Nonpublic Records and Access Requirements
5 minutes
5 Questions
In the CFE curriculum, Sources of Information distinguishes between public records (freely available to anyone, such as court filings, property records, and corporate registrations) and nonpublic records, which are restricted by law, contract, or policy and require specific legal authority or consent to obtain. Nonpublic records typically include banking and financial account records, credit reports, tax returns, medical records, telephone and electronic communication records, educational records, and employment or personnel files held by third parties. Access to these records is governed by privacy and confidentiality laws that vary by jurisdiction. In the United States, for example, the Gramm-Leach-Bliley Act and the Right to Financial Privacy Act restrict access to financial institution records; the Fair Credit Reporting Act limits who may pull a consumer credit report and for what 'permissible purpose'; HIPAA protects medical information; the Electronic Communications Privacy Act and the Stored Communications Act restrict access to communications data; and tax returns are protected under the Internal Revenue Code. Many other countries, such as those under the EU's GDPR, impose even stricter data protection regimes. Fraud examiners generally gain lawful access to nonpublic records through one of several means: (1) voluntary consent or authorization from the subject, often in writing; (2) legal process such as a subpoena, court order, search warrant, or discovery request in civil litigation; (3) the organization's own records when the examiner is acting on behalf of the record owner (e.g., an employer's internal email or payroll data, subject to company policy and employee notice); or (4) cooperation with law enforcement, who possess broader investigative authority. CFEs must never use pretexting, bribery, or deception to obtain protected records, as this can violate laws such as the Gramm-Leach-Bliley Act's anti-pretexting provisions and the ACFE Code of Professional Ethics. Improperly obtained evidence may also be inadmissible and expose the examiner and client to civil and criminal liability.
Nonpublic Records and Access Requirements: A Complete CFE Exam Guide
Overview
In the ACFE CFE exam, the Investigation section includes a topic area called Sources of Information. Within that area, you must understand the difference between public records (information anyone can obtain, such as real property records, court filings, and corporate registrations) and nonpublic records (information that is legally protected and can only be obtained with the subject's consent, through legal process, or under specific statutory authority). This guide explains what nonpublic records are, why the distinction matters, the key laws that govern access, and how to handle exam questions on the subject.
Why This Topic Is Important
Fraud examiners constantly need information about people and entities: where their money is, what they earn, who they call, what they owe, and where they have lived. Much of the most valuable information is nonpublic. If an examiner obtains it improperly, several bad things can happen:
- The evidence may be inadmissible in court, destroying the case.
- The examiner and the client may face civil liability (invasion of privacy, statutory damages).
- The examiner may face criminal prosecution (for example, pretexting to obtain financial or telephone records is a federal crime in the United States).
- The examiner violates the ACFE Code of Professional Ethics, which requires compliance with lawful orders and prohibits illegal or unethical conduct.
Because of these consequences, the CFE exam tests whether you know which records are off-limits without proper authority and what that authority must look like.
What Are Nonpublic Records?
Nonpublic records are records held by private organizations or government agencies that are not available to the general public on request. Access is restricted by statute, regulation, contract, or common-law privacy rights. Common categories tested on the exam include:
- Banking and financial institution records (account statements, signature cards, deposit slips, loan files, wire transfer records).
- Consumer credit reports from credit reporting agencies.
- Tax returns and tax return information.
- Telephone records (call detail records, subscriber information).
- Medical and health records.
- Educational records (transcripts, disciplinary files).
- Employment and personnel records held by other employers.
- Electronic communications (email content, stored messages) and Internet service provider subscriber data.
- Motor vehicle and driver records in many jurisdictions.
- Insurance claim files and policy information.
- Suspicious Activity Reports (SARs) and other Bank Secrecy Act filings, which are confidential by law and cannot be disclosed by the filing institution.
How Access Works: The Three Lawful Paths
Regardless of jurisdiction, nonpublic records are generally reachable through one of three routes:
1. Consent of the subject. A signed, informed authorization from the person whose records are sought is the most universal key. Examples: a signed bank records release, IRS Form 4506 or 4506-T authorizing release of tax return information, a written FCRA authorization for a background check, a HIPAA-compliant medical release. In internal investigations, employees may have signed consents in employment agreements or policies, but those consents must be specific enough to cover the records sought.
