What is the "Red Flags" Rule?
The "Red Flags" Rule
requires many businesses to implement a written Identity Theft
Prevention Program designed to detect the warning signs ("red
flags") of identity theft, and take steps for prevention and
mitigation. The intent is to protect consumers by
identifying red flags in advance and taking steps to prevent
escalation to fraud. The Red Flags Rule is enforced by the
Federal Trade Commission (FTC) and is currently slated to go
into effect June 1, 2010.
Who does it impact?
The determination of
whether the Red Flags Rule applies to your business is based on
your business activities and not your industry. There are
essentially two parts to making this determination, 1.) If you
meet the definition of a "financial institution" or "creditor",
and 2.) if you have "covered accounts". It is important to
read these definitions carefully as they are very broad and
apply to firms which typically might not use these words to
describe themselves.
Who is a
"Creditor"? - For purposes of the Red Flags Rule, a
"Creditor" includes any business or organization that "regularly
defer payment for goods or services or provides goods or
services and bills customers later".
What is a "Covered
Account"? - If you meet the definition of "financial
institution" or "creditor" you must then determine if you have
any "covered accounts". A "covered account" is a consumer
account that you offer your customers that is designed to permit
multiple payments or transactions. In addition, it
includes any account you offer for which there is a reasonably
foreseeable risk to customers or to the safety of you from
identity theft.
How to comply
If you are considered
a financial institution or creditor with covered accounts, you
must develop and implement a written Identity Theft Prevention
Program. Your program must be appropriate to the size and
complexity of your business and the nature and scope of your
activities. It will in essence include Four Steps:
1. Identify
relevant red flags.
2. Establish
procedures to detect those red flags in your operations.
3. Prevent and
mitigate identity theft if you spot red flags.
4. Update your
program regularly.
This information is
developed from materials on the FTC website and is intended to
be a general overview of the Red Flags Rule. It should not
be relied on solely in your determination if the Red Flags Rule
applies to you. For more information visit the Federal
Trade Commission
website and consult legal
counsel. |
