12 C.F.R. § 1022.123
§ 1022.123 Appropriate proof of identity. (12 CFR Part 1022)
Operative Text
(a) Consumer reporting agencies shall develop and implement reasonable requirements for what information consumers shall provide to constitute proof of identity for purposes of sections 605A, 605B, and 609(a)(1) of the FCRA. In developing these requirements, the consumer reporting agencies must: (1) Ensure that the information is sufficient to enable the consumer reporting agency to match consumers with their files; and (2) Adjust the information to be commensurate with an identifiable risk of harm arising from misidentifying the consumer. (b) Examples of information that might constitute reasonable information requirements for proof of identity are provided for illustrative purposes only, as follows: (1) Consumer file match. The identification information of the consumer including his or her full name (first, middle initial, last, suffix), any other or previously used names, current and/or recent full address (street number and name, apt. no., city, state, and zip code), full nine digits of Social Security number, and/or date of birth. (2) Additional proof of identity. Copies of government issued identification documents, utility bills, and/or other methods of authentication of a person's identity which may include, but would not be limited to, answering questions to which only the consumer might be expected to know the answer.
Under § 1022.123, consumer reporting agencies (CRAs) are required to establish reasonable standards for verifying that a person requesting access to their own credit file, placing a fraud alert, or requesting a security freeze is actually who they claim to be. The requirements must be strong enough to accurately match a consumer to their file, and the level of verification demanded must scale with the risk of harm that could result from a mistaken identity. The regulation offers illustrative examples—such as full name, address, Social Security number, government-issued ID, or knowledge-based questions—but does not mandate any single method.
Plain English — not legal advice.
Although § 1022.123 governs consumer reporting agencies rather than landlords directly, property owners and managers who use tenant screening reports should be aware that the CRAs supplying those reports operate under identity-verification obligations. A compliant screening process generally involves collecting identifying information from applicants that aligns with what CRAs require to pull an accurate file match. Understanding that CRAs must calibrate their proof-of-identity standards to the risk of misidentification can help operators appreciate why applicants may be asked to supply detailed documentation before a report is generated.
General guidance for property managers — not legal advice for your specific situation. Consult an attorney for advice on your case.
Section 1022.123 establishes that when you contact a consumer reporting agency to request your credit file, place a fraud alert, or request a security freeze under the FCRA, the agency is permitted to ask you to verify your identity—but those requirements must be reasonable and proportionate to the risk involved. If you believe a CRA is imposing identity-verification demands that seem excessive or are preventing you from exercising your FCRA rights, you may file a complaint with the Consumer Financial Protection Bureau (CFPB), which oversees this regulation. Tenant-rights organizations and consumer law clinics can also help you understand what documentation is generally considered appropriate under § 1022.123.
General guidance for tenants — not legal advice for your specific situation. Consult a tenant-rights organization or attorney for advice on your case.
Generated September 4, 2026 — auto-generated, not yet human-reviewed. See /transparency for methodology.
Effective Timeline
References Out
No outbound references recorded yet for this provision.
References In
No inbound references recorded yet for this provision.