We have received a mortgage insurance quality control letter requesting info. on one of our former deposit accounts. I am uncomfortable completing the questions because one question asks for the former customers social security number. Can we give general answers such as the account is no longer open without causing any privacy problems?

The customer should have signed an authorization to allow a quality control review of the loan file. You can certainly refuse to cooperate but to the extent financial institutions utilize GLBA to thwart the legitimate exchange of information, fraud can increase. Do you not have the customer authorization for verificaton of deposits ?

If the borrower had signed a standard FannieMae application (1003), just above the signature line there is section IX Acknowledgement and Agreement. These are basically the borrower's reps and warranties on the loan.

Point (6) states " any owner or servicer of the loan may verify or reverify any information contained in the application from any source named in this application, and Lender, its successors or assignes may retain the original and/or an electronic record of this application even if the loan is not approved."

From a QC point, the verification to the bank should have come in with a signed copy of the acknowledgement and agreement.

FannieMae and FreddieMac have standard forms that are used to facilitate QC requests like this. I can't remember the number right now, but it might be a 1004. I suggest you require any such requests to be submitted on the proper form.

Anyway, in addition to the language on the 1003, many lenders also get a separate authorization form signed by the applicants at the time of application that authorizes the lender or its agents/assigns to request and receive information about the borrower. These authorizations usually apply both to underwriting-related requests for information and subsequent QC requests as well. A copy of this form should be attached to the QC reverification request.

Remember, there is no law that obligates you to respond. The idea, however, is that fighting fraud is a good thing in general for all lenders (and the public too), so if you can reply without violating privacy laws, then it's in the best interest of everyone.