FTC Issues Amended Rule on Identity Theft Red Flags

The Federal Trade Commission today announced publication of an Interim Final Rule on identity theft “red flags” that narrows the circumstances under which creditors are covered by the Rule.

Congress directed the FTC, along with several banking agencies to develop regulations requiring “financial institutions” and “creditors” to develop and implement a written identity theft prevention program.   By identifying “red flags” for identity theft in advance, businesses can be better equipped to spot suspicious patterns that may arise -- and take steps to prevent potential problems from escalating into a costly episode of identity theft.

Under the Rule, Red Flag Programs must have four parts.  First, the Program must include reasonable policies and procedures to identify signs – or “red flags” – of identity theft in the day-to-day operations of the business.  Second, the Program must be designed to detect the red flags of identity theft identified by the business.  Third, the Program must set out the actions the business will take upon detecting red flags.  Finally, because identity theft is an ever-changing threat, a business must re-evaluate its Program periodically to reflect new risks from this crime. 

The agencies promulgated the Red Flags Rule in 2007.  In December 2010, Congress enacted legislation narrowing the definition of “creditors” covered by the Rule.  The amended Red Flags Rule now provides that a creditor is covered only if, in the ordinary course of business, it regularly:

• Obtains or uses consumer reports in connection with a credit transaction;
• Furnishes information to consumer reporting agencies in connection with a credit transaction; or
• Advances funds to or on behalf of a person, in certain cases.

The Commission is seeking comment on the Interim Final Rule for 60 days.  After the expiration of the 60-day comment period and a review of the comments received, the Interim Final Rule will become final.   

The Commission vote approving issuance of the Federal Register notice announcing the Interim Final Rule was 5-0.  The notice will be published in the Register shortly and can be found on the FTC’s Web site as a link to this press release.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC's online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 2,000 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s website provides free information on a variety of consumer topics.  Like the FTC on Facebook, follow us on Twitter, and subscribe to press releases for the latest FTC news and resources.