Nitpick: depending on how the financing is structured, it may not be under CFPB jurisdiction at all - the DOJ explainer on the ECOA says that retailers and "finance companies" are the FTC's responsibility.

https://www.justice.gov/crt/equal-credit-opportunity-act-3

IANAL but I do suspect the counter-argument would be that their internal fraud processes & metrics have determined there's NO approach that produces "reasonable belief" of the user's identity as required before issuing credit for a report with a fraud alert.

https://www.govinfo.gov/content/pkg/USCODE-2011-title15/html...