting agency that failed to properly screen prospective customers and, as a result, sold at least 318 credit reports to identity thieves, has agreed to settle Federal Trade Commission charges that it violated federal law. Under the settlement, the company and its principal must ensure that they provide credit reports only to legitimate businesses for lawful purposes, use a comprehensive information security program, and obtain independent audits every other year for 20 years. The settlement also imposes a $500,000 penalty but suspends payment due to the defendants’ inability to pay.

According to the FTC, the defendants use sensitive financial data from other consumer reporting agencies to create reports that landlords use to assess potential renters. These reports contain consumers’ names, Social Security numbers, birth dates, bank and credit card account numbers, credit histories, and other personal information. The Commission alleges that the company failed to properly screen new customers. The company allegedly requested only publicly-available information from applicants seeking credit reports, and it did not request supporting documentation to establish that an applicant was actually a landlord renting property. As a result, identity thieves posing as property owners were given an account with unlimited online access to credit reports, and the account was used to access at least 318 reports containing sensitive personal information.

The FTC charged the defendants with violating the Fair Credit Reporting Act (FCRA) by furnishing credit reports to persons who did not have a permissible purpose to obtain them, and by failing to maintain reasonable procedures to prevent such impermissible disclosures and to verify their customers’ identities and how they intended to use the information. The agency also charged them with violating the FTC Act by failing to employ reasonable and appropriate security measures to protect sensitive consumer information. Specifically, they allegedly engaged in an unfair practice by failing to have reasonable policies and procedures to verify or authenticate the identities and qualifications of prospective customers, and to monitor or otherwise identify unauthorized customer activity.

The settlement bars the defendants from furnishing a credit report to anyone who lacks a permissible purpose to receive the report. It also requires them to maintain reasonable procedures to limit the furnishing of credit reports to persons with a permissible purpose to have them, and to ensure that credit reports are resold only for such a purpose. The company also must employ a comprehensive information security program to protect the security, confidentiality, and integrity of consumers’ personal information, and it must obtain, every other year for the next 20 years, an audit from a qualified, independent, third-party professional to ensure that its security program meets the standards of the order.

The settlement imposes a $500,000 judgment, which is suspended based on the defendants’ inability to pay. The full judgment will be imposed if they are found to have misrepresented their financial condition. The settlement also contains record-keeping and reporting provisions to allow the FTC to monitor compliance with the order.

The defendants are Rental Research Services, Inc. and Lee Mikkelson, both located in Eden Prairie, Minnesota. The Commission vote to authorize staff to refer the complaint and stipulated final order to the Department of Justice for filing was 4-0. The documents were filed in the U.S. District Court for the District of Minnesota.

NOTE: The Commission files a complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. The complaint is not a finding or ruling that the defendants have actually violated the law. The case will be decided by the court. Stipulated final orders are for settlement purposes only and do not constitute an admission by the defendant of a law violation. A stipulated final order requires approval by the court and has the force of law when signed by the judge.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC’s online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 1,500 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s Web site provides free information on a variety of consumer topics.

MEDIA CONTACT:

Frank Dorman
Office of Public Affairs
202-326-2674

STAFF CONTACT:

Sandra McCarthy,
Bureau of Consumer Protection
202-326-2531

(FTC File No. 0723228)
(Rental Research Services)