investigators have expressed their concerns and confusion
about utilizing the investigative practice of pretexting. Whether
it is a
simple pretext to confirm if a subject is
home, or a pretext to acquire case information discretely from
neighbors, the practice of pretexting has been an indispensable
tool used by investigators and law enforcement for decades.
The Gramm-Leach-Bliley Act
(GLB) signed into law in 1999 specifically addresses pretexting
as an illegal act punishable under federal statues. However,
the Act specifically addresses pretexting only as it pertains
to its use in acquiring financial information from consumers
or financial institutions.
One would then assume that any pretexting not dealing with such
financial information would be permissible. Unfortunately, that’s
not the case. Merely by its definition, to pretext is to pretend
that you are someone who you are not, telling an untruth, or
When a business entity, such as a private investigator, SIU insurance
investigators and an adjuster — just to name a few — conducts
any type of “deception,” it falls under the authority
of the Federal Trade Commission (FTC). This federal agency
has the obligation and authority to insure that consumers are
not subject to any unfair or deceptive business practices.
where the Federal Trade Commission Act comes into play. Section
5 of the FTCA states, in part:
“Whenever the Commission shall have reason to believe that
any such person, partnership, or corporation has been or is using
any unfair method of competition or unfair or deceptive act or
practice in or affecting commerce, and if it shall appear to the
Commission that a proceeding by it in respect thereof would be
to the interest of the public, it shall issue and serve upon such
person, partnership, or corporation a complaint stating its charges
in that respect…”
In an effort to get a definitive definition of pretexting and the
potential risks and penalties for conducting pretexts, PI
Magazine was granted an interview with Joel Winston, Associate Director
of the FTC, Division of Financial Practices. His office has
the responsibility to monitor and regulate the use of pretexting.
The following interview clearly outlines several areas of pretexting
normally conducted by investigators. I would suggest that
you read the answers carefully and refer to them often.
What is the FTC’s definition of “pretexting” as
it pertains to the GLB? (Gramm-Leach-Bliley Act)
Winston: First, we should dispel the misimpression,
if there is one, that the pretexting provisions of GLB only apply
if the pretexter is getting “financial information.” Actually,
what the statue says is if you are getting any personal, non-public
information from a financial institution or the consumer, that
is covered by the statue. It relates to the consumer’s
relationship with the financial institution. So, if for example,
the pretexter is using false pretenses to get from the consumer’s
bank the consumer’s address, that would be covered. Or,
if they are going to the consumer and getting the name of their
bank through false pretenses, that would be covered. The determining
principle is that it’s only pretexting if the information
is obtained through false pretenses. That is, some false statement,
misrepresentation, or fraud. The message is if you are trying
to get this sort of information; then you can not use improper
means, you can not tell lies in order to get this information.
PIM: What if I already have a unique identifier, such a date
of birth or Social Security number, and I speak to a person,
under false pretenses, only to confirm that the person I am speaking
to is my subject? Would that be allowed?
Winston: I don’t think that would be pretexting, because
it is not relating to a financial institution. Conceivably, it
could be considered a depictive practice, but we would have to
consider it on a case-by-case basis. It doesn’t seem like
a matter the FTC would be concerned with, but if you were calling
the bank to get information, that would be pretexting.
PIM: What If I call a bank to determine the approximate balance
in an account? I properly identify myself by name and ask if
a check will clear, with me providing them the account number
and they give it to me. Is this a GLB violation?
Winston: As long as you have not said that
you are the customer, or said anything that isn’t true, or used false pretenses,
it would not have violated the GLB Act. If you don’t actually
have a check and you are trying to discern whether there is money
in the account, then you are pretexting. If you are not telling
the truth when speaking to the bank, you are pretexting.
PIM: Law enforcement and
professional investigators have used simple pretext as a means
of acquiring information. Is it the FTC’s position that
all pretexts are unlawful even when it is not related to personal
Winston: The only thing the GLB Act covers
is financial information, information from a financial institution,
or a customer’s
relationship with that financial institution. The other statue
that might apply is the FTC Act itself, which prohibits deceptive
practices. Now that’s a very broad concept and covers a
wide range of falsehoods and misstatements. I suppose it’s
possible that a PI that’s going around to a neighbor posing
as someone who he isn’t in order to learn the location
of the target would be engaged in some form of deception. However,
that’s really not a matter that the FTC would consider
a priority. It is not our priority to be challenging the functions
of a PI that are conceivably deceptive during a one on one transaction
with someone, as opposed to looking at some broad practices that
might cause harm to numerous individuals.