2. Legal process. When the subject will not consent, the examiner must rely on compulsory process:
- Subpoena (grand jury subpoena, administrative subpoena, or a civil subpoena duces tecum issued in litigation). A subpoena compels the record holder to produce documents.
- Court order, including orders under specific statutes (for example, orders for stored communications data).
- Search warrant, issued by a judge upon probable cause, used by law enforcement in criminal matters. Government actors in the United States are also bound by the Fourth Amendment, so warrantless seizures of protected records may be suppressed.
- Civil discovery requests (requests for production, interrogatories, depositions) once a lawsuit has been filed.
Private fraud examiners cannot issue subpoenas on their own; they must work through an attorney and a court, or through a client that has litigation pending.
3. Statutory authority or permissible purpose. Some laws allow certain parties to obtain records without the subject's consent if a defined purpose exists. The clearest example is the Fair Credit Reporting Act's list of permissible purposes for obtaining a consumer report.
Key Laws You Must Know (United States Focus)
The CFE exam is international, but its legal content draws heavily on US statutes. Learn what each law protects, whom it binds, and how access is lawfully gained.
Right to Financial Privacy Act (RFPA), 1978
- Protects customer records held by financial institutions from access by the federal government.
- Federal agencies may obtain records only with customer authorization, an administrative subpoena or summons, a search warrant, a judicial subpoena, or a formal written request, and generally must give the customer notice and an opportunity to challenge.
- Exam trap: RFPA applies to federal government agencies, not to private parties, state agencies, or the financial institutions themselves (though many states have similar statutes).
Gramm-Leach-Bliley Act (GLBA), 1999
- Requires financial institutions to protect the privacy and security of nonpublic personal information and to give privacy notices.
- Contains the pretexting provision: it is a federal crime to obtain, or attempt to obtain, customer information from a financial institution by false statements, fraudulent documents, or impersonation. Hiring someone to do so is also prohibited.
Fair Credit Reporting Act (FCRA)
- Governs consumer reports issued by consumer reporting agencies.
- A report may be obtained only for a permissible purpose: in response to a court order or grand jury subpoena; with the written instructions of the consumer; for credit transactions; for employment purposes (with the consumer's written authorization); for insurance underwriting; for licensing or government benefits eligibility; for a legitimate business need in connection with a transaction initiated by the consumer, or to review an existing account.
- For employment purposes, the employer must provide a clear written disclosure, obtain written authorization, and follow pre-adverse action and adverse action notice procedures.
- Obtaining a report under false pretenses carries civil and criminal penalties. An investigation of a suspected employee for fraud generally does not by itself create a permissible purpose; consent or a court order is normally required.
- Credit header data (name, address, Social Security number, date of birth) has historically been more accessible than the full report, but GLBA restricts much of it as well.
Internal Revenue Code Section 6103
- Tax returns and return information are confidential. Access requires the taxpayer's consent (for example via Form 4506 or 4506-T), a court order in appropriate proceedings, or a statutory exception.
Telephone Records and Privacy Protection Act, 2006
- Makes it a federal crime to obtain confidential phone records by pretexting, hacking, or unauthorized access, and to sell or purchase such records.
Electronic Communications Privacy Act (ECPA) and Stored Communications Act (SCA)
- Protect the content of electronic communications in transit and in storage. Providers generally cannot disclose content to private parties; law enforcement needs a subpoena, court order, or warrant depending on the data type.
- Employers have broader rights over communications on their own systems, especially when employees have been given notice through policy.
Health Insurance Portability and Accountability Act (HIPAA)
- Restricts disclosure of protected health information by covered entities; access generally requires a patient authorization or a qualifying subpoena or court order with required protections.
Family Educational Rights and Privacy Act (FERPA)
- Education records cannot be released without the student's (or parent's) consent, except for limited directory information or lawful subpoena with notice.
Driver's Privacy Protection Act (DPPA)
- Restricts release of personal information from state motor vehicle records except for enumerated permissible uses (including use by licensed private investigators for a permitted purpose and use in connection with litigation).
Bank Secrecy Act (BSA) and SAR confidentiality
- Financial institutions must not disclose the existence or contents of a SAR to the subject or to unauthorized parties. Fraud examiners should never ask a bank whether a SAR was filed.
