The “Red Flags” Rule: Are You Complying with New Requirements for Fighting Identity Theft?
by Tiffany George and Pavneet Singh
The expression “red flag” signals “Danger: Be alert to problems ahead.” For millions of consumers every year, identity theft is more than a threat — it’s their reality. The economic, psychological, and emotional harm to victims can be devastating. But businesses often bear the biggest part of the monetary damage from identity theft.
It’s everyone’s responsibility to do what they can to fight identity theft. But businesses and organizations that offer credit or other financial services can be the first to spot the red flags that signal the risk of identity theft, including suspicious activity indicating that identity thieves may be using stolen information like names, Social Security numbers, account numbers, and birth dates to open new accounts or raid existing ones.
Under the Red Flags Rule, which went into effect on January 1, 2008, certain businesses and organizations are required to spot and heed the red flags that often can be the telltale signs of identity theft. To comply with the new Red Flags Rule — enforced by the Federal Trade Commission (FTC), the federal bank regulatory agencies, and the National Credit Union Administration (NCUA) — you may need to develop a written “red flags program” to prevent, detect, and minimize the damage from identity theft.
Are you covered by the Red Flags Rule? If so, have you put into place the new procedures the Rule requires?
Who Must Comply
Although every business or organization with an ongoing relationship with consumers should keep an eye out for the possibility of identity theft, the Red Flags Rule applies only to “financial institutions” and “creditors." To determine if your business or organization is covered by the Rule and required to develop a written identity theft Program, you’ll need to answer two questions:
Is your business or organization either a “financial institution” or “creditor,” as those terms are defined in the Rule?
If so, do you have “covered accounts”?
A “financial institution” is a bank, savings and loan, credit union, or other entity that holds a “transaction account” belonging to a consumer. A “transaction account” is an account that allows the owner to make payments or transfers. Examples include checking accounts, savings accounts that permit automatic transfers, and share draft accounts. Another example would be a brokerage account that allows consumers to write checks.
Your business or organization is a “creditor” if you regularly:
-
extend, renew, or continue credit;
-
arrange for someone else to extend, renew, or continue credit; or
-
are the assignee of a creditor who is involved in the decision to extend, renew, or continue credit.
Under the Rule, “credit” means an arrangement by which you defer payment of debts or accept deferred payments for the purchase of property or services. In other words, payment is made after the product was sold or the service was rendered. Some examples of creditors are finance companies, automobile dealers, mortgage brokers, utilities, and telecommunications companies. Even if you’re a non-profit or government agency, you still may be a creditor if you accept deferred payments for goods or services. However, simply accepting credit cards as a form of payment does not make you a creditor under the Rule.
If you determine you’re a financial institution or a creditor, the next step is to see if you have “covered accounts.” There are two types of covered accounts. One is an account used mostly for personal, family, or household purposes that involves multiple payments or transactions. Examples include credit card accounts, mortgage loans, car loans, margin accounts, cell phone accounts, utility accounts, and checking or savings accounts.
The other is one for which there is a foreseeable risk of identity theft. For example, one type of account that should be considered for coverage because it may be vulnerable to identity theft is a small business or sole proprietorship
|
TRAINING OPPORTUNITIES
Tampa Bay Chapter
Dinner Meetings
April
14, 2009
"Red Flags of Fraud"
Debbi Drake, CFS. VP/Sr. Corporate Investigator, Mercantile Bank
10th Annual Fraud & Computer Crimes Seminar
May 26-27, 2009
Ruth Eckerd Hall
Clearwater, Florida
1111 McMullen Booth Road
Clearwater, FL 33759
Association of Certified Fraud Examiners
20th Annual ACFE Fraud Conference and Exhibition
- Las Vegas, NV
2008 - 2009
OFFICERS &
DIRECTORS
PRESIDENT
Steve Hooper, CIA, CFE, CCSA, CGAP
Clerk of the Circuit Court Hillsborough County, FL
(813) 276-2029 x3703
VICE PRESIDENT
Christine Dever, CPA, CFE
City of Tampa
(813) 274-7166
SECRETARY
Ellen Wilcox, CFE
Florida Department of
Law Enforcement
(727) 298-2482
TREASURER
Laura Krueger Brock, CPA/CFF, CFE, CVA
Kirkland, Russ, Murphy & Tapp, P.A.
