201 CMR 16.09
Lost Personal Identification Number or Password
Upon receipt of notification, conforming to the procedures referenced in 201 CMR 16.03(e),
that a resident has lost his or her personal identification number or password, the consumer
reporting agency shall cancel the lost personal identification number or password and, as soon
as practicable thereafter and without unreasonable delay, but in no event later than three business
days after receipt of such notification, mail to such resident a new personal identification number
or password, provided that the resident has supplied the information necessary for proper
identification given pursuant to 201CMR 16.03(a). The new personal identification number or
password shall not contain the resident’s Social Security Number or any sequence of three or
more numbers of the resident’s Social Security Number.