International Perspective
Outside the United States, data protection laws such as the EU General Data Protection Regulation (GDPR), the UK Data Protection Act, Canada's PIPEDA, and bank secrecy laws in many countries impose similar or stricter limits. The exam's general principle is the same everywhere: nonpublic personal and financial information requires consent, legal process, or explicit statutory authority, and examiners must know the rules of the jurisdiction where the records are held.
Pretexting: The Recurring Exam Theme
Pretexting means using a false identity or false story to persuade a record holder to release information. On the exam, remember:
- Pretexting to obtain financial institution customer information is illegal under GLBA.
- Pretexting to obtain telephone records is illegal under the 2006 Act.
- Even where not expressly criminal, pretexting may violate state law, privacy torts, and professional ethics, and it can taint evidence.
If an answer choice involves pretending to be the account holder, a bank officer, or a government official to get records, it is almost always the wrong (unlawful) choice.
Practical Workflow for the Fraud Examiner
1. Classify the record: public or nonpublic?
2. Identify the holder (bank, credit bureau, ISP, employer, government agency) and the governing law.
3. Identify who you are in the scenario (private examiner, corporate investigator, law enforcement, federal agency) because the rules differ by actor.
4. Seek consent first when practical and when it will not tip off the subject prematurely.
5. If consent is unavailable, coordinate with counsel for subpoenas, court orders, or discovery; coordinate with law enforcement for warrants.
6. Document the legal basis for every nonpublic record obtained to preserve admissibility.
7. Never use pretexting, bribery, or unauthorized access.
Exam Tips: Answering Questions on Nonpublic Records and Access Requirements
Tip 1 - Sort the record type first. Many questions ask which of several items is a public record versus a nonpublic record. Real estate deeds, court records, UCC filings, corporate registrations, and professional licenses are public. Bank records, credit reports, tax returns, phone records, medical records, and educational records are nonpublic.
Tip 2 - Identify the actor. Ask whether the question involves a federal agency, a private fraud examiner, an employer, or a financial institution. The RFPA binds federal agencies. GLBA binds financial institutions and anyone pretexting them. FCRA binds users of consumer reports. The correct answer often depends on who is seeking the records.
Tip 3 - Consent is the default correct method. When asked how a private examiner can lawfully obtain a subject's bank or credit records, the answer that involves a signed authorization from the subject is almost always correct. The next best answers involve subpoena or court order through counsel.
Tip 4 - Eliminate pretexting answers. Any option describing deception to obtain financial or telephone records is illegal. Treat these as distractors.
Tip 5 - Know the FCRA employment sequence. Disclosure in writing, written authorization, pre-adverse action notice with a copy of the report and a summary of rights, then adverse action notice. Questions frequently test the order and the requirement that authorization be in writing.
Tip 6 - Remember what RFPA does NOT cover. A common distractor says RFPA prevents a private investigator or a state agency from obtaining bank records. RFPA restricts federal government access only.
Tip 7 - SARs are never disclosed. If a question asks whether an examiner can confirm with a bank that a SAR was filed on a subject, the answer is no; disclosure is prohibited.
Tip 8 - Subpoena power belongs to courts and agencies, not to examiners. A private CFE cannot issue a subpoena independently. Answers suggesting the examiner issues a subpoena directly are wrong unless the examiner is acting as government counsel or through a court.
Tip 9 - Watch for the words only, always, and never. Questions about permissible purposes under FCRA or exceptions under HIPAA and FERPA often hinge on absolute language. Recall that limited directory information (FERPA) and limited header data may be available, so absolute statements are frequently incorrect.
Tip 10 - Think admissibility and ethics. When two answers seem plausible, choose the one that preserves admissibility of evidence and complies with the ACFE Code of Professional Ethics. The exam rewards the lawful, documented approach over the fast, risky one.
Quick Review Summary
- Nonpublic records require consent, legal process, or statutory authority.
- RFPA: federal government access to bank records; notice and challenge rights.
- GLBA: financial privacy; pretexting is a crime.
- FCRA: permissible purposes; written authorization for employment; adverse action procedures.
- IRC 6103: tax returns confidential; Form 4506 for consent.
