GLBA pretexting provisions

Pretexting means getting information by pretending to be someone you are not, or by giving a false reason. Section 6821(a) makes it a violation for any person to obtain or attempt to obtain, or cause or attempt to cause to be disclosed to any person, customer information of a financial institution relating to another person in any of three ways:

1. by making a false, fictitious, or fraudulent statement or representation to an officer, employee, or agent of a financial institution;
2. by making a false, fictitious, or fraudulent statement or representation to a customer of a financial institution; or
3. by providing any document to an officer, employee, or agent of a financial institution, knowing that it is forged, counterfeit, lost, or stolen, was fraudulently obtained, or contains a false, fictitious, or fraudulent statement or representation.

Lying to the account holder, not only to the bank, is covered.

Section 6821(b) adds a second violation: requesting a person to obtain customer information, knowing that the person will obtain or attempt to obtain it in any manner described in 6821(a). Hiring a broker who you know will use a pretext falls within this.

Customer information of a financial institution means any information maintained by or for a financial institution which is derived from the relationship between the institution and a customer and is identified with the customer (6827(2)). A document means any information in any form (6827(3)).

The definition of financial institution is broad. It covers any institution engaged in the business of providing financial services to customers who maintain a credit, deposit, trust, or other financial account or relationship with it. The statute names examples, including depository institutions, brokers and dealers, investment advisers, insurance companies, loan or finance companies, credit card issuers, and consumer reporting agencies that compile and maintain files on consumers on a nationwide basis (6827(4)).

Section 6821 lists a small number of situations it does not prevent:

• Law enforcement (6821(c)). Action by a law enforcement agency, or its officers, employees, or agents, to obtain customer information in connection with the performance of the agency’s official duties.
• Financial institutions (6821(d)). An institution obtaining its own customer information while testing its security procedures, investigating allegations of misconduct or negligence by its own officers, employees, or agents, or recovering customer information that someone else obtained in a prohibited way.
• Insurance investigations (6821(e)). An insurance institution obtaining information as part of an insurance investigation into criminal activity, fraud, material misrepresentation, or material nondisclosure that is authorized for it under state law, regulation, interpretation, or order.
• Securities filings (6821(f)). Obtaining customer information that is otherwise available as a public record filed under the securities laws.
• Child support (6821(g)). A State-licensed private investigator, or the investigator’s officers, employees, or agents, obtaining customer information to the extent reasonably necessary to collect child support from a person adjudged delinquent by a federal or state court. The action must not be unlawful under any other federal or state law or regulation, and it must be authorized by an order or judgment of a court of competent jurisdiction.

Outside the child support exception, a private investigator license gives no permission to obtain financial account information by pretext.

Whoever knowingly and intentionally violates, or attempts to violate, section 6821 shall be fined in accordance with Title 18, imprisoned for not more than 5 years, or both (6823(a)).

An enhanced penalty applies to a violation committed while violating another federal law, or as part of a pattern of illegal activity involving more than $100,000 in a 12-month period. The penalty is twice the fine provided in 18 U.S.C. 3571(b)(3) or (c)(3), imprisonment for not more than 10 years, or both (6823(b)).

The Federal Trade Commission enforces the subchapter with the same powers it has under the Fair Debt Collection Practices Act (6822(a)). Federal banking regulators and the National Credit Union Administration enforce it for the institutions they supervise (6822(b)).

State law can go further. The subchapter does not supersede state law except to the extent of an inconsistency (6824(a)), and a state law is not inconsistent if the protection it gives is greater than the subchapter’s, as determined by the Federal Trade Commission (6824(b)).

The first reason is the law itself. Pretexting a bank or a customer for account information is a federal crime, and so is knowingly sending someone else to do it.

The second reason is the case. Information obtained by a crime can expose the investigator, the client, and the retaining attorney to liability, and can damage the matter it was meant to support.

The third reason is trust. USCLI’s Code of Conduct and its position on honest representation of authority both rest on the same idea: investigators do not misrepresent who they are to get information.

• Financial account information usually reaches a case through lawful channels such as consent of the account holder, subpoena, court order, or discovery.
• A vendor that offers bank balances or transaction details without such a channel raises a 6821(b) question for anyone who orders from it knowing how the data is obtained.
• The child support exception has several conditions. All of them apply at once: state licensure, a court adjudication of delinquency, a court order or judgment authorizing the action, and no conflict with other law.

• 15 U.S.C. 6821, Privacy protection for customer information of financial institutions
• 15 U.S.C. 6822, Administrative enforcement
• 15 U.S.C. 6823, Criminal penalty
• 15 U.S.C. 6824, Relation to State laws
• 15 U.S.C. 6827, Definitions
• 15 U.S.C. chapter 94, subchapter II, official text on govinfo
• Federal Trade Commission, Gramm-Leach-Bliley Act