FTC Alleges Kohl’s Violated Fair Credit Reporting Act By Refusing To Provide Victims of Identity Theft With Complete Records of Questionable Transactions 

Kehoe Law Firm, P.C. is making consumers aware that an FTC complaint against Kohl’s Department Stores alleges Kohl’s violated the Fair Credit Reporting Act (“FCRA”) by refusing to provide victims of identity theft with complete records of questionable transactions – a right the FCRA guarantees to victimized consumers. 

According to the FTC, if, for example, a consumer notices unauthorized charges or lines of credit suggesting they are victims of identity theft, the consumer will need copies of documents from the businesses where those transactions occurred. Once a consumer asks for those documents, Section 609(e) of the Fair Credit Reporting Act gives businesses 30 days to provide the records. The law allows businesses to require proof of identity (like a driver’s license) and proof of the identity theft (like a police report and affidavit), but the whole idea behind the provision is to avoid re-victimizing consumers by tying them up in red tape.

Kohl’s original practice, according to the FTC, was to provide records to victims within 30 days, subject to proper verification. In February 2017, Kohl’s changed its policy and would share information identifying the identify thief only with law enforcement or with a victim’s attorney – not with the victimized consumer.

In August 2018, Kohl’s changed its policy again and gave customers with a Kohl’s charge account a more expansive list of business and transaction records – for example, statements, receipts, and applications. Kohl’s, however, still refused to give them information identifying the alleged thief (including the address and phone number listed on a fraudulent application or the shipping address used for fraudulent orders). Kohl’s also stopped providing that information to victims’ attorneys, which left victims with only one recourse: a direct request from a law enforcement agency.

According to the FTC’s complaint, the company’s revised policies left consumers with no practical way to get the documentation they needed to establish the charges were not theirs. Additionally, individuals whose lives had already been turned upside down by identity thieves now found themselves at odds with Kohl’s. Even when consumers complained to Kohl’s and sent the company copies of Section 609(e) of the FCRA and accompanying FTC guidance documents, the FTC’s complaint alleges that Kohl’s stonewalled them.

According to the FTC, it wasn’t until April 2019 that Kohl’s finally revised its policy to provide victims with the credit application and transaction records for which they asked. The FTC’s complaint charges that Kohl’s violated the FCRA by failing to provide consumers with the records they had a right to under the law. The FTC also says the company violated Section 609(e)’s 30-day requirement. In addition to a $220,000 civil penalty, the settlement requires Kohl’s to provide identity theft victims with business transaction records related to the theft within 30 days. Kohl’s also must post a notice on its website advising victims how to get those records and must certify that it reached out to victims who were unlawfully denied access to those records in the past.

Source: Federal Trade Commission – FTC.gov

Kehoe Law Firm, P.C.