(1) If a credit information provider reasonably believes that a credit information subject has been, or may have been, impersonated by any person, the credit information provider shall give to the credit information subject notice of that belief.

(2) The notice shall be given as soon as reasonably practicable and (in any event) not later than 24 hours after the credit information provider first believes that the credit information subject has been, or may have been, impersonated.