Declined for suspected fraud: what the notice may and may not say

When a card or loan application is refused because the identity behind it could not be verified, the applicant still receives an adverse action notice, and what that notice says is governed by two rules that appear to contradict each other. Regulation B requires a statement of the specific principal reasons for the refusal and rejects anything vague. The suspicious activity reporting rule prohibits a bank from disclosing a report or any information that would reveal one exists. Write the letter badly and you breach one of them. The way through is narrower than most teams expect, and it is written into Regulation B's own sample forms. Botminds' Synthetic Identity Fraud Detection is built around that line: the drafted notice carries only what could not be verified about this applicant, and nothing about the ring they were linked to.

This matters more in fraud than anywhere else in lending because the real reason and the sayable reason are different sentences. The real reason is that fourteen applications shared a voice-over-internet phone line, a handset and a mail-receiving address. The sayable reason is about this applicant alone, and must be true of them.

The rules below are quoted from the regulations and linked where they appear. The worked case and the screens are the solution's sample data, on a fictional issuer with fictional applicants. Nothing here is legal advice: a notice template belongs to your own counsel.

Two rules that point opposite ways on one letter

Start with what counts as adverse action at all, because fraud teams routinely take three actions that qualify. The definition covers "a refusal to grant credit in substantially the amount or on substantially the terms requested in an application unless the creditor makes a counteroffer … and the applicant uses or expressly accepts the credit offered," a "termination of an account or an unfavorable change in the terms of an account that does not affect all or substantially all of a class of the creditor's accounts," and "a refusal to increase the amount of credit available to an applicant who has made an application for an increase" (12 CFR 1002.2(c)(1)).

Read against a ring decision, that is three separate notice obligations from one investigation: the new applications refused, the booked accounts closed, and the limit increases denied. In the sample case that is five declines, four closures and three denied increases — twelve letters, not one.

On the other side stands the reporting rule, which is categorical: "No bank, and no director, officer, employee, or agent of any bank, shall disclose a SAR or any information that would reveal the existence of a SAR" (31 CFR 1020.320(e)(1)). There is no materiality test and no good-faith exception in that sentence. A notice that hints at a filing is a problem regardless of how carefully it was hinted.

What Regulation B requires of the reason

The timing is the easy part: a creditor must notify an applicant of action taken within 30 days of receiving a completed application, with parallel 30-day clocks for adverse action on an incomplete application and on an existing account.

The content is where fraud declines go wrong. The statement of reasons "must be specific and indicate the principal reason(s) for the adverse action," and the rule then names two things that will not do: "Statements that the adverse action was based on the creditor's internal standards or policies or that the applicant, joint applicant, or similar party failed to achieve a qualifying score on the creditor's credit scoring system are insufficient" (12 CFR 1002.9(b)(2)).

Both of those are exactly what a link-based control produces if nobody intervenes. "Our fraud policy declined this application" is an internal standard. "The cluster scored 904 against a hold line of 700" is a failing score. Neither is a lawful reason, and the second is also meaningless to the person reading it.

What reasons may an adverse action notice give?

Any factor actually used — and the sample form's list is a starting point, not a boundary. Form C-1 prints 23 named reasons: credit application incomplete; insufficient number of credit references provided; unacceptable type of credit references provided; unable to verify credit references; temporary or irregular employment; unable to verify employment; length of employment; income insufficient for amount of credit requested; excessive obligations in relation to income; unable to verify income; length of residence; temporary residence; unable to verify residence; no credit file; limited credit experience; poor credit performance with us; delinquent past or present credit obligations with others; collection action or judgment; garnishment or attachment; foreclosure or repossession; bankruptcy; number of recent inquiries on credit bureau report; value or type of collateral not sufficient. Then one box reading "Other, specify."

Read that list with a synthetic identity in mind and the gap is obvious. Every entry is about money, employment, residence or credit history. None of them is about whether the applicant is who they say they are. "No credit file" and "limited credit experience" come closest and are both wrong for a cultivated synthetic identity, which usually has a file and sometimes a good one.

