‘Risk Scores’ Often Set Credit Decisions

A week-old Federal Trade Commission decision is the latest in a long-running dispute between consumer groups and credit bureaus over access to information, and it illustrates the difficulties governments are having in regulating the fast-moving and technology-intensive industry.

The commission ruled that federal law does not require credit bureaus to disclose “risk scores” merchants and banks use to gauge how risky you are to lend money to.

The about-face - the agency’s second reversal on this issue - means that consumers are cut off from information, even if inaccurate, that often determines whether they will qualify for many kinds of loans, from mortgages to credit card limits.

Credit-risk scores, which are generated by computer models using information collected on consumers’ credit histories, have become widespread since the 1970s, after the passage of the Fair Credit Reporting Act.

They are used to predict performance - who is likely to pay on time, who will often be late, who is likely to default. More sophisticated models have been designed to predict such things as who will carry a credit card balance-never defaulting, but never paying it all off, either - a profitable type of customer for a credit-card issuer.

Big lenders typically do their own scores, tweaking their models from time to time to get the risk profiles that best suit their needs. The ones generated by the credit bureaus, primarily Equifax Inc., TRW CreditData and Trans Union Corp., are “more of a generic score,” according to an industry spokesman, but they allow smaller businesses to use some of the same techniques as big lenders in making credit decisions.

In its decision last week, the FTC said that a literal reading of the Fair Credit Reporting Act requires a credit bureau to disclose “all information” other than medical data “in its files on the consumer at the time of the request” - and that risk scores are not actually kept in those files.

Some consumer groups called the move a blow to consumers, while the industry called it “correct.”

“I think consumers should have access to any information that’s been collected or used about them,” said Janice Shields of the Center for Study of Responsive Law here.

“Even if they know what’s in their file, they don’t know how it’s being used or how it’s being weighted,” she said.

The Associated Credit Bureaus, the industry trade group, “believes that the commission’s decision on risk scores is the correct one. As has always been our practice, ACB members will continue to provide consumers with full disclosure of their credit file,” the organization said in a statement.

In its original analysis, back in 1990, the FTC said that risk scores did not fall within the fair credit law’s disclosure requirements. However, two years later, the agency changed its mind.

That reversal was based on the agency’s discovery that in some cases the risk score was the only information a credit bureau received, and in part on the legislative history of the Fair Credit Reporting Act.

Last year, the FTC said it thought that the score should be computed at the time of the consumer’s request for his or her file, that it was to be disclosed whether the bureau or a creditor created the system that generated the score and that only a brief explanation was needed.

The industry strongly attacked this proposal during a comment period, and consumer groups defended it. The industry argued that it would be costly, and that the score itself would not mean very much to most consumers.

FTC officials said that as a practical matter the score itself might not be very useful to a consumer, but the decision was based on the letter of the law requiring disclosure of what is actually in the consumer’s file.

“Risk scores are … calculated at the request of the customer,” meaning the merchant that is seeking a credit rating on a customer, said David Medine of the FTC’s Bureau of Consumer Protection. The credit bureau is “always capable of calculating a number but it’s only done upon request. The score is not in its files but would have to be created.”