(a) Consumer reporting agencies shall develop and implement reasonable requirements for what information consumers shall provide to constitute proof of identity for purposes of sections 605A, 605B, and 609(a)(1) of the FCRA. In developing these requirements, the consumer reporting agencies must:

(1) Ensure that the information is sufficient to enable the consumer reporting agency to match consumers with their files; and

(2) Adjust the information to be commensurate with an identifiable risk of harm arising from misidentifying the consumer.

(b) Examples of information that might constitute reasonable information requirements for proof of identity are provided for illustrative purposes only, as follows:

(1) Consumer file match. The identification information of the consumer including his or her full name (first, middle initial, last, suffix), any other or previously used names, current and/or recent full address (street number and name, apt. no., city, state, and zip code), full nine digits of Social Security number, and/or date of birth.

(2) Additional proof of identity. Copies of government issued identification documents, utility bills, and/or other methods of authentication of a person's identity which may include, but would not be limited to, answering questions to which only the consumer might be expected to know the answer.