- Telephone Records and Privacy Protection Act: phone record pretexting is a crime.
- ECPA/SCA: email and stored communications; providers need process.
- HIPAA, FERPA, DPPA: medical, educational, and motor vehicle records.
- BSA: SARs are strictly confidential.
- Private examiners cannot issue subpoenas; work through counsel.
Master these points and you will be well prepared for any CFE exam question on nonpublic records and access requirements.
In the ACFE CFE exam, the Investigation section includes a topic area called Sources of Information. Within that area, you must understand the difference between public records (information anyone can obtain, such as real property records, court filings, and corporate registrations) and nonpublic records (information that is legally protected and can only be obtained with the subject's consent, through legal process, or under specific statutory authority). This guide explains what nonpublic records are, why the distinction matters, the key laws that govern access, and how to handle exam questions on the subject.
Why This Topic Is Important
Fraud examiners constantly need information about people and entities: where their money is, what they earn, who they call, what they owe, and where they have lived. Much of the most valuable information is nonpublic. If an examiner obtains it improperly, several bad things can happen:
- The evidence may be inadmissible in court, destroying the case.
- The examiner and the client may face civil liability (invasion of privacy, statutory damages).
- The examiner may face criminal prosecution (for example, pretexting to obtain financial or telephone records is a federal crime in the United States).
- The examiner violates the ACFE Code of Professional Ethics, which requires compliance with lawful orders and prohibits illegal or unethical conduct.
Because of these consequences, the CFE exam tests whether you know which records are off-limits without proper authority and what that authority must look like.
What Are Nonpublic Records?
Nonpublic records are records held by private organizations or government agencies that are not available to the general public on request. Access is restricted by statute, regulation, contract, or common-law privacy rights. Common categories tested on the exam include:
- Banking and financial institution records (account statements, signature cards, deposit slips, loan files, wire transfer records).
- Consumer credit reports from credit reporting agencies.
- Tax returns and tax return information.
- Telephone records (call detail records, subscriber information).
- Medical and health records.
- Educational records (transcripts, disciplinary files).
- Employment and personnel records held by other employers.
- Electronic communications (email content, stored messages) and Internet service provider subscriber data.
- Motor vehicle and driver records in many jurisdictions.
- Insurance claim files and policy information.
- Suspicious Activity Reports (SARs) and other Bank Secrecy Act filings, which are confidential by law and cannot be disclosed by the filing institution.
How Access Works: The Three Lawful Paths
Regardless of jurisdiction, nonpublic records are generally reachable through one of three routes:
1. Consent of the subject. A signed, informed authorization from the person whose records are sought is the most universal key. Examples: a signed bank records release, IRS Form 4506 or 4506-T authorizing release of tax return information, a written FCRA authorization for a background check, a HIPAA-compliant medical release. In internal investigations, employees may have signed consents in employment agreements or policies, but those consents must be specific enough to cover the records sought.
2. Legal process. When the subject will not consent, the examiner must rely on compulsory process:
- Subpoena (grand jury subpoena, administrative subpoena, or a civil subpoena duces tecum issued in litigation). A subpoena compels the record holder to produce documents.
- Court order, including orders under specific statutes (for example, orders for stored communications data).
- Search warrant, issued by a judge upon probable cause, used by law enforcement in criminal matters. Government actors in the United States are also bound by the Fourth Amendment, so warrantless seizures of protected records may be suppressed.
- Civil discovery requests (requests for production, interrogatories, depositions) once a lawsuit has been filed.
Private fraud examiners cannot issue subpoenas on their own; they must work through an attorney and a court, or through a client that has litigation pending.
3. Statutory authority or permissible purpose. Some laws allow certain parties to obtain records without the subject's consent if a defined purpose exists. The clearest example is the Fair Credit Reporting Act's list of permissible purposes for obtaining a consumer report.
Key Laws You Must Know (United States Focus)
The CFE exam is international, but its legal content draws heavily on US statutes. Learn what each law protects, whom it binds, and how access is lawfully gained.
Right to Financial Privacy Act (RFPA), 1978
- Protects customer records held by financial institutions from access by the federal government.
- Federal agencies may obtain records only with customer authorization, an administrative subpoena or summons, a search warrant, a judicial subpoena, or a formal written request, and generally must give the customer notice and an opportunity to challenge.