Appendix C anticipates precisely this. Paragraph 4 forbids reaching for the nearest printed box and sets out what to do instead — and in the same breath grants the latitude that makes a fraud decline sayable at all.

"If the reasons listed on the forms are not the factors actually used, a creditor will not satisfy the notice requirement by simply checking the closest identifiable factor listed. … The creditor should either add such other factors to the form or check “other” and include the appropriate explanation. The creditor need not, however, describe how or why a factor adversely affected the application."

Appendix C to 12 CFR part 1002, paragraph 4

Two instructions in one paragraph. First: add the factor you really used. Second — and this is the sentence the whole letter turns on — you do not have to explain how or why it weighed. The appendix's own illustration is deliberately mundane: the notice may say "length of residence" rather than "too short a period of residence." Paragraph 5 adds that "a creditor may design its own notification forms or use all or a portion of the forms contained in this Appendix," so adding a factor is permitted rather than merely tolerated.

What the reporting rule forbids, and the sentence that saves the letter

The prohibition on disclosure is absolute as to the report. It is not absolute as to the facts. The same rule continues: "Provided that no person involved in any reported suspicious transaction is notified that the transaction has been reported, this paragraph (e)(1) shall not be construed as prohibiting … the disclosure by a bank … of … the underlying facts, transactions, and documents upon which a SAR is based."

That proviso is what makes both obligations satisfiable at the same time. The fact that a submitted name, date of birth and number did not match Social Security records is an underlying fact about the application. It can be stated. The fact that the institution formed a suspicion and filed cannot be, nor can anything from which a reader would infer it — which rules out the word "investigation", any reference to a case, any reference to other applicants, and any formulation such as "we are required to report certain activity."

Can you say suspected fraud on an adverse action notice?

Say that a specific fact could not be verified; do not say that fraud was suspected. Nothing in Regulation B forbids the word, and a reason such as "suspected fraudulent application" is specific in the ordinary sense. The difficulty is everything downstream of it. If a report was filed or is being considered, a letter announcing a suspicion of fraud is close to the line the reporting rule draws, and a plaintiff's reading of "information that would reveal the existence of a SAR" is not one you want to litigate over a form letter. If no report was filed, the word invites a dispute you will have to defend with evidence you may not want to produce.

The verifiable-fact formulation avoids both and is also more accurate. The institution does not know that this applicant committed fraud; it knows that the identity could not be verified, that the number did not match, that the address is a commercial mail-receiving agency. Those are facts, and each one is a factor "actually used."

There is a third reason to keep the letter narrow, and it is about what you would have to prove. A reason that asserts fraud is a reason you may have to defend — in a complaint, in an examination, or in a fair-lending file someone reads two years later. A reason that states a verification outcome is a reason you can evidence with one document: the response you received. In a control that works by comparing applications, that difference is the difference between a file that closes and a file that reopens. A letter that accuses is also a letter you cannot withdraw gracefully when the characteristic it rested on turns out to have been innocent.

Five draft reasons, and the rule each one satisfies

Five shapes cover most synthetic identity declines. Each names a factor actually used, each is true of the individual applicant, and none of them refers to any other application or to any filing.

Two drafting habits are worth adopting with them. Give the applicant a route back: the federal identity guidelines make a documented redress route an obligation on whoever runs a fraud check, and recommend a trained human reviewer for anyone who fails one in an unattended process (NIST SP 800-63A-4, §3.2.3). And keep Part II of the form in mind: if the decision rested in whole or in part on a consumer report, the form's second part discloses the agency and the applicant's rights, which is a separate obligation from the reason itself.

What changed in May 2025, and what did not

A great deal of the guidance written about adverse action notices between 2022 and 2024 is no longer in force. On 12 May 2025 the Consumer Financial Protection Bureau withdrew 97 interpretive rules, policy statements and advisory opinions in a single notice. Two of them were directly on this subject: item 7, "Consumer Financial Protection Circular 2023-03: Adverse action notification requirements and the proper use of the CFPB's sample forms provided in Regulation B," and item 14, "Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms" (90 FR 20084).

