Pretexting: getting account information by deception is a federal crime

Listen instead

The same material, read aloud and told more loosely than it is written. Nothing is said in it that this page does not also say.

What pretexting is

The statute does not care whether anyone pretended to be someone else. It cares about the means used to get the information.

Getting, or trying to get, a financial institution's customer information about another person by certain means is a violation. 15 U.S.C. 6821¹ says so for any person. Causing that information to be disclosed to anyone counts the same as obtaining it.

Three means are listed. A false, fictitious or fraudulent statement to an officer, employee or agent of the institution. The same statement to a customer of a financial institution. Or handing the institution's staff a document known to be forged, counterfeit, lost, stolen, fraudulently obtained, or false. 15 U.S.C. 6821 draws those three. And a document, for this purpose, is any information in any form, so the word does not limit the reach to paper. 15 U.S.C. 6827(3)².

Customer information is any information an institution keeps that comes from its relationship with a customer and is tied to that customer. 15 U.S.C. 6827(2). The institutions covered go well past banks. 15 U.S.C. 6827(4)(B) names depository institutions, brokers and dealers, investment advisers and investment companies, insurers, loan and finance companies, card issuers and operators, and the nationwide consumer reporting agencies. An insurer is a financial institution here, which is the kind of thing people miss.

Asking someone else to get the information is a fourth way in. 15 U.S.C. 6821(b) makes it a violation to request a person to obtain the information knowing that person will get it by the prohibited means. So the one who places the order can be on the wrong side of the line without ever speaking to the bank.

The penalty is not administrative. 15 U.S.C. 6823(a)³ makes a knowing and intentional violation, or attempt, a crime: a fine under title 18, up to 5 years in prison, or both. Where the violation rides alongside another federal crime, or sits inside a pattern of illegal activity over $100,000 in a 12-month period, the fine doubles and the prison term can reach 10 years. 15 U.S.C. 6823(b).

Enforcement sits with the Federal Trade Commission, using the powers it holds under the Fair Debt Collection Practices Act. 15 U.S.C. 6822⁴. The banking regulators, the National Credit Union Administration, and the securities bodies must review and revise their regulations and guidelines so the institutions they oversee have policies, procedures and controls to prevent unauthorized disclosure of customer financial information and to deter and detect this activity. 15 U.S.C. 6825⁵. And a debt collector who uses a false representation or deceptive means to obtain information about a consumer has a separate problem under 15 U.S.C. 1692e(10)⁶. State law is not swept away: the federal sections do not supersede it except to the extent it is inconsistent with them, and then only that far. 15 U.S.C. 6824(a)⁷. A state law that protects a person more, as the Federal Trade Commission determines, is not inconsistent. 15 U.S.C. 6824(b).

The exceptions

Section 6821 lists its own exceptions, and they are short and specific. None of them is a general permission for a creditor to call a bank and get an account.

Law enforcement agencies, and their officers, employees and agents, may obtain the information in performing the agency's official duties. 15 U.S.C. 6821(c). A financial institution may obtain its own customer information to test its security, to investigate its own staff, or to recover information another person took by these means. 15 U.S.C. 6821(d). An insurance institution may obtain information in an investigation into criminal activity, fraud, material misrepresentation or material nondisclosure that state law authorizes. 15 U.S.C. 6821(e). And information already available as a public record filed under the securities laws is left alone. 15 U.S.C. 6821(f).

One exception touches collecting a judgment, and only one. A state-licensed private investigator may obtain the information to collect child support from a person a court has adjudged delinquent, to the extent reasonably necessary, only where not unlawful under other law, and only when a court order or judgment authorizes it. 15 U.S.C. 6821(g). It is child support, under a court order, by a licensed investigator. It does not stretch to other debts, and this page will not stretch it by analogy.

The routes the law gives an ordinary judgment creditor run through the court instead. In New York, CPLR 5223⁸ lets a judgment creditor compel disclosure of all matter relevant to satisfying the judgment by serving a subpoena on any person. In Florida, Fla. R. Civ. P. 1.560(b)⁹ requires the court, at the creditor's request, to order the debtor to complete the fact information sheet within 45 days of the order, or another reasonable time the court sets, and Fla. R. Civ. P. Form 1.977¹⁰ asks the debtor to list the checking and savings accounts by number. The account can arrive from the debtor's own hand under court order. It cannot arrive from a lie to a teller.

Questions to ask a vendor

Because the requester can be the one who violates the section, how a report was built is the buyer's question and not only the vendor's.

Where did each account in the report come from: a court process, a public filing, or a person. Those three sources are not the same under the law, and a report that mixes them without saying which is which is a report that cannot be checked. A UCC filing or a court order leaves a paper trail that a reader can go back to. A phone call leaves nothing, unless someone wrote down what was said.

Does anyone, at any step, contact a bank or the debtor. If so, what does that person say about who they are and why they are calling. Then ask the vendor to put its method in writing, and to say in the engagement letter what it will not do. The reason the buyer asks is in the statute: 15 U.S.C. 6821(b) makes requesting the information a violation when the requester knows it will be obtained by false statements. Knowledge is the hinge, and silence about method is not the same as not knowing.

These are questions, not a test any vendor passes or fails on the spot. A clean answer to all three does not certify anything, and a vague answer does not convict anyone. What the questions do is move the method into the light before the report is bought rather than after. For why an account never shows up in a public record in the first place, and why that is the reason the method matters so much, see bank accounts are not in any public record. Whether a given method is lawful, and whether to engage a vendor who uses it, is a question for counsel with the file open.