Civ. Code, § 1785.20.3

(a) Any person who uses a consumer credit report in connection with the approval of credit based on an application for an extension of credit, and who discovers that the consumer’s first and last name, address, or social security number, on the credit application does not match, within a reasonable degree of certainty, the consumer’s first and last name, address or addresses, or social security number listed, if any, on the consumer credit report, shall take reasonable steps to verify the accuracy of the consumer’s first and last name, address, or social security number provided on the application to confirm that the extension of credit is not the result of identity theft, as defined in Section 1798.92.

(b) Any person who uses a consumer credit report in connection with the approval of credit based on an application for an extension of credit, and who has received notification pursuant to subdivision (k) of Section 1785.16 that the applicant has been a victim of identity theft, as defined in Section 1798.92, may not lend money or extend credit without taking reasonable steps to verify the consumer’s identity and confirm that the application for an extension of credit is not the result of identity theft.

(c) Any consumer who suffers damages as a result of a violation of this section by any person may bring an action in a court of appropriate jurisdiction against that person to recover actual damages, court costs, attorney’s fees, and punitive damages of not more than thirty thousand dollars ($30,000) for each violation, as the court deems proper.

(d) As used in this section, “identity theft” has the meaning given in subdivision (b) of Section 1798.92.

(e) For the purposes of this section, “extension of credit” does not include an increase in an existing open-end credit plan, as defined in Regulation Z of the Federal Reserve System (12 C.F.R. 226.2), or any change to or review of an existing credit account.

(f) If a consumer provides initial written notice to a creditor that he or she is a victim of identity theft, as defined in subdivision (d) of Section 1798.92, the creditor shall provide written notice to the consumer of his or her rights under subdivision (k) of Section 1785.16.

(g) The provisions of subdivisions (k) and (l) of Section 1785.16 do not apply to a consumer credit reporting agency that acts only as a reseller of credit information by assembling and merging information contained in the database of another consumer credit reporting agency or the databases of multiple consumer credit reporting agencies, and does not maintain a permanent database of credit information from which new credit reports are produced.

(h) This section does not apply if one of the addresses at issue is a United States Army or Air Force post office address or a United States Fleet post office address.