What Are Red Flag Rules?

Red Flag rules were created by the Federal Trade Commission to help prevent identity theft. The National Credit Union Administration also had input on the rules. It was passed in January 2008 and was put in place in November 2008. Unfortunately, there has been opposition so the Federal Trade Commission has been forced to delay the enforcement five times. It was finally signed into law in December, 2010. This bill removes certain businesses from the Federal Trade Commission Red Flag Rules.

The companies that are exempt from this bill are health care practices and veterinary practices. It also defines “creditor” differently from what the Federal Trade Commission did. The reasoning behind this difference is that it has the intent of exempting small businesses and other service providers who, at the time of the service, do not receive payment in full. This is why health care practices and veterinary practices are exempt.

Even though health care practices and veterinary practices are exempt, they still should review the Red Flag rules to make sure that their employees and customers are protected because many of the customers pay by credit card, debit card, or check. All personal information needs to be protected to help prevent identity theft.

This rule applies to Creditors and Financial Institutions.

  • Financial Institutions—it can be any entity that holds a “transaction account” that belongs to a consumer. This can include a state or national bank, a mutual savings bank, a state or federal savings and loan associations, a state or federal credit union.
  • Creditor—this is any entity that regularly renews or extends credit. This can also include any firm or company that receives payment after a service is completed.

This rule can apply to automobile dealers, mortgage brokers, finance companies, utility companies, medical practices, hospitals and more.

The Red Flag rule states how certain organizations and businesses must implement, develop, and administer their Identity Theft Prevention Programs. Before you can implement your Identity Theft Prevention Program you must include four basic elements, which are:

  • Identify Relevant Red Flags—you need to be able to identify the ones that you are likely to come across in your business.
  • Detect Red Flags—you have to set up the procedures that you are going to use to detect these red flags in your day-to-day operations.
  • Prevent and Mitigate Identity Theft—once you have spotted a red flag, you have to respond appropriately to prevent and mitigate the harm that was done.
  • Update your program—the risks of identity theft changes rapidly so it is very important to educate your staff and keep the program current. Update your program. The risks of identity theft changes rapidly so it is very important to educate your staff and keep the program current.

Some of the things that creditors and financial institutions need to do to protect their customer’s identity is when a person asks to open a new account, they need to make know that the person who is applying is for a new account is the actual person. Make sure that the process you use will detect the Red Flag, if there is one, before the account is opened, not after the account is opened and the person has had a chance to run up a bill they have no intention of paying.