Who This Is For
Mortgage fraud leaders, underwriting and processing managers, and compliance officers responsible for a lender's Identity Theft Prevention Program. Also anyone who has found a fraud alert in a file after closing and had to explain to an examiner why nobody acted on it.
The Section of the Report Nobody Reads
A tri-merge credit report is long, and the underwriter reads it for scores, tradelines, inquiries and public records. The alert messages sit in their own section, sometimes per bureau, sometimes at the top, sometimes as a short coded line between the header and the first tradeline. On a busy desk they get the same glance as the vendor's boilerplate. That is a problem, because some of those lines are legal restrictions on what the lender may do next.
Section 605A of the Fair Credit Reporting Act, 15 U.S.C. 1681c-1, creates three kinds of alert a consumer can place. An initial fraud alert lasts one year. An extended alert, which requires an identity theft report, lasts seven years. An active duty alert, for servicemembers deployed away from their usual station, lasts twelve months. Each one changes what the lender is allowed to do with an application in that consumer's name.
What the Statute Actually Requires
For an initial alert or an active duty alert, subsection (h)(1)(B) says a user of the report may not establish a new credit plan or extension of credit, other than under an open-end plan, in the consumer's name "unless the user utilizes reasonable policies and procedures to form a reasonable belief that the user knows the identity of the person making the request." A purchase or refinance mortgage is an extension of credit, so the restriction applies. If the consumer put a telephone number in the alert, the statute goes further: the user must contact the consumer at that number, or take reasonable steps to verify identity and confirm the application is not the result of identity theft.
For an extended alert, subsection (h)(2)(B) is stricter. The user must contact the consumer in person or using the method of contact the consumer designated in the alert before extending credit.
Two details in that text drive most of what we built. The first is that the number to call is the one in the alert. If the application was filed by an impostor, the phone number on the application is the impostor's, and a verification call to it will be answered by the person you are trying to catch. The second is timing. The restriction is on extending credit, so in principle the check can wait until closing, but a lender that discovers the alert at closing has spent the whole process on a file it may not be able to fund, and has sent disclosures and status updates to whoever filed the application. We recommend doing the verification before underwriting approval, so that is the default the condition is set to, and the lender can move it.
Reading Alerts on Every Pull
The Fraud Agent reads the alert section of every credit report that reaches the file, not only the first. That matters because credit is pulled more than once on many loans. There is the initial tri-merge, sometimes a re-issue after a rescore, and the pre-closing refresh or undisclosed-debt monitoring we wrote about in our post on fresh credit and permissible purpose. A consumer who discovers identity theft in the middle of someone else's application will place an alert after the first pull. If nobody reads the second report's alert section, the file proceeds on a verification that never happened.
For each alert the agent records the type, the bureau or bureaus reporting it, the date placed, any contact number or contact method the consumer designated, and the text of any consumer statement. Then it compares. The designated number is matched against the phone numbers on the application, the loan officer's notes and the borrower's uploaded documents. A match is reassuring but proves little on its own. A mismatch is a finding in itself, and it goes into the Evidence Trail beside the alert, cited to the report page.
Why a Person Makes the Verification Call
We had the technical ability to let a voice agent place the verification call. We decided against it, and the reasons are worth stating because they are about control design rather than capability.
The verification is the control against the application. The system that is processing the application, collecting its documents and moving it toward closing is the wrong party to also decide whether the applicant is real. That is the same separation of duties we apply inside the agent's own decisions, where a checker that is independent of the maker has to agree before anything reaches the loan file. Here the independent party is a person on the lender's fraud or operations team.
The person who answers the alert number may be a victim. If the application is fraudulent, the call reaches someone who just learned that a stranger applied for a mortgage in their name. That conversation needs judgment, and it may become the first step in a referral or a SAR. And voice is the channel most exposed to impersonation now, which we wrote about in our post on voice cloning and caller verification. A verification step should not depend on a voice match.
So the agent prepares the call and does not make it. It creates a condition that blocks clear-to-close, names the alert type and the statutory subsection, gives the designated number or contact method, lists any mismatches it found, and states what the reviewer has to record: who was reached, how, and what they confirmed. The named person's outcome is logged with the condition. If the person at the alert number says they did not apply, the file goes to the lender's fraud team and the agent stops all borrower-facing activity on it, including status messages, because those messages would go to the impostor.
Active Duty Alerts Are Also a Servicemember Signal
An active duty alert triggers the same (h)(1) identity verification. It also tells you something else: the consumer has told a bureau they are on active duty away from their usual station. That is not proof of active duty status, and it should not be used as one. But it is a reason to run the Defense Manpower Data Center check and apply the protections that follow from it, which we covered in our post on SCRA compliance. The agent links the two: an active duty alert on the report creates a DMDC verification task if one is not already in the file.
Address Discrepancies Have Their Own Duty
A notice of address discrepancy is different from an alert. The bureau sends it when the address the lender submitted differs substantially from the addresses in the consumer's file. Regulation V, 12 CFR 1022.82, requires the user to have reasonable policies and procedures to form a reasonable belief that the report relates to the consumer it asked about. Where the user establishes a continuing relationship with the consumer and regularly furnishes to that bureau, which is true of a lender that will service the loan, it must furnish an address it has reasonably confirmed.
People move, and most discrepancies are benign. The work is to tell the benign ones from the others quickly. The agent compares the application address with the report's addresses, the driver's license or other ID, the paystubs' and W-2s' mailing addresses, the bank statements, and on a refinance the title commitment and the hazard declaration. A borrower who moved four months ago and whose new address appears on the recent paystub and the bank statement resolves on the documents. A borrower whose application address appears on nothing else, and whose documents all point to an address the report knows, is an exception with the comparison attached.
Freezes Stop the Pull Entirely
A security freeze is the simplest case and the one that most often confuses borrowers. A frozen file cannot be pulled, so the lender gets no report from that bureau. Freezes have been free to place and lift at each nationwide bureau since 2018, under the same section of the FCRA. The POS and the Document Concierge tell the borrower which bureau is frozen and that they need to lift it temporarily, point them to that bureau's own process, and never ask for the PIN or the bureau login. Asking for credentials is a habit a lender should never train its borrowers to accept.
Where This Sits in the Lender's Program
Alerts and address discrepancies are named red flags in the Identity Theft Red Flags Rule. The FTC's version, 16 CFR Part 681, which covers nonbank mortgage lenders, lists in its Supplement A both "a fraud or active duty alert is included with a consumer report" and a notice of address discrepancy. The banking agencies have parallel rules for banks. A lender's written program has to say how it detects and responds to those flags, and an examiner will ask for evidence that it does on every file, not on the ones someone happened to notice.
That evidence is what the agent produces: every report read, every alert recorded, every discrepancy compared, every verification assigned to a named person, and the outcome logged. The decisions stay with people. Whether a verification was sufficient, whether to deny or withdraw, whether to file a suspicious activity report under the AML program rules for nonbank residential mortgage lenders at 31 CFR 1029.320, all belong to the lender's fraud and BSA staff. The agent's job is to make sure the alert line in the report is never the part nobody read.
Ramkumar Venkataraman
CTO & Co-Founder