Complain about a product or service

'Red Flags Rules' for Identity Theft on the Way

Feds push for better fraud and theft prevention

By Martin H. Bosworth
ConsumerAffairs.Com

July 8, 2008

Called the "Red Flags Rules," the rules mandate that banks, credit unions, and similar institutions set up written plans for identifying suspicious "red flag" transactions that could indicate identity theft or fraud, and update their plans with changing trends in financial crimes.

The rules were passed as part of the Fair and Accurate Credit Transactions Act (FACTA) in 2003, but did not go into effect until January 1, 2008, and full compliance is not due until November 1, 2008.

The long delay of full implementation and lack of consumer awareness led to scarcity of information and some confusion among financial institutions as to who should comply and what compliance requires. After several revisions, the final rules were issued on October 31, 2007.

The FTC is pushing a "general outreach" campaign to educate businesses and individuals as to what the Red Flags Rules mean.

"We want financial institutions and creditors to know that they are covered by the Red Flags Rules and to understand what is required of them," said FTC Bureau of Consumer Protection director Lydia Parnes. "We encourage all organizations that have ongoing accounts or relationships with consumers to keep an eye out for red flags that signal identity theft."

What kind of financial activity constitutes a "red flag" under the new rules? Included among the potential warning signs:

• Alerts from credit bureaus, such as requests for consumer credit reports that have fraud alerts or credit freezes in place.

• Suspicious or apparently forged documents, such as photo identification that doesn't match the person presenting the identification, or unverifiable addresses and Social Security numbers.

• Suspicious account activity from the customer, such as sudden spending on goods that can be resold for cash, frequent requests for cash advances, or failures to make payments on balances after making initial payments.

The Red Flags Rules govern financial institutions and creditors that have specific, ongoing transactional relationships with customers who maintain a regular account with the entity, such as banks, credit unions, and savings and loan associations.

"Creditors" include a wide range of businesses, from automobile dealerships to telecommunications companies, all of which are considered "any entity that regularly extends, renews, or continues credit; any entity that regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who is involved in the decision to extend, renew, or continue credit" under the rules.

The FTC said that more guidance on the rules would be forthcoming, possibly including details on punishments for financial entities that fail to comply with the rules or the regular reporting requirements.

No. 1

Identity theft has been the number one fraud complaint filed with the FTC for the better part of a decade. The agency's yearly publication of its fraud complaints regularly finds identity theft outstripping all other categories. In 2007, the FTC reported that of 813,899 total complaints received in 2007, 258,427, or 32 percent, were related to identity theft.

According to the FTC, total consumer fraud losses totaled $1.2 billion, with the average monetary loss for an individual at $349.

The FTC's last official survey, released in November 2007, claimed 8.3 million Americans had been victims of identity theft in 2005. The agency recently announced that it would commission a new study of the experiences of identity theft victims, including their knowledge of remedies available to them under the law.

Although the FTC does not publish identity theft trends broken down by businesses or industries, privacy expert Chris Hoofnagle used the FTC's complaint data to determine that large banks and telecommunications companies had a disproportionately large share of consumer complaints relating to identity theft.

Hoofnagle said that publicly-available reporting data on institutions' experience with identity theft could help consumers make better decisions about which companies to do business with.

Another research report noted that existing data breach disclosure laws seem to do little to actually prevent identity theft, in part because companies may comply with breach laws, but do little to actually improve their security procedures in the long run.

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Back to the top |