Is it? What paragraph makes it ambigious whether a company needs to do more than reasonable efforts establish if a request is legitimate?