What is the Red Flags Rule & How Does it Stop Identity Theft?

Each year, millions of Americans encounter identity theft. It can destroy credit, drain accounts, and inflict extensive damage on customers and businesses alike. To counter this evolving threat, regulatory frameworks like the Red Flags Rule have emerged as vital tools in the fight against fraudulent activities. Enforced by the U.S. Federal Trade Commission (FTC), the Red Flags Rule serves as a preemptive strike against identity theft, providing guidelines for businesses and organizations to detect, respond to, and prevent potential threats.

What is the Red Flags Rule?

The Red Flags Rule is a regulation established by the U.S. Federal Trade Commission (FTC) to help prevent identity theft. Enacted in 2008 as part of the Fair and Accurate Credit Transactions Act (FACTA), the Red Flags Rule requires certain businesses and organizations to implement identity theft prevention programs. The Red Flags Rule’s primary focus is on entities considered “creditors” or “financial institutions.” It also includes organizations that regularly extend credit or defer payment for goods or services, as well as those that offer or maintain accounts that involve multiple payments or transactions. The Red Flags Rule aims to enhance the ability of businesses to detect and respond to warning signs of identity theft, ultimately reducing the risk of financial and reputational harm to both the entity and the individuals it serves. 

Who Needs to Comply?

Specifically, the Red Flags Rule covers entities that meet the definition of creditors or financial institutions and have “covered accounts.” A covered account is primarily used for personal, family, or household purposes that involve multiple payments or transactions and pose a reasonably foreseeable risk of identity theft. Entities that often need to comply with the identity theft Red Flags Rule include:

Financial Institutions

According to the Red Flags Rule, a “financial institution” is defined as a national or state bank, a federal or state savings and loan association, a federal or state federal credit union, a mutual savings bank, or an individual that holds a transaction account belonging to a customer whether directly or indirectly. 

Creditors

Various businesses that regularly extend credit or defer payment for goods and services, including but not limited to:

• Credit card issuers
• Mortgage lenders
• Auto lenders
• Utilities extending credit
• Healthcare providers billing patients

Entities that Maintain Covered Accounts

Even if an organization is not a traditional financial institution or creditor, it may fall under the rule if it maintains covered accounts. It can include entities that provide services on credit, such as telecommunications companies, healthcare providers, and certain service providers.

Covered entities need to assess whether they fall under the definition of creditors or financial institutions and whether they maintain covered accounts. If so, they are required to comply with the Red Flags Rule by implementing an identity theft prevention program tailored to their specific operations.

Entities subject to the Red Flags Rule should regularly review and update their programs to address emerging threats and changes in their operations. Compliance with the rule helps protect consumers from identity theft and ensures that organizations are taking proactive measures to detect and respond to suspicious activities related to identity theft.

How to Comply

Compliance with the Red Flags Rule involves three essential steps for developing and implementing an effective identity theft prevention program. 

Identify Red Flags

The first step is to identify potential red flags of identity theft within the organization’s covered accounts. Red flags are practices, possible patterns, or specific activities that indicate the risk of identity theft. This assessment should consider the nature of the organization’s operations, the types of covered accounts it maintains, and any historical incidents of identity theft or fraud. For example, red flags for deposit accounts may differ from those for credit accounts. The following reflect different categories of common red flags: 

Alerts, Warnings, and Notifications Sent by a Credit Reporting Company

Any changes in a credit report can be a strong indication of identity theft. Some examples include a fraud or active duty alert, a notice of an address discrepancy, a notice of a credit freeze, or a credit report indicating an increase in the use of credit. 

Suspicious Documents

There can be several kinds of red flags associated with document discrepancies. For instance, identification may appear forged or altered, the individual presenting the ID doesn’t match the photo, a signature doesn’t match, or the application seems to have been forged or altered. 

Account Activity

How an account is being used can be a clear sign of identity theft. A few examples include:

• New credit cards are requested after an address change.
• Available credit is used for cash advances on merchandise.
• Unauthorized charges on the account present themselves. 

Prevent Identity Theft

Once you spot a red flag, it’s essential that it be dealt with swiftly and appropriately. Enterprises and institutions may need to accommodate laws regarding terminating or providing service. Here are some appropriate responses offered by the Red Flags Rule Guidelines:

• Update the customer
• Change passwords and security codes
• Close existing accounts
• Reopen an account and provide a new account number
• Notify law enforcement

Each instance of identity theft may require some of these options, all of them, or more. 

Update Your Plan Regularly

The Red Flag Rule acknowledges that additional red flags may emerge as technology advances and identity thieves adjust their approaches. Updating your plans and policies related to fraud and identity theft is essential. There are a lot of factors that can alter your current approach to combating identity theft. For instance, there may be changes in the accounts you offer, new detection methods, or new service providers. 

How the Red Flags Rule Fights Identity Theft

Businesses that comply with the Red Flags Rule can prevent identity theft in several ways. An implemented program will help enterprises identify red flags affecting customer accounts. It can also safeguard businesses by requiring them to develop and employ policies and procedures for responding to red flags. A proactive approach allows organizations to detect red flags and prevent identity thefts before they can occur. The Red Flag Rule also requires businesses to notify customers of procedures and policies for red flag responses. When businesses communicate their approaches to identity theft, it can build customer confidence and educate them on how their information is protected. 

Navigating the continual rise of identity theft can be challenging for financial institutions. Join BankersHub for our webinar Online Account Application Fraud: Identification Prevention and Recovery. If you’re considering implementing the online account opening process or already have, it’s important to understand fraud risks and how to prevent them. This webinar takes attendees through the implementation of effective tools to identify account application fraud and best business practices to identify, handle, and escalate these threats. The knowledge gained from this important webinar can help with Red Flag Rule compliance.