Florida Digital Bill of Rights (FDBR) 2-3.004(1)(d): Rule 2-3.004(1)(d) and (e): account holders, fraud detection and appeals by others

Where the consumer holds a password-protected account, the controller must authenticate through that account's existing method, may not require a new account, must have measures to detect and prevent fraudulent authentication, and on detecting suspicious activity must notify the consumer as soon as practicable, attempt commercially reasonable authentication, and hold the request until authentication succeeds. An appeal lodged by someone other than the original requester must be authenticated the same way.