PIM: What steps has the FTC taken to identify pretexters?
Winston: We have in the past been quite
busy surfing the net and looking at advertisements. A couple
of years ago we had a program (“Operation Detect Pretext”) where we
identified people who appeared to be advertising pretexting
service. We sent out warning letters to them and followed up.
In some cases, we brought a series of cases to litigation.
We remain interested in situations where there is an ongoing
pattern of pretexting. We continue to investigate improper
cases and do forward cases to the Justice Department for criminal
prosecution, if we feel the behavior is sufficiently serious.
We don’t have any one specific way by which we identify
pretexters. We rely on tips from the industry, our monitoring
efforts, and consumer claimants. Information can come to us
from any source, such as an article in a newspaper.
PIM: How can people provide tips to the FTC?
Winston: They can email or write to us at the FTC, 600 Pennsylvania
Ave. NW, Washington, DC 20580 (www.ftc.gov). Or, they can simply
call us at 1-877-FTCHELP.
PIM: What type of penalties can violators of the GLB expect
as it pertains to pretexting for financial information?
Winston: What we have done in some of our pretexting cases
is require that the pretexter give back the money, the profits,
made from the pretexting. In the cases involving particularly
egregious behavior, there are criminal provisions and we would
refer them to the Department of Justice for possible criminal
PIM: Has the FTC encountered any instances where a licensed
private investigator has violated or been prosecuted for violating
Winston: We recently referred one pretexing case to the Department
of Justice criminal authorities, but I am not at liberty to discuss
the details of this ongoing case. To date, the cases brought
by the FTC itself have not involved PIs.
PIM: How does the FTC address pretexting
under the unfair business or deceptive practices clause?
Winston: There are legal definitions of
what deceptive and unfair practices are, which are available
on our website. Traditionally, a deceptive practice is when you
misrepresent a fact to the consumer in the course of selling
them something. What makes pretexting a little different is that
obviously, the pretexter is not selling anything to the consumer.
So, there has been a fair amount of discussion about how exactly
does the theory of deception apply to a pretexting situation.
Part of that is because the person who is the recipient of the
misrepresentation is different from the person who is hurt by
it. In other words, the pretexter is telling a falsehood to the
bank, but the person who actually suffers the harm is the consumer.
So, it’s an issue which
we feel falls within the definition of deception, but it’s
never really been tested in the courts. There is also a separate
theory of unfairness, which is essentially where you are undertaking
a practice that causes substantial injury to a consumer. The
issue of pretexting would then be, if you are pretexting, what
harm does that cause the consumer and that would be determined
by the facts in a particular case.
PIM: Do you classify the acquisition of telephone toll records
as a clear violation of deceptive business practices?
Winston: It’s not what we traditionally look at as deception
because you’re deceiving party A, but party B is the actual
party being harmed. But, we believe that, even though it has
not been tested in the courts, that acquiring toll records through
false statements constitutes deceptive business practices.
PIM: Is this an area that the FTC is going to start looking
Winston: We are aware that there have been
some concerns about that and we’re continuing to consider
PIM: Is Operation Detect Pretext still in operation?
Winston: Yes, it’s an ongoing operation
that has not been terminated. There was a time where we were
actively sending out warning letters, but we are not doing that
right now. We are continuing to monitor the industry, certain
companies, and we are prepared to act should the need arise.
PIM: Can clients who hire investigators or info brokers who
violate GLB be prosecuted?
Winston: Yes, under the law they can, but
there has to be a showing of knowledge. If the person who hired
the pretexter had no idea how the information was going to be
acquired or didn’t
specifically know that pretexting was going to be used, then
no, they would not have violated GLB. However, when a PI subcontracts
to another investigator, the PI should insure that the subcontractor
is not violating GLB. The PI should not just rely on the subcontractor’s
word, but should know how the information will be acquired.
PIM: Are there currently any FTC concerns about private investigators?
Winston: Not as a general matter. If I
thought that there were major problems in the PI industry that
concerned us, I would certainly tell you. As with any industry,
there are the occasional bad apples, but the PI industry as a
whole is not an area about which we have any particular concerns.
One area that does concern us right now is the acquisition of
credit reports by persons without proper authority. I’m not aware of any specific
incidents in this regard involving PIs, but this is an issue
your readers should be made aware of. That is, the Fair Credit
Reporting Act forbids any person from obtaining a consumer’s
credit report without a “permissible purpose,” as
defined by the Act.