What did not change is everything this page relies on. Section 1002.9's 30-day clock and its specificity requirement are unchanged. Appendix C's paragraph 4 and the 23 printed reasons are unchanged. The reporting rule's prohibition and its proviso are unchanged. The practical consequence is narrower than it first looks: a withdrawn circular was the Bureau's statement of how it read a rule, so the rule still says what it says — but anything you have written down that cites one of those circulars as authority should be re-grounded on the regulation itself.

The genuine applicant who was in the ring

Every link-based control produces this case, and the notice policy has to answer it before it happens. In the sample ring one applicant appears only because three other applicants claimed to work at her real employer. Her government number check matches, her credit file goes back to 1998, her phone is her own and her licence and selfie pass. She is cleared to underwriting and no notice is sent, because nothing adverse was done.

The harder version is the applicant who shares a genuine element with a ring and is declined for an unrelated credit reason. The rule for the letter is the same as for the file: the reason must be the factor actually used. If the decision rested on obligations in relation to income, that is what the notice says, and the linkage plays no part in it. Writing it any other way imports the ring into a credit decline, which is both inaccurate and the fastest route to a fair-lending question.

One applicant, cleared — and no letter at all

Who signs the notice, and when it goes out

Order matters as much as wording. In the solution the case writer drafts every notice and is forbidden from sending any of them. An analyst signs the decision; a second person — the fraud investigator by default — co-signs every decline and every account closure; and only after that second signature are the notices released. In the sample case five notices go out, each saying only what could not be verified, and the case carries on under its own reporting clock without any of that reaching the applicant.

The sequence is a drafting control as much as an approval control. A notice released on the first signature is a notice nobody has read against the second rule, and the second rule is the one with no materiality test in it. For the four signatures a ring decision actually generates, and what each one commits to, the sign-off guide works through all of them; for what a red flag can and cannot support on its own, the Red Flags Rule guide is the companion to this one.

Notices released on the second signature, not the first

To see the drafted notices, the second signature that releases them and the evidence behind every word, start from Synthetic Identity Fraud Detection.

Questions people ask

Does Regulation B apply to a decline for suspected fraud?

Yes. Regulation B's definition of adverse action turns on what was done to the application, not on why. A refusal to grant credit in substantially the amount or terms requested is adverse action whatever the underlying concern, so the notice and the specific statement of reasons are both owed. The same is true of closing an account and of refusing a requested limit increase.

Is “unable to verify identity” an acceptable reason on the notice?

It is not a printed reason on the sample form, but Appendix C expressly allows a creditor to add the factors it actually used, or to check "other" and include the explanation — and says a creditor "need not … describe how or why a factor adversely affected the application." Naming the item that could not be verified is usually better than the general word: the number, the address, the telephone line, the document.

How long do you have to send an adverse action notice?

Thirty days after receiving a completed application. Separate 30-day clocks apply to adverse action on an incomplete application, unless the incompleteness notice route is used, and to adverse action on an existing account; a counteroffer that is not accepted carries a 90-day outer limit. In a ring case the practical risk is the opposite of lateness — sending before a second person has read the letter.

Must a creditor use the printed reasons on Form C-1?

No. Appendix C states that a creditor may design its own notification forms or use all or part of the appendix's forms, and proper use of Forms C-1 through C-4 satisfies the statement-of-reasons requirement. What it may not do is substitute a listed reason for the factor it really used because the listed one is close enough.

Is closing a booked account adverse action?

Yes, where it is a termination or an unfavourable change in terms that does not affect substantially all of a class of the creditor's accounts. That makes a ring investigation a source of several notice obligations at once — the applications refused, the accounts closed and the limit increases denied — each needing a reason that is true of that account's holder.

Do you have to name the credit bureau whose report you used?

If the decision was based in whole or in part on information in a consumer report, the sample form's second part discloses the reporting agency's name, address and telephone number, states that the agency played no part in the decision, and sets out the applicant's right to a free copy of the report within 60 days and to dispute inaccuracies. That disclosure is separate from, and additional to, the statement of reasons.