(727) 572-1400
DIRECTOR
Mark Dubina,
CFE
Tampa Port Authority
(813) 241-1893
DIRECTOR
Sharon Shaw, CFE
Tel: (727) 674-8399
DIRECTOR
Debbie Venanzio, CFE
Branch Banking & Trust Co.
Tel: (727) 302-5498
DIRECTOR
Bill Miles, CFE
Florida Department of
Law Enforcement
Tel: (863) 701-1474
DIRECTOR
Gary Chapman, CIA, CGAP, CFE
City of Tampa
Tel: (813) 274-7163
CHAPTER TRAINING
Wayne Boytim, CFE
Retired
(813) 274-7167 |
|
account. In determining whether you have such an account, consider the risks associated with how the accounts may be opened or accessed — i.e. what type of interaction and documentation is required — as well as your experience with identity theft.
If your business or organization is a financial institution or creditor, but does not have any covered accounts, you don’t need a program. But if you have covered accounts, you must develop a written program to identify and address the red flags that could indicate identity theft.
How To Comply
The Rule doesn’t tell you specifically what your red flags program must look like. Instead, it gives you flexibility to implement a program that best suits your business or organization, as long as it meets the Rule’s requirements.
Your starting point for developing a program is the Guidelines issued with the Red Flags Rule, available at www.ftc.gov/os/fedreg/2007/november/071109redflags.pdf. (The Guidelines are on pages 63773-63774 of the document.) The Guidelines list the issues you must consider in developing and maintaining a program appropriate for your business or organization. You also should draw on your own experience and knowledge about identity theft risks in developing your program.
There are four basic steps to designing a program to comply with the Rule:
-
Identify relevant red flags;
-
Detect red flags;
-
Prevent and mitigate identity theft; and
-
Update your program periodically.
In addition, your program must spell out how it will be administered. The program should be appropriate to the size and complexity of your company or organization, as well as the nature of your operations.
Identify Relevant Red Flags
Under the Rule, financial institutions and creditors with covered accounts must develop a written program to identify the warning signs of identity theft.
The Guidelines describe the following categories of warning signs — red flags — that your program must identify and address:
-
alerts, notifications, or warnings from a consumer reporting agency;
-
suspicious documents;
-
suspicious personally identifying information;
-
suspicious activity relating to a covered account; or
-
notices from customers, victims of identity theft, law enforcement authorities, or other entities about possible identity theft in connection with covered accounts.
When identifying red flags, consider the nature of your business and the type of identity theft to which you might be vulnerable.
Detect Red Flags
Once you’ve identified the red flags that are relevant to your organization or business, you must establish policies and procedures to detect them in your day-to-day operations.
For example, you may spot red flags when you verify a consumer’s identity, authenticate customers, monitor transactions, or verify requests for changes of address. Some red flags may seem harmless on their own, but can signal identity theft when paired with other events, say, a change of address coupled with the use of an address associated with fraudulent accounts.
Prevent and Mitigate Identity Theft
Your program must include appropriate responses to your red flags to prevent and mitigate identity theft. These responses could include monitoring an account, closing an account, not opening a new account, contacting the consumer when you spot a red flag, or a combination. Sometimes you may determine that no response is necessary. In other cases, certain events — such as a recent data breach, a phishing fraud that targeted your business or organization, or another suspicious activity — may raise the risk of identity theft and require specific preventive actions.
Update Your Program Periodically
Because identity theft threats change, your program must describe how you will update it to ensure that you are considering new risks and trends.
Administering Your Program
No matter how good your program looks on paper, the true test is how it works. Your program must describe how it will be administered, including how you will get the approval of your management, maintain the program, and keep it current.
According to the Rule, your program must be approved by your Board of Directors or, if your business or organization doesn’t have a Board, by a senior employee. The Board or designated senior employee also must approve any material changes to the program. Your program should include staff training as appropriate, and provide a way for you to monitor the work of your service providers. The keys are to maintain oversight of the program, keep it relevant and current, and ensure that all necessary members of your staff — from the boardroom to the mail room — are on board. A program that stays in a filing cabinet isn’t a good program.
