When an agency receives a record response to an NCIC query containing identity theft information and the person inquired upon does not appear to be identical with the subject of the Identity Theft File record and/or does not know the assigned password, the inquiring agency must contact the ORI of the record to confirm the record information prior to taking official action based on the record information. The subject of the inquiry may be the identity thief, and the location of the subject could be beneficial to the identity theft case of the entering agency. If the originating agency requests notification of all hits, this agency should place a Y in the Notify Originating Agency (NOA) Field.