201 CMR, § 16.09
Upon receipt of notification, conforming to the procedures referenced in 201 CMR 16.03(e), that a resident has lost his or her personal identification number or password, the consumer reporting agency shall cancel the lost personal identification number or password and, as soon as practicable thereafter and without unreasonable delay, but in no event later than three business days after receipt of such notification, mail to such resident a new personal identification number or password, provided that the resident has supplied the information necessary for proper identification given pursuant to 201CMR 16.03(a). The new personal identification number or password shall not contain the resident's Social Security Number or any sequence of three or more numbers of the resident's Social Security Number.
201 CMR, § 16.09