How to Comply With the FTC's Red Flag Rules
The Federal Trade Commission (FTC) amended its Fair and Accurate Credit Transactions Act (FACTA) of 2003 to include Red Flag rules. Under these rules, financial institutions and creditors must take additional steps to combat identity theft. This requires the use of written programs and procedures for identifying "red flags" or warning signs of identity theft. Red flags or warning signs can include unusual account activity and fraud alerts. As of November 1, 2008, all financial institutions and creditors must be Red Flag compliant.
Other People Are Reading
Instructions
-
-
1
Study identity theft and Red Flag rules. Before an organization can develop and implement a written Red Flag program, it must understand identity theft and Red Flag rules. Identity theft is the unauthorized use of another person's identity or personal information. Instances can include applying for a loan or using someone's account without his permission. Red Flag rules fall into five categories of identity-theft warning signs. These include: alerts, notifications or warnings from consumer reporting agencies; suspicious documents; suspicious personal information such as a suspicious address; unusual account activity; notices from customers, law enforcement, victims of identity theft, or other businesses about possible identity theft on covered accounts.
-
2
Develop your Red Flag program. As part of the Red Flag rules, financial institutions and creditors must have written programs or procedures for detecting, preventing and dealing with instances of identity theft. Financial institutions include banks, savings and loans (S&Ls), credit unions and any other entity that holds consumer transaction accounts. Organizations have the flexibility to design and implement their own plans based on the size, complexity and nature of their business. These plans, however, must effectively address and mitigate identify theft. Put together a written program that allows the organization to address possible instances of identity theft. This program should provide instructions such as how to proceed if identity theft is suspected regarding an account. This can include reporting the account to a manager and suspending account activity or placing a freeze on the account.
-
-
3
Implement your Red Flag program. This should include training to educate staff on the Red Flag program. Any staff members who have access to customer accounts or who may be in a position to detect, prevent or mitigate identity theft should be part of this training. Red Flag rules require your Red Flag program to be managed by the board of directors or senior employees. The program should also provide oversight to make sure it is followed and remains effective. Updates should be made to reflect any changes in identity theft risks.
-
1
References
- Photo Credit red flag image by Lombok from Fotolia.com
