Identification

• The Red Flags Rule requires the creation and implementation of written Identity Theft Prevention Programs. The rule applies to financial institutions and certain creditors. Financial institutions generally include banks, credit unions and savings and loans. Creditors generally include businesses or organizations that regularly defer payment for goods and services or businesses that provide their products or services and bill customers later. For example, finance companies, car dealers, and even some furniture retailers may be subject to the rule.
  
  

Types

• A financial institution or creditor may have two types of "covered accounts" subject to the rule. The first kind is a consumer-type account used mostly for personal, family or household purposes that allows for multiple payments or transactions. Examples include cell phone, mortgage loan, credit card, car loan, utility and bank accounts. The second type of covered account includes any account with a foreseeable risk of identity theft, including small business or sole proprietorship accounts.
  
  

Features

• The design of a program is primarily up to the business, but it must include procedures for identifying and detecting warning signs--or "red flags"--of possible identity theft. Red flags include unusual account activity, attempted use of suspicious documents or fraud alerts from a customer, consumer reporting agency or law enforcement agency. Once policies to identify and detect red flags have been written, the program must also include procedures for responding to those red flags to prevent and mitigate identity theft.
  
  

Warning

• Compliance with the rule does not end with just writing the program. The rule also has requirements for incorporating the program into day-to-day business operations. The program must be managed by the board of directors or senior employees of the business, include staff training and provide for oversight of any contractors. It must also include a detailed plan for updating the program.
  
  

Time Frame

• After June 1, 2010, any business or organization subject to the Red Flag Rule must be in compliance, meaning the Identity Theft Prevention Program must be written and implemented. Compliance with the rule is enforced by the Federal Trade Commission, federal banking regulatory agencies and the National Credit Union Administration.