Penalties for Noncompliance
Although there are no criminal penalties for failing to comply with the Red Flags Rule, financial institutions or creditors that violate the Rule may be subject to civil monetary penalties. But there’s an even more important reason for compliance: It’s just plain good business. It assures your customers that you are doing your part to fight identity theft.
Have questions about how health care providers can comply with the Rule? Email RedFlags@ftc.gov.
* On October 22, 2008, the Federal Trade Commission issued an Enforcement Policy statement that delays enforcement of the Red Flags rule until May 1, 2009 (http://www.ftc.gov/opa/2008/10/redflags.shtm). Although the Rule is in effect, the FTC will wait until May 2009 to enforce it. This does not affect enforcement of the address discrepancy and credit card issuer rules. Nor does it affect compliance for entities not under the jurisdiction of the Commission.
Tiffany George and Pavneet Singh are attorneys in the Federal Trade Commission’s Division of Privacy and Identity Protection. |
News from the ACFE
Fraud risks are heightened in the current
economic climate. Learn the strategies and skills you need
to keep ahead of the fraudsters at the
20th Annual ACFE Fraud Conference & Exhibition, July
12-17, 2009 in Las Vegas.
|
Chapter News
FY2009 - 2010 Chapter Election Ballot
Chapter Elections will run through
April 13th, 2009. According to the Tampa Bay Chapter's
Bylaws, only Chapter Members and Chapter Associates may vote.
Results will be announced at the Chapter's Annual Meeting on
April 14, 2009. Go to:
http://www.tampabaycfe.org/ballot.htm to vote. |
Dinner Meeting News
Our
next Dinner Meeting is scheduled for April 14, 2009
Deborah H. Drake, VP/Corporate Investigations,
Mercantile Bank a Division of Carolina First Bank, will be
presenting
"Red Flags of Fraud." The presentation will encompass various
topics including identifying and recognizing red flags as they
relate to Check Fraud, Check Kiting, Online Schemes and Scams,
and Identity Theft.
Debbi has approximately 28 years experience in
the banking industry and over half of that in the security and
fraud related fields. Graduating from the University of
Michigan with a BA in Business Administration and a minor in
Economics, she began her career with Barnett Bank where she
learned the basics of banking by working as a Teller, Loan
Processor, Auditor, and as Assistant Cashier. Her career took
her then to Citizens National Bank where she worked as an AVP
Cashier, and began her work in Security. As mergers took her
from CNB to Mercantile Bank she moved from Fraud, Forgeries and
Compliance supervising 3 counties, where she now specializes in
Corporate Investigations and Fraud which includes fraud training
for Tampa Bay, and Central Florida. She works directly with the
FBI, Secret Service, FDLE, Postal Inspector, and all the local
Law Enforcement Agencies in Florida.
|
FTC Warns Consumers About
Economic Stimulus Scams
The FTC is warning consumers that
they could get stung by an economic
stimulus scam. The scams come in
different forms.
Right now, on the Web and in e-mail,
scammers are telling consumers they can
help them qualify for a payment from
President Obama's economic stimulus
package. All they have to do is provide
a little information or a small payment.
E-mail messages may ask for bank
account information so that the
operators can deposit consumers' share
of the stimulus directly into their bank
account. Instead, the scammers drain
consumers' accounts of money and
disappear. Or bogus e-mail may appear
to be from government agencies and ask
for information to "verify" that you
qualify for a payment. The scammers use
that information to commit identity
theft. Some e-mail scams don't ask for
information, but provide links to find
out how to qualify for funds. By
clicking on the links, consumers have
downloaded malicious software or spyware
that can be used to make them a victim
of identity theft.
"Web sites may advertise that they
can help you get money from the stimulus
fund. Many use deceptive names or
images of President Obama and Vice
President Biden to suggest they are
legitimate. They're not," says Eileen
Harrington, Acting Director of the FTC's
Bureau of Consumer Protection. "Don't
fall for it. If you do, you'll get
scammed."