- Exam trap: RFPA applies to federal government agencies, not to private parties, state agencies, or the financial institutions themselves (though many states have similar statutes).
Gramm-Leach-Bliley Act (GLBA), 1999
- Requires financial institutions to protect the privacy and security of nonpublic personal information and to give privacy notices.
- Contains the pretexting provision: it is a federal crime to obtain, or attempt to obtain, customer information from a financial institution by false statements, fraudulent documents, or impersonation. Hiring someone to do so is also prohibited.
Fair Credit Reporting Act (FCRA)
- Governs consumer reports issued by consumer reporting agencies.
- A report may be obtained only for a permissible purpose: in response to a court order or grand jury subpoena; with the written instructions of the consumer; for credit transactions; for employment purposes (with the consumer's written authorization); for insurance underwriting; for licensing or government benefits eligibility; for a legitimate business need in connection with a transaction initiated by the consumer, or to review an existing account.
- For employment purposes, the employer must provide a clear written disclosure, obtain written authorization, and follow pre-adverse action and adverse action notice procedures.
- Obtaining a report under false pretenses carries civil and criminal penalties. An investigation of a suspected employee for fraud generally does not by itself create a permissible purpose; consent or a court order is normally required.
- Credit header data (name, address, Social Security number, date of birth) has historically been more accessible than the full report, but GLBA restricts much of it as well.
Internal Revenue Code Section 6103
- Tax returns and return information are confidential. Access requires the taxpayer's consent (for example via Form 4506 or 4506-T), a court order in appropriate proceedings, or a statutory exception.
Telephone Records and Privacy Protection Act, 2006
- Makes it a federal crime to obtain confidential phone records by pretexting, hacking, or unauthorized access, and to sell or purchase such records.
Electronic Communications Privacy Act (ECPA) and Stored Communications Act (SCA)
- Protect the content of electronic communications in transit and in storage. Providers generally cannot disclose content to private parties; law enforcement needs a subpoena, court order, or warrant depending on the data type.
- Employers have broader rights over communications on their own systems, especially when employees have been given notice through policy.
Health Insurance Portability and Accountability Act (HIPAA)
- Restricts disclosure of protected health information by covered entities; access generally requires a patient authorization or a qualifying subpoena or court order with required protections.
Family Educational Rights and Privacy Act (FERPA)
- Education records cannot be released without the student's (or parent's) consent, except for limited directory information or lawful subpoena with notice.
Driver's Privacy Protection Act (DPPA)
- Restricts release of personal information from state motor vehicle records except for enumerated permissible uses (including use by licensed private investigators for a permitted purpose and use in connection with litigation).
Bank Secrecy Act (BSA) and SAR confidentiality
- Financial institutions must not disclose the existence or contents of a SAR to the subject or to unauthorized parties. Fraud examiners should never ask a bank whether a SAR was filed.
International Perspective
Outside the United States, data protection laws such as the EU General Data Protection Regulation (GDPR), the UK Data Protection Act, Canada's PIPEDA, and bank secrecy laws in many countries impose similar or stricter limits. The exam's general principle is the same everywhere: nonpublic personal and financial information requires consent, legal process, or explicit statutory authority, and examiners must know the rules of the jurisdiction where the records are held.
Pretexting: The Recurring Exam Theme
Pretexting means using a false identity or false story to persuade a record holder to release information. On the exam, remember:
- Pretexting to obtain financial institution customer information is illegal under GLBA.
- Pretexting to obtain telephone records is illegal under the 2006 Act.
- Even where not expressly criminal, pretexting may violate state law, privacy torts, and professional ethics, and it can taint evidence.
If an answer choice involves pretending to be the account holder, a bank officer, or a government official to get records, it is almost always the wrong (unlawful) choice.
Practical Workflow for the Fraud Examiner
1. Classify the record: public or nonpublic?
2. Identify the holder (bank, credit bureau, ISP, employer, government agency) and the governing law.
3. Identify who you are in the scenario (private examiner, corporate investigator, law enforcement, federal agency) because the rules differ by actor.
4. Seek consent first when practical and when it will not tip off the subject prematurely.
5. If consent is unavailable, coordinate with counsel for subpoenas, court orders, or discovery; coordinate with law enforcement for warrants.
