The Federal Red Flag Rules are designed to protect consumers from identity theft by requiring financial institutions, creditors, and businesses that act as fiduciaries to develop a plan to detect and protect against identity theft of an individual for which it maintains identifying information. Additionally, the party maintaining the data must properly identify a client, customer or patient before discussing confidential data.
Many businesses might be surprised to know they are considered creditors under the Red Flag Rules. If you are a business that provides trade credit and obtains personally identifiable information from another business’ principals, you are likely to be a creditor under the FTC guidelines. Medical offices, dental offices, and even veterinarians may be considered creditors under the FTC guidelines if you obtain identifying information about patients and use that information for filing insurance claims and collecting from patients.
The FTC’s definition of a creditor a creditor is, “A creditor is any entity that regularly extends, renews, or continues credit; any entity that regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who is involved in the decision to extend, renew, or continue credit.”
Below are 26 examples of Red Flags of identity theft that those businesses responsible must develop policies and procedures around and provide training to their employees about:
The 26 Red Flag Rules*
1. A fraud alert included with a consumer report.
2. Notice of a credit freeze in response to a request for a consumer report.
3 A consumer reporting agency providing a notice of address discrepancy.
4. Unusual credit activity, such as an increased number of accounts or inquiries.
5. Documents provided for identification appearing altered or forged.
6. Photograph on ID inconsistent with appearance of customer.
7. Information on ID inconsistent with information provided by person opening account.
8. Information on ID, such as signature, inconsistent with information on file at financial institution.
9. Application appearing forged or altered or destroyed and reassembled.
10. Information on ID not matching any address in the consumer report, Social Security number has not been issued or appears on the Social Security Administration’s Death Master File, a file of information associated with Social Security numbers of those who are deceased.
11. Lack of correlation between Social Security number range and date of birth.
12. Personal identifying information associated with known fraud activity.
13. Suspicious addresses supplied, such as a mail drop or prison, or phone numbers associated with pagers or answering service.
14. Social Security number provided matching that submitted by another person opening an account or other customers.
15. An address or phone number matching that supplied by a large number of applicants.
16. The person opening the account unable to supply identifying information in response to notification that the application is incomplete.
17. Personal information inconsistent with information already on file at financial institution or creditor.
18. Person opening account or customer unable to correctly answer challenge questions.
19. Shortly after change of address, creditor receiving request for additional users of account.
20. Most of available credit used for cash advances, jewelry or electronics, plus customer fails to make first payment.
21. Drastic change in payment patterns, use of available credit or spending patterns.
22. An account that has been inactive for a lengthy time suddenly exhibiting unusual activity.
23. Mail sent to customer repeatedly returned as undeliverable despite ongoing transactions on active account.
24. Financial institution or creditor notified that customer is not receiving paper account
25. Financial institution or creditor notified of unauthorized charges or transactions on
26. Financial institution or creditor notified that it has opened a fraudulent account for a person engaged in identity theft.
*Source: Federal Trade Commission
If you think your business may be impacted by the impending Red Flag Rules, you should begin formulating your company’s policies and procedures as soon as possible. The FTC has a large library of information available for you to start with.
You may contact Sam directly at: email@example.com
or follow him on Twitter: SMBfinance
EXTRA: If you have questions for Sam regarding business financing, the credit market, and similar issues, please send an e-mail. Your questions will be recorded and Sam will answer the best ones in his Ask the Expert podcast show.