Identity Theft Red Flag Rule
Address Discrepancies under the Fair and Accurate Credit Transactions Act of 2003

This website page provides important information regarding the Identity Theft "Red Flag Rule". As you may or may not be aware, federal regulatory agencies have released the much anticipated final rule for Identity Theft Red Flags and Address Discrepancies under the Fair and Accurate Credit Transactions Act of 2003 (commonly referred to as the "Red Flag Rule").

This Rule has a significant impact on a wide variety of organizations.

Background:

The issuance of the final rule of the Identity Theft Red Flags and Address Discrepancies under the Fair and Accurate Credit Transactions Act of 2003 rule implements sections 114 and 315 of the Fair and Accurate Credit Transactions Act of 2003, an amendment to the Fair Credit Reporting Act. The purpose of the Rule is to attempt to minimize incidents of Identity Theft and fraud in the opening and maintenance of covered accounts by financial institutions and creditors, as well as addressing issues of address discrepancies by users of consumer reports (credit reports and specialty consumer reports) and debit or credit card issuers.

Final Rule Effective Date: 1 January, 2008

Date of Mandatory Compliance by Covered Institutions and Creditors: 1 November, 2008

Summary of Key Requirements:

The final rules requires each financial institution and creditor that holds any consumer account, or other account for which there is a reasonably foreseeable risk of identity theft, to develop and implement a written Identity Theft Prevention Program for combating identity theft in connection with the opening of new accounts and the maintenance of existing accounts. The Program must include reasonable policies and procedures for detecting, preventing, and mitigating identity theft of its customers and enable a financial institution or creditor to specifically:

1. Identify relevant patterns, practices, and specific forms of activity that are "red flags" signaling possible identity theft and incorporate those red flags into the Program;

2. Detect red flags that have been incorporated into the Program;

3. Respond appropriately to any red flags that are detected to prevent and mitigate identity theft; and

4. Ensure the Program is updated periodically to reflect changes in risks from identity theft.

The agencies also issued guidelines to assist financial institutions and creditors in developing and implementing a Program, including a supplement that provides examples of red flags.

The final rules also require credit and debit card issuers to develop policies and procedures to assess the validity of a request for a change of address that is followed closely by a request for an additional or replacement card. In addition, the final rules require users of consumer reports to develop reasonable policies and procedures to apply when they receive a notice of address discrepancy from a consumer reporting agency.

It is important to note that, as with the Disposal Rule, the Red Flags Rule does NOT automatically apply to every business. Under the final rule, only those financial institutions and creditors that offer or maintain "covered accounts" must develop and implement a written Program. For example, a restaurant that accepts credit cards as a means of one-time payment in full by a customer who purchases a meal is not impacted; whereas, a utility company that opens and maintains accounts for its customers is impacted.

Question:

"To what businesses does the Red Flag Rule apply?

Answer:

The provisions of the Red Flags Rule predominantly apply to financial institutions and creditors that offer or maintain covered accounts, and also to users of consumer reports and to debit or credit card issuers. As noted below, "creditor" is somewhat broadly defined, though the key determination of a mandatory compliance requirement is triggered by the offering or maintenance of "covered accounts" (or if the business is a user of consumer reports or issues debit or credit cards).

Click the Link Below to View the Complete Text of Identity Theft Red Flag Rule and Address Discrepancies under the Fair and Accurate Credit Transactions Act of 2003 (256 page pdf document):

Identity Theft Red Flags

Return to Small Business Protection

From Identity Theft Red Flag Rule to Home Page

Identity Theft Red Flag RuleAddress Discrepancies under the Fair and Accurate Credit Transactions Act of 2003

Identity Theft Red Flag Rule
Address Discrepancies under the Fair and Accurate Credit Transactions Act of 2003