12 CFR 1403.4: Times, places, and requirements for identification of individuals making requests.

The individual making written requests for information or records ordinarily will not be required to verify that person's identity. The signature upon such requests shall be deemed to be a certification by the requester that he or she is the individual to whom the record pertains, or the parent of a minor, or the duly appointed legal guardian of the individual to whom the record pertains. The Privacy Act Officer, however, may require such additional verification of identity in any instance in which the Privacy Act Officer deems it advisable.