In 2003, Congress passed legislation intended to prevent identity theft, specifically the Fair and Accurate Credit Transactions Act (FACTA). The Federal Trade Commission (FTC) later issued a “Red Flags” Rule, promulgated under FACTA, requiring financial institutions and creditors to take actions to prevent identity theft of covered accounts (accounts used for personal, family, or household purposes). Despite previous delays in the enforcement of the Red Flags Rule, enforcement of the Red Flags rule began on June 1, 2010.
The Red Flags Rule requires financial institutions and creditors to implement a written Identity Theft Prevention Program designed to identify, detect, and respond to the warning signs of identity theft in their day-to-day operations. Determining if your business is classified as a financial institution under the Red Flags Rule may take little consideration; however, determining if your business is a creditor under the Rule is arguably more difficult. The definition of creditor is broad and encompasses many businesses, no matter how small or large. For example, any business that regularly permits deferred payment for goods or services may fall within FACTA’s definition of “creditor.” Most businesses provide goods or services and then bill their customers later. Their customers then pay the business by way of “covered accounts.” “Covered accounts” are used for personal, family, or household purposes, including but not limited to, credit card accounts, checking accounts, savings accounts, and mortgage loans.
The Red Flags Rule creates much concern for small businesses that are facing the added expenses of compliance with this new Rule during an already difficult financial time. The FTC Red Flags web site is an excellent, free resource. It contains information to assist you in determining whether or not your business is subject to the Red Flags Rule and, if so, how to develop Program of compliance. The web site also contains a how-to guide for businesses, a video, and a do-it-yourself online compliance template for businesses who are at low risk for identity theft to design their Identity Theft Prevention Program.
The FTC has developed a site specific these regulations which can be found at http://ftc.gov/redflagsrule .