6. Document the legal basis for every nonpublic record obtained to preserve admissibility.
7. Never use pretexting, bribery, or unauthorized access.
Exam Tips: Answering Questions on Nonpublic Records and Access Requirements
Tip 1 - Sort the record type first. Many questions ask which of several items is a public record versus a nonpublic record. Real estate deeds, court records, UCC filings, corporate registrations, and professional licenses are public. Bank records, credit reports, tax returns, phone records, medical records, and educational records are nonpublic.
Tip 2 - Identify the actor. Ask whether the question involves a federal agency, a private fraud examiner, an employer, or a financial institution. The RFPA binds federal agencies. GLBA binds financial institutions and anyone pretexting them. FCRA binds users of consumer reports. The correct answer often depends on who is seeking the records.
Tip 3 - Consent is the default correct method. When asked how a private examiner can lawfully obtain a subject's bank or credit records, the answer that involves a signed authorization from the subject is almost always correct. The next best answers involve subpoena or court order through counsel.
Tip 4 - Eliminate pretexting answers. Any option describing deception to obtain financial or telephone records is illegal. Treat these as distractors.
Tip 5 - Know the FCRA employment sequence. Disclosure in writing, written authorization, pre-adverse action notice with a copy of the report and a summary of rights, then adverse action notice. Questions frequently test the order and the requirement that authorization be in writing.
Tip 6 - Remember what RFPA does NOT cover. A common distractor says RFPA prevents a private investigator or a state agency from obtaining bank records. RFPA restricts federal government access only.
Tip 7 - SARs are never disclosed. If a question asks whether an examiner can confirm with a bank that a SAR was filed on a subject, the answer is no; disclosure is prohibited.
Tip 8 - Subpoena power belongs to courts and agencies, not to examiners. A private CFE cannot issue a subpoena independently. Answers suggesting the examiner issues a subpoena directly are wrong unless the examiner is acting as government counsel or through a court.
Tip 9 - Watch for the words only, always, and never. Questions about permissible purposes under FCRA or exceptions under HIPAA and FERPA often hinge on absolute language. Recall that limited directory information (FERPA) and limited header data may be available, so absolute statements are frequently incorrect.
Tip 10 - Think admissibility and ethics. When two answers seem plausible, choose the one that preserves admissibility of evidence and complies with the ACFE Code of Professional Ethics. The exam rewards the lawful, documented approach over the fast, risky one.
Quick Review Summary
- Nonpublic records require consent, legal process, or statutory authority.
- RFPA: federal government access to bank records; notice and challenge rights.
- GLBA: financial privacy; pretexting is a crime.
- FCRA: permissible purposes; written authorization for employment; adverse action procedures.
- IRC 6103: tax returns confidential; Form 4506 for consent.
- Telephone Records and Privacy Protection Act: phone record pretexting is a crime.
- ECPA/SCA: email and stored communications; providers need process.
- HIPAA, FERPA, DPPA: medical, educational, and motor vehicle records.
- BSA: SARs are strictly confidential.
- Private examiners cannot issue subpoenas; work through counsel.
Master these points and you will be well prepared for any CFE exam question on nonpublic records and access requirements.
Test mode:
CFE - Nonpublic Records and Access Requirements Example Questions
Test your knowledge of Nonpublic Records and Access Requirements
Question 1
Which information is a fraud examiner MOST likely to obtain from a subject's brokerage account statements, a type of nonpublic financial record?
Question 2
Because bank records are nonpublic, a fraud examiner typically obtains a subject's account statements through the account holder's written consent, a subpoena, or a court order.
Question 3
A fraud examiner suspects that an accounts payable clerk created a shell company and has been paying its invoices. Using the organization's own authority, the examiner pulls the company's cancelled checks issued to that vendor. The examiner now needs to identify which financial institution received the deposited funds, so that legal counsel can seek a subpoena for the vendor's account records. Which detail on the cancelled checks would BEST identify that institution?
Unlock Premium Access
Certified Fraud Examiner (CFE)
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3404 Superior-grade Certified Fraud Examiner (CFE) practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CFE: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Nonpublic Records and Access Requirements questions
21 questions (total)