We believe that banks are prohibited from using credit reports for cross-marketing purposes, unless a bank has the consumer’s written authorization to use the credit report or is complying with appropriate prescreening procedures.

The Fair Credit Reporting Act (FCRA) allows banks to pull credit reports only if they have a certain “permissible purpose” for using the report. 15 USC 1681b. The FCRA also requires that banks have procedures in place to certify the purposes for which the credit report is sought and that the information will be used for no other purposes. 15 USC 1681e(a).

“Permissible purposes” include credit transactions, employment purposes, insurance underwriting, etc. (and “in accordance with the written instructions of the consumer”) 15 USC 1681b(a)(1)–(6). For example, a bank can pull a credit report in connection with an “extension of credit to, or review or collection of an account of, the consumer.” 15 USC 1681b(a)(3)(A). Another permissible purpose is a “legitimate business need” for credit information “in connection with a business transaction that is initiated by the consumer.” 15 USC 1681b(3)(F)(i)

We do not believe that a permissible purpose would include using credit reports or credit scores for cross-selling or marketing purposes. While it may be permissible to pull credit reports for purposes of extending credit to a consumer and for pulling any information in connection with a loan that is initiated by the consumer, use of credit reports beyond those purposes would violate the FCRA. The FTC’s Isaac-Gowen letter (April 29, 1999) supports this conclusion, as that letter concludes that a bank could not obtain credit reports under the pretext of “reviewing” accounts if the bank uses the reports “to market additional credit to current and former borrowers.”

Of course, the FCRA does carve out an exception for permissible prescreening requests that involve the release of limited consumer information (the consumer’s name and address, an identifier that is not unique to the consumer, and other information that does not identify the relationship of the consumer with a particular creditor). 15 USC 1681b(c). The bank may also want to consider including a provision in your account applications or account agreements that allow the bank to obtain a credit report for cross-selling purposes. As discussed in another FTC letter, the consumer’s authorization should clearly authorize the bank to obtain the consumer’s credit report (rather than vaguely stating that “where appropriate, credit bureau reports may be obtained”). FTC Shibley-Brinckerhoff letter (June 8, 1999).