Some sites suggest that for a small
sum of money - as little as $1.99 in
some cases - consumers can get a list of
economic stimulus grants they can apply
for. But two things can happen: the
number of the credit card the consumer
uses to pay the fee can fall into the
hands of scam artists, or the $1.99 can
be the down payment on a "negative
option" agreement that may cost hundreds
or thousands of dollars if the consumer
does not cancel.
"Consumers who may already have
fallen for these scams should carefully
check their credit card bills for
unauthorized charges and report the scam
to the FTC," Harrington said.
|
BBB on Differences Between Debt Consolidation, Debt
Negotiation and Debt Elimination Plans
Consumers are being battered on all fronts and offers from companies to
help get them out of debt are extremely tempting in
troubling times. Offers of debt negotiation, debt
settlement, and debt elimination are three different
options available to consumers. Better Business
Bureau advises consumers to ensure they understand
these critical differences before enlisting the help
of a company to manage their debt or they could end
up making their current financial situation worse.
The unemployment rate in the US rose from 7.2 to
7.6 percent in January according to the U.S.
Department of Labor and more families are struggling
to make ends meet. While the unemployment rate
continues to rise, so do complaints filed with BBB
against companies that claim to help consumers
manage their debt. In fact complaints against debt
consolidation and negotiation companies rose by
almost 19 percent in 2008 over the previous year.
“Consumers are bombarded every day with ads and
e-mails offering services to manage or reduce debt
and it’s hard to know which offer will work for
them, let alone if the company can be trusted,” said
Steve Cox, BBB spokesperson. “Families in debt may
think their situation can’t get any worse, but
trusting the services of some debt negotiation,
consolidation or elimination firms can actually lead
to increased debt and bigger headaches.”
To help consumers understand various options for
dealing with debt, BBB offers a brief explanation of
debt negotiation, consolidation and elimination
services and tips on finding help to deal with debt:
Debt Negotiation/Settlement
Debt negotiation companies claim that they will
negotiate with a consumer’s lenders to lower the
total amount of debt owed for an upfront fee.
Unfortunately, some consumers who paid for debt
negotiation services found out that the company
never contacted their lenders, but instead, took
their money and ran. Because the debt negotiation
company made it sound like they had everything under
control, the consumer stopped talking directly with
their lenders and ended up slipping deeper into
debt. Relying on debt negotiation firms could also
put a dent in a consumer’s credit report.
Debt Consolidation
Debt consolidation companies offer to roll up
various debts allowing the debtor to make one lower
payment to the company, rather than many payments to
the different lenders. While debt consolidation can
make paying monthly bills more manageable, some
companies tack on high fees and charge exorbitant
interest rates, which means the consumer is paying
much more in the long run.
Debt Elimination
Companies that offer debt elimination rely
on many different schemes but they all hinge on the
notion that credit lines are illegal. Debt
elimination companies typically provide, for an
upfront fee, a document for the lender that
supposedly absolves the consumer of the debt.
Unfortunately, the document has no bearing
whatsoever on the debt owed and consumers paying for
such services have found that they’ve wasted money
on a debt elimination scheme that would have been
better spent on actually paying back their debts.
Before enlisting the help of a business to manage
debt, BBB offers the following advice for consumers.
• Stay in contact with lenders and try to work
out a plan with them first before enlisting outside
help.
• Always check the company out first with BBB. BBB
Reliability Reports on debt negotiation,
consolidation, and elimination companies are
available online for free at
www.bbb.org.
• Start with a credit counseling service. Credit
counseling services are often nonprofits that offer
financial guidance for a small fee, or even for
free.
Click here for more advice on choosing a credit
counseling agency.
• Beware of offers that sound too good to be
true. There is no easy fix for reducing debt and any
company that makes huge claims and guarantees,
probably can’t deliver.
|
FTC Releases List of Top Consumer Complaints
in 2008
The Federal Trade Commission today released
the list of top consumer complaints received by
the agency in 2008. The list, contained in the
publication “Consumer Sentinel Network Data Book
for January-December 2008,” showed that for the
ninth year in a row, identity theft was the
number one consumer complaint category. Of
1,223,370 complaints received in 2008, 313,982 –
or 26 percent – were related to identity theft.
The report breaks out complaint data on a
state-by-state basis and also contains data
about the 50 metropolitan areas reporting the
highest per capita incidence of fraud and other
complaints. In addition, the report sets forth
the 50 metropolitan areas reporting the highest
incidence of identity theft.
The report states that credit card fraud was
the most common form of reported identity theft
at 20 percent, followed by government
documents/benefits fraud at 15 percent,
employment fraud at 15 percent, phone or
utilities fraud at 13 percent, bank fraud at 11
percent and loan fraud at four percent.
The top 20 complaint categories were:
|
Rank |
Category |
Complaints |
% |
|
1 |
Identity
Theft |
313,982 |
26 |
|
2 |
Third Party
and Creditor Debt Collection |
104,642 |
9 |
|
3 |
Shop-at-Home and Catalog Sales |
52,615 |
4 |
|
4 |
Internet
Services |
52,102 |
4 |
|
5 |
Foreign
Money Offers and Counterfeit Check Scams |
38,505 |
3 |
|
6 |
Credit
Bureaus, Information Furnishers and
Report Users |
34,940 |
3 |
|
7 |
Prizes,
Sweepstakes and Lotteries |
33,340 |
3 |
|
8 |
Television
and Electronic Media |
25,930 |
2 |
|
9 |
Banks and
Lenders |
22,890 |
2 |
|
10 |
Telecom
Equipment and Mobile Services |
22,387 |
2 |
|
11 |
Computer
Equipment and Software |
21,442 |
2 |
|
12 |
Business
Opportunities, Employment Agencies and
Work-at-Home |
20,286 |
2 |
|
13 |
Internet
Auction |
17,294 |
1 |
|
14 |
Advance-Fee
Loans and Credit Protection/Repair |
17,263 |
1 |
|
15 |
Health Care |
16,275 |
1 |
|
16 |
Auto
Related Complaints |
14,278 |
1 |
|
17 |
Travel,
Vacations and Timeshare Plans |
13,200 |
1 |
|
18 |
Credit
Cards |
13,196 |
1 |
|
19 |
Magazines
and Buyers Clubs |
10,188 |
1 |
|
20 |
Telephone
Services |
9,300 |
1 |
The FTC collects consumer complaints from
more than 125 other organizations and makes them
available to more than 1,600 civil and criminal
law enforcement agencies in the U.S. and abroad
via Consumer Sentinel, a secure, online
database. Copies of the “Consumer Sentinel
Network Data Book” can be found at
http://www.ftc.gov/sentinel.
|
President's Message
We had a tremendous turn out for our March 10th dinner meeting
and I want to thank all who attended. I also want to thank our
first time attendees. They were:
Charles Young – Robert Half Management Services
Bob Ingham – Gregory, Sharer & Stuart
Tim Farrell – Gregory, Sharer & Stuart
Ed Hancock – Surety & Construction Consultants
Laura Hughes – Pinellas County Department of Justice & Consumer
Protection
Mark Simon – Guest of Penny Borjas
Cynthia Lawrence – Guest of Susie Adams
I want to thank Richard Campbell, for his excellent presentation
on the subject of “Contractor Fraud."
Our CFE Exam Prep Study Group is going strong with six
participants attending the weekly three-hour session. We meet
every Tuesday (except on dinner meeting nights we meet on
Thursday) at 6pm at the Fifth Third Bank on Kennedy Blvd, which
is close to the Westshore Blvd intersection. I publicly want to
thank Pamela Ranney and Consuelo Herrera for volunteering to
help facilitate the session. If you are interested in joining
us, contact me at hooper@hillsclerk.com or at the chapter
website www.tampabaycfe.org.
Our nominations for the Association’s chapter and individual
recognitions are almost complete and will be finalized by mid
April. I think we have an excellent chance for recognition in
this year’s competition.
Our next dinner meeting on April 14 will feature Debbie Drake,
CRE, VP/Senior Corporate Investigator for Mercantile Bank. Her
topic is “Red Flags of Fraud.” We have been having excellent
turnouts this year so make your reservations early to guarantee
