18.3 Privacy, Fraud, and Consumer Protection

Consumer Reports: FCRA and FACTA

Insurers buy consumer reports (credit, claims history via C.L.U.E., motor-vehicle records) to underwrite and price policies. The Fair Credit Reporting Act (FCRA) governs their use. If an insurer takes an adverse action — declining, rating up, or non-renewing based wholly or partly on a report — it must notify the consumer, identify the reporting agency, and explain the right to a free copy and to dispute errors. The Fair and Accurate Credit Transactions Act (FACTA) amended FCRA to add identity-theft protections (fraud alerts, free annual reports, truncated account numbers).

An investigative consumer report, which gathers information through personal interviews about character or reputation, requires advance written disclosure to the consumer.

Privacy: GLBA and the NAIC Model

The Gramm-Leach-Bliley Act (GLBA) requires financial institutions, including insurers, to give consumers a privacy notice at the start of the relationship and annually, describing what nonpublic personal information is collected and shared. Consumers may opt out of certain sharing with nonaffiliated third parties.

The NAIC privacy model draws a tested line by information type:

Memory hook: health = opt-in (harder), financial = opt-out (easier).

Insurance Fraud

Fraud is a knowing misrepresentation made to obtain a benefit the person is not entitled to. Two flavors are tested:

• Soft fraud (opportunistic): padding an otherwise legitimate claim — inflating a real $4,000 theft loss to $6,500.
• Hard fraud (premeditated): staging or fabricating a loss entirely — torching an insured building, faking an accident.

Both are crimes. Many states require a fraud-warning statement on applications and claim forms (e.g., "Any person who knowingly files a false claim is guilty of a crime"). The producer must ensure the warning is present and that the application reflects the applicant's true answers; altering an application is itself fraud.

The 18 U.S.C. 1033/1034 Felony Bar

Federal law (18 U.S.C. 1033/1034) makes it a crime for anyone convicted of a felony involving dishonesty or breach of trust to engage in the business of insurance affecting interstate commerce without written consent (a 1033 waiver) from the state insurance regulator. This bar reaches producers, adjusters, and company employees. It is commonly tested as the reason a prior felon cannot be licensed or employed without express written permission.

Consumer Protections

• Free-look period: a window (commonly 10-30 days) to return a new policy for a full refund; tested more often on life/health but appears on P&C exams as a general consumer right.
• Required disclosures: policy summaries, outline of coverage, and producer identification.
• Replacement rules: when replacing existing coverage, the producer must provide replacement notices so the consumer can compare — the regulatory backstop against twisting and churning from 18.1.
• Privacy of claims data: medical and claims information gathered must be safeguarded and used only for permitted purposes.

Worked Scenario

An insurer non-renews a homeowners policy after a credit-based insurance score drops. Because the decision relied on a consumer report, FCRA requires an adverse-action notice naming the credit-reporting agency and the consumer's right to a free report and to dispute. Skipping that notice is itself a compliance violation, separate from whether the underwriting decision was otherwise lawful.

How the Privacy and Fraud Rules Fit Together

These statutes are tested as a layered system. FCRA/FACTA control the inputs (what reports may be pulled and the notices owed). GLBA and the NAIC model control the outputs (how collected nonpublic information may be shared). Fraud statutes and 18 U.S.C. 1033/1034 police misconduct by both consumers and insurance professionals. Consumer-protection rules (free-look, disclosures, replacement notices) give the policyholder time and information to act. A single exam scenario can touch several layers at once, so identify which layer the question is probing.

Privacy Notice Timing and Content

An insurer that shares only as permitted (servicing the policy, processing claims, complying with law) may be exempt from providing a separate opt-out, but the initial notice is still required.

Producer Compliance Checklist

The producer is the front line for these rules. Practically, that means: deliver the privacy notice at application, confirm the fraud-warning language appears on every application and claim form, never alter an applicant's answers, secure consumer data (locked files, encrypted systems), and deliver every state-mandated disclosure and replacement notice on time. A clean compliance file is also the best defense against the E&O and unfair-practice exposures covered earlier in this unit.

Gramm-Leach-Bliley and Privacy Notices

The Gramm-Leach-Bliley Act (GLBA) governs how financial institutions, including insurers and producers, handle nonpublic personal information. It requires an initial and annual privacy notice describing information-sharing practices and an opt-out before sharing certain data with nonaffiliated third parties, and it mandates safeguards to protect customer data. State insurance-information-privacy laws (modeled on the NAIC) add notice and access rights and limit the use of information gathered during underwriting and claims. Producers must recognize when a privacy notice is required and what triggers an opt-out right.

Fraud Statutes and Consumer Protections

Insurance fraud — knowingly making a false statement to obtain a benefit or in an application — is a crime, and many states require insurers to maintain special investigation units (SIUs) and to include fraud warning statements on applications and claim forms. The federal Fraud and False Statements provisions and state acts make both applicant fraud and insurer/producer fraud punishable.

Consumer protections also flow from the Fair Credit Reporting Act (FCRA/FACTA), which governs the use of consumer and credit-based insurance scores and requires adverse-action notices when information in a report leads to a declination, higher rate, or nonrenewal. The exam tests recognizing which statute supplies a given consumer right or notice obligation.