You applied for a card on a Tuesday night. By Thursday, a message says your application is on hold until you verify your identity. Is that normal, or is someone fishing? Both are possible. The difference usually shows up in how the request reaches you, not in what it says.

Why issuers ask in the first place

Banks, savings associations, credit unions, and certain other banks must run a Customer Identification Program, known as CIP. The rule is 31 C.F.R. § 103.121, and it carries out section 326 of the USA PATRIOT Act. FinCEN explains it in interagency guidance. The goal is simple. Confirm that the person opening an account is the person they claim to be.

The rule asks institutions to verify identity to the extent reasonable and practicable, using risk-based procedures. That phrase matters. An issuer weighs the type of account, how it was opened (online, phone, or in person), what identifying information is on hand, and its own size and customer base. So two people applying on the same day can get different requests. An extra step alone is not a warning sign.

The guidance also sets a minimum of basic information every customer must provide, and issuers add steps on top. The public sources reviewed here do not list those items or say which documents a given issuer will accept. Only that issuer can tell you, through its official channels.

One more detail. In June 2025, federal banking agencies issued an exemption order to some CIP requirements, with FinCEN concurrence, as the OCC announced. The sources reviewed here do not say how it applies to a card application. So do not assume a check is required or skipped. Ask the issuer.

Run the request through a quick scorecard

Score the message on two things: the channel it came through and the pressure it applies. Start with the channel. The CFPB advises against using the phone number, link, or email address in an unsolicited message. Look up the institution yourself instead, such as the number on your card or the one on its official website. Each question below is worth one point toward trust. A message that scores low on most of them deserves a pause.

  1. Did I start this? A real request usually follows an application you submitted, and it often lives inside that application.
  2. Did I find the contact details myself? If the only path is a link or number in the message, stop.
  3. Does it ask for something the issuer should already have? Be cautious if it does.
A woman stands at a sunlit bus shelter on a busy city street, turned partly away as she unfolds a paper letter, with blurred pedestrians and traffic behind her.
A woman unfolds a paper letter at a bus shelter. Whatever the format, look up the sender's contact details yourself before replying.
  1. Is there a deadline designed to rush me? Pressure to act fast is a warning sign in the sources.
  2. Am I being told to move money to keep it safe? The CFPB notes that the FTC never threatens you, never tells you to move money to protect it, and never asks you to withdraw cash or buy gold.
  3. Could I finish this by calling the number on my card? If yes, do that.

That second set of questions is about pressure. Messages that demand immediate action should slow you down. The American Bankers Association's Banks Never Ask That campaign exists because bank impersonation is a known problem. Anyone claiming to be a government agency who threatens you is another warning.

If you think your identity was misused

Say you replied to a message and now feel uneasy. The CFPB suggests a sequence. Close affected accounts, contact the security or fraud department of the institution involved, and report the theft at IdentityTheft.gov. That site can produce an Identity Theft Report and a recovery plan.

Keep notes as you go. Write down dates, representative names, reference numbers, and copies of messages. The sources reviewed here do not require this, but a record may help if an error needs correcting later. If you lost nothing but received a suspicious message, the FTC takes scam reports, and that is a reasonable place to send it.

Fraud alerts and security freezes

If your information may be exposed, the credit bureaus offer two tools. The FTC explains credit freezes and fraud alerts, and the bureaus explain their own versions, including Experian and Equifax. They work differently, so read those explanations before choosing the one that fits your situation.

Both tools are described as free at the three nationwide bureaus. Check the FTC page for current details, since the bureau pages were hard to read in full. Contacting one bureau can start the process, though you should confirm current steps on each official site. The sources reviewed here do not say how a freeze interacts with an application that is still pending. If you are mid-approval, ask both the bureau and the issuer about timing before you act.

What the public rules leave out

The sources do not say how long a decision takes after verification, what happens when a check fails, or how to appeal the result. They also do not explain whether a verification request touches your credit report or score, so no outcome should be assumed. If an issuer declines you or places a hold, ask for the specific reason and what it needs from you. Write down the answer and who gave it. If that goes nowhere, the CFPB takes complaints about financial products, and the FTC takes scam reports.

This article is general education, not personal financial, legal, or tax advice. If a large sum, a suspected crime, or a stuck dispute is involved, a qualified professional can look at your specifics.

Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.