(a) A consumer may elect to place a security alert in his or her credit report by making a request in writing or by telephone to a consumer credit reporting agency. “Security alert” means a notice placed in a consumer’s credit report, at the request of the consumer, that notifies a recipient of the credit report that the consumer’s identity may have been used without the consumer’s consent to fraudulently obtain goods or services in the consumer’s name.

(b) A consumer credit reporting agency shall notify each person requesting consumer credit information with respect to a consumer of the existence of a security alert in the credit report of that consumer, regardless of whether a full credit report, credit score, or summary report is requested.

(c) Each consumer credit reporting agency shall maintain a toll-free telephone number to accept security alert requests from consumers 24 hours a day, seven days a week.

(d) The toll-free telephone number shall be included in any written disclosure by a consumer credit reporting agency to any consumer pursuant to Section 1785.15 and shall be printed in a clear and conspicuous manner.

(e) A consumer credit reporting agency shall place a security alert on a consumer’s credit report no later than five business days after receiving a request from the consumer.

(f) The security alert shall remain in place for at least 90 days, and a consumer shall have the right to request a renewal of the security alert.

(g) Any person who uses a consumer credit report in connection with the approval of credit based on an application for an extension of credit, or with the purchase, lease, or rental of goods or non-credit-related services and who receives notification of a security alert pursuant to subdivision (a) may not lend money, extend credit, or complete the purchase, lease, or rental of goods or non-credit-related services without taking reasonable steps to verify the consumer’s identity, in order to ensure that the application for an extension of credit or for the purchase, lease, or rental of goods or non-credit-related services is not the result of identity theft. If the consumer has placed a statement with the security alert in his or her file requesting that identity be verified by calling a specified telephone number, any person who receives that statement with the security alert in a consumer’s file pursuant to subdivision (a) shall take reasonable steps to verify the identity of the consumer by contacting the consumer using the specified telephone number prior to lending money, extending credit, or completing the purchase, lease, or rental of goods or non-credit-related services. If a person uses a consumer credit report to facilitate the extension of credit or for another permissible purpose on behalf of a subsidiary, affiliate, agent, assignee, or prospective assignee, that person may verify a consumer’s identity under this section in lieu of the subsidiary, affiliate, agent, assignee, or prospective assignee.

(h) For purposes of this section, “extension of credit” does not include an increase in the dollar limit of an existing open-end credit plan, as defined in Regulation Z issued by the Board of Governors of the Federal Reserve System (12 C.F.R. 226.2), or any change to, or review of, an existing credit account.

(i) If reasonable steps are taken to verify the identity of the consumer pursuant to subdivision (b) of Section 1785.20.3, those steps constitute compliance with the requirements of this section, except that if a consumer has placed a statement including a telephone number with the security alert in his or her file, his or her identity shall be verified by contacting the consumer using that telephone number as specified pursuant to subdivision (g).

(j) A consumer credit reporting agency shall notify each consumer who has requested that a security alert be placed on his or her consumer credit report of the expiration date of the alert.

(k) Notwithstanding Section 1785.19, any consumer credit reporting agency that recklessly, willfully, or intentionally fails to place a security alert pursuant to this section shall be liable for a penalty in an amount of up to two thousand five hundred dollars ($2,500) and reasonable attorneys’ fees.

(Amended by Stats. 2003, Ch. 907, Sec. 1.5. Effective January 1, 2004. Operative July 1, 2004, by Sec. 8 of Ch. 907. Note: Previously, the amendment by Stats. 2003, Ch. 533, was operative from Jan. 1 until July 1, 2004, as authorized by Sec. 6 of Stats. 2003, Ch. 907.)