In a recent decision, the U.S. Court of Appeals for the Second Circuit clarified the expectations for furnishers when investigating consumer disputes under the Fair Credit Reporting Act (FCRA). In Suluki v. Credit One Bank, No. 23-721 (2d Cir. May 28, 2025), the Second Circuit emphasized that the FCRA requires furnishers to conduct reasonable, not perfect, investigations into disputed accounts. The opinion also cements the fact that summary judgment is possible — and appropriate — when a furnisher conducts a reasonable investigation of a credit dispute.
The case arose out of a claim by Khalilah Suluki that her mother, Khadijah, opened several credit card accounts in her name without authorization, including one with Credit One Bank. On the advice of her mother, Suluki began opening credit card accounts in 2014 in order to build up her credit history before starting college. Her mother assisted in preparing for and completing the application process for various credit cards, provided Suluki with funds to pay off the balance of her credit cards while attending college, and also opened an account with Credit One for Suluki’s sister so that the sister could begin building a credit history as well.
On November 2, 2017, an individual opened a Credit One credit card using Suluki’s information including her name, birth date, and social security number. The individual also provided the address of Suluki’s childhood home in Brooklyn and an email address of “ksuluki@yahoo.com.” The card was then used for miscellaneous purchases in Brooklyn over the next eighteen months and minimum or partial payments were made on the card every month from a bank account shared by Suluki and her mother.
In July 2019, Suluki applied to rent an apartment, but her application was rejected. This prompted her to review her credit report, which led her to discover that her mother had opened and maxed out various lines of credit in her name. Suluki then called Credit One to report that she had not opened the account at issue, at which point Credit One closed the account and requested that Suluki provide a police report to support her claim. However, Suluki decided not to obtain a police report due to “back and forth” about paperwork that the police first needed from Credit One to file a report. Credit One later reached out to Suluki’s mother who told Credit One that the account was not fraudulent, but instead was opened by her and Suluki together with the understanding that Khadijah would make payments on the account to assist Suluki with building her credit while she was in college.
Suluki began submitting disputes to the major consumer reporting agencies in November 2019 and May 2020. When conducting its investigation into these disputes, Credit One first reviewed the ACDV, the dispute code, and the documents contained within the associated image accompanying the ACDV. Credit One next reviewed its internal databases, which included a “fraud” tab that identifies potentially fraudulent activity and a “Red Flag” tab that identifies other applications making use of the same information provided at account opening or suspected fraudulent activity associated with accounts linked to that information. Credit One also reviewed the transaction history for the account, which did not identify any specific disputed charges, reflected a history of on-time payments, payments received from a joint account shared by Suluki and her mother, and purchases were made with the card in Brooklyn, where Suluki resided. Lastly, Credit One used external databases to confirm that Suluki was associated with the information provided at account opening, which reflected that her association with the address and phone number that had been provided pre-dated the opening of the account. Based on all of these factors, Credit One determined that Suluki was responsible for the account and that she was not the victim of identity theft.
Suluki subsequently filed a lawsuit, alleging that Credit One violated the FCRA by failing to conduct a reasonable investigation. After conducting discovery, both Suluki and Credit One moved for summary judgment. The Southern District of New York denied Suluki’s motion finding that there was a genuine dispute of material fact as to whether the reported information was accurate to the extent that Credit One was reporting Suluki as responsible for the account, and further granted Credit One’s motion finding that no reasonable jury could conclude that Credit One could have concluded Suluki was not responsible for the account if it had taken any other steps during its investigation.
The Second Circuit’s analysis centered on two critical issues: the reasonableness of Credit One’s investigation and the causation and damages linked to the alleged FCRA violation. The court highlighted that the FCRA mandates reasonable, not flawless, investigations by furnishers. The FCRA “does not guarantee that the results of those investigations will favor the consumer lodging the dispute.” The court concluded that even if Credit One’s investigation was not perfect, no reasonable investigation would have led to a different conclusion regarding the account’s legitimacy.
Suluki argued that Credit One failed to consider the identity theft affidavit submitted by Suluki, links to her mother in the account information, and evidence that her mother was actively using the card, and further claimed that reviewing this information would have resulted in Credit One determining that she was not responsible for the account. In scrutinizing each of these categories of information, the Second Circuit flatly disagreed with Suluki’s theory. In particular, the Second Circuit found that Suluki’s affidavit was flawed on its face because she failed to follow the affidavit’s instructions requesting that she attach a report submitted to law enforcement, failed to identify specific transactions that she did not authorize, and included her own social security number as well as both her and her mother’s name when identifying the suspected identity thief. The Second Circuit also found that the supposed links between Suluki’s mother and the account did not necessarily suggest fraud because the information provided at account opening and account from which payments were made were also associated with Suluki. Lastly, the use of the card appeared to be consistent with that of a college-aged female from Brooklyn, which also did not necessarily suggest fraud. Accordingly, the Second Circuit determined that no reasonable jury could conclude the information Suluki claimed was not reviewed by Credit One would have lead Credit One to determine she was not responsible for the account.
Regarding causation, the court emphasized the need for Suluki to prove that a reasonable investigation would have uncovered evidence demonstrating the account was fraudulent. In other words, Suluki had to show that a reasonable investigation would have made a difference in the reporting of her account. Without such evidence, Suluki could not establish that Credit One’s actions caused her harm, thereby preventing her from recovering damages. The court affirmed that Credit One’s investigation adhered to established protocols and was based on available information, and no reasonable jury could find that Credit One willfully or negligently violated the FCRA.
Our Take
Investigations into claims of identity theft continue to be a hotly contested area in the FCRA space, particularly where there appears to be a connection between a plaintiff and a supposed identity thief. This case does not create a bright-line rule as to how much information is needed to support the reasonableness of an investigation as a matter of law, however it does serve as important guidance for furnishers that a thorough review of available information (including external sources) can go far in demonstrating why an investigation should be considered reasonable.
