It states that when there is an extended fraud alert that the customer must be contacted at the number provided.

(A)(ii) a telephone number or other reasonable
contact method designated by the consumer.

Is it acceptable to have a process where the customer is directed to call in and a CBR quiz is used to verify their identity?

Although not an expert, I don't believe this would be acceptable. The CBR that I have seen with an extended alert also stated a phone number. From the training I have received I was told that the bank was required to contact the customer at that number since that was their request initially.

The FACT Act says you must follow what the customer listed on the fraud alert. The key is "designated by the consumer."

David,
What if the phone number on the credit report is not longer listed?

If the phone number is no longer valid, is there any any other contact info. provided? If not, I would try to contact the customer through other means possible and then verify it was them that applied. I'd want to be VERY sure they are who they say they are.

If I was 100% comfortable it was really them, I would tell them to update the fraud alert info and document the heck out of this. Not a little CYA, but a lot of CYA in this case.

BTW, Happy Birthday.