Fair and Accurate Credit Transactions Act of 2003 (identity theft, disposal, truncation, affiliate marketing provisions)
FACTA
Credit reporting · Data security · Financial
FACTA amended the FCRA to fight identity theft. It requires card receipt truncation, fraud alerts, written identity theft prevention programs for creditors (Red Flags Rule), secure disposal of consumer report information, and an opt-out before affiliates use shared data for marketing.
- Where
- Federal
- Citation
- Pub. L. 108-159; 15 U.S.C. 1681c(g), 1681c-1, 1681m(e), 1681s-3, 1681w; 16 CFR Parts 680, 681, 682
- Status
- In force
- In force since
- 2003-12-04
- Last amended
- 2018-05-24
- Enforced by
- FTC, CFPB, and federal banking agencies (by entity type)
- People can sue
- Limited
- Penalties
- FCRA civil liability applies (willful: $100-$1,000 statutory damages plus punitive damages); 15 U.S.C. 1681m(h)(8) bars private suits under 1681n/1681o for any failure to comply with section 1681m (which includes the Red Flags duties), leaving those to administrative enforcement.
- Applies to
- Merchants that accept credit or debit cards (receipt truncation)
- Financial institutions and creditors with covered accounts (Red Flags Rule)
- Any person that maintains consumer report information for a business purpose (Disposal Rule)
- Affiliated companies sharing eligibility information for marketing
Rights it gives people
- Consumers may place initial, extended, and active-duty fraud alerts with nationwide agencies.15 U.S.C. 1681c-1(a)-(c)
- Give consumers notice and an opt-out before using eligibility information received from an affiliate to make marketing solicitations.15 U.S.C. 1681s-3; 16 CFR Part 680
Security duties
- Print no more than the last 5 digits of the card number, and not the expiration date, on electronically printed point-of-sale receipts.15 U.S.C. 1681c(g)
- Financial institutions and creditors with covered accounts must adopt a written Identity Theft Prevention Program to detect and respond to red flags.15 U.S.C. 1681m(e); 16 CFR 681.1(d)
- Dispose of consumer report information by reasonable measures that protect against unauthorized access.15 U.S.C. 1681w; 16 CFR 682.3(a)
Sources
- Official text
- 15 U.S.C. 1681c (OLRC)
- 15 U.S.C. 1681c-1 (OLRC)
- 15 U.S.C. 1681m (OLRC)
- 15 U.S.C. 1681s-3 (OLRC)
- 15 U.S.C. 1681w (OLRC)
- 16 CFR Part 681 (eCFR)
- 16 CFR Part 682 (eCFR)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: FACTA provisions had staggered effective dates; effective_date uses the enactment date | last_amended reflects the 2018 credit-freeze amendment to 1681c-1 (Pub. L. 115-174); Red Flag Program Clarification Act (Pub. L. 111-319, Dec. 18, 2010) amended 1681m
Research reference, not legal advice.