The FACT Act brought about a lot of requirements intended to help prevent identity theft. One such requirement (§334.91 FDIC / §41.91 OCC / §222.91 Federal Reserve / §717.91 NCUA) is that an issuer of a debit or credit card …must establish and implement reasonable policies and procedures to assess the validity of a change of address if it receives notification of a change of address for a consumer's debit or credit card account and, within a short period of time afterwards (during at least the first 30 days after it receives such notification), the card issuer receives a request for an additional or replacement card for the same account.
In other words, an issuer is prohibited from issuing a subsequent card or replacement card without verifying the request is valid. There are several ways to go about this which Kevin discusses in the video.
Published 2026/08/20