Recently I applied for rental housing for the first time in several years. I just sold my home and planned to live in an area I’m much less familiar with, and using a realtor to help me learn about neighborhoods to trust or avoid was extremely useful. The property I applied for was owner managed, and the vacancy being filled using another agent. The initial application seemed pretty straight-forward, but while waiting for the approval I received an unsecured email that contained my credit report in PDF. This instantly set off a red flag to me as a renter, consumer and a professional that has spent nearly a decade working in credit reporting.
DON’T EMAIL CLIENT’S SENSITIVE INFORMATION UNSECURED
We live in an age where every other week it seems like you learn about some new type of massive data breach. Yahoo! (YHOO) recently had over 500 million accounts stolen; The U.S. Department of Justice (DOJ) had information on approximately 30,000 government employees released online; Popular social network for professionals, LinkedIn (LNKD) had over 117 million usernames and passwords stolen – and all of these took place within 2016 alone!
Imagine my concern when I saw a completely unencrypted consumer credit report containing my wife and my un-redacted social security numbers among all of our bank accounts, credit accounts and other information sitting in my Gmail. A simple Adobe PDF file with no password security emailed to me with information that could lead to identity theft causing me years of distress and financial loss. Having had mortgages and working with financial institutions I know firsthand that products like DocuSign or Adobe Acrobat with password security exist in order to provide some additional peace of mind in protecting valuable information digitally. Even consumer-initiated tenant screening sites have multiple levels of security and encryption to protect sensitive consumer data. I would have thought a loan officer –from whom I received the credit report – would know better, however this raised another big concern.
NOT ALL CREDIT REPORTS ARE CREATED EQUAL!
Every time a credit report is pulled, there must be a “permissible purpose” such as auto, mortgage, insurance, employment, rental and so on. Turns out the loan officer pulled our credit reports under the wrong purpose and it will now be reflected as in inaccurate inquiry for the next 2 years unless I take up valuable time to initiate a consumer dispute. As a previous and future homeowner this type of credit inquiry could have a derogatory effect the next time I apply for a mortgage.
There is a reason that different reports are used for various functions; credit is an objective resource that can be presented in different ways depending on its intended use. Permissible purposes exist as guidance for consumer reporting agencies to provide accurate reporting that is within a set criteria of what information is okay to furnish based on the consumer’s need. This information is laid out very clearly within § 604 of the Fair Credit Reporting Act (FCRA) introduced and regulated by the Federal Trade Commission (FTC).
For example, a FICO score is not a necessary resource to have for employment screening. It is a scoring model made to demonstrate creditworthiness among other consumers, so on credit reports used in employment the FICO is never included. A mortgage report is developed and organized for the purpose of determining whether consumers should be issued loans valued at substantial amounts. In tenant screening, the credit report is used to determine that the rent can be afforded, and there is no substantial derogatory information that would disqualify them from meeting the set rental criteria.
The violation of the FCRA in using a mortgage credit report for the purpose of tenant screening carries up to a $1,000 fine per incident. These reports are created for specified purposes by the bureaus, and unique accounts for each type of report need to be created. This is something many real estate agents may not be aware of because tri-merge reports are common in home buying, and most lenders will have easy access to provide them. To avoid potential fines, real estate agents should have their own accounts created with companies (such as ApplyConnect®) for the specific purpose of tenant screening in order meet all requirements, including who can view them.
CREDIT REPORTS CANNOT BE FREELY SHARED
As a consumer I care greatly about protecting my personally identifiable information (PII) and stemming off potential identity theft and fraud. The Consumer Financial Protection Bureau (CFPB) as well as the FTC care about protecting consumers as well, which is why there are requirements regarding who can and cannot view a consumer’s credit report. Generally speaking there will be specific parties involved in reviewing credit reports, and only those who need to be involved should.
In regards to tenant screening with a real estate agent involved it would depend on who is making the rental decision. If the owner is making the final decision and reviewing all documentation produced on the applicants, they are the only ones who should have access to the reports. If the agent will be approving or denying applicants then the owner should waive their right of having access to view the credit reports since there would be no reason for them to need to know that information. The owner is entrusting the agent to make an informed and professional decision. In all cases the applicants (consumers) are entitled to a copy of their own reports, but two parties are generally all that should need access to review credit reports. The fewer people involved, the less risk of sensitive information being mistreated.
My personal experience was a bit jarring because I’m much more involved in working with sensitive information than other applicants may be. For this reason most applicants would likely receive a copy of their mortgage credit report when applying for rental housing, and not think much of it. Knowing the risks involved I feel I have a duty to try and educate anyone who may not be familiar in the requirements in an effort to help rental professionals avoid costly mistakes and unnecessary liabilities.
If you have been working with rentals, and have questions about what is and what is not allowed – let us know in the comments section below.
3 Replies to “How a Realtor Lost my Trust with 1 Email”
Great article. One thing that jumped out at me (aside from the fact that the Realtor sent the reports in a PDF) is that the Realtor sent your wife’s report to you without her authorization. As required, we will gladly provide a copy of the credit report to the individual it belongs to. However, not even a husband or wife can request a copy of a report belonging to their spouse.
Thanks for the response, Sandy. In this instance, I didn’t specify, but my wife had submitted a signed authorization as well so that wasn’t an issue here. However, both of our authorizations for very clearly on an “Application to Rent” which means the mortgage credit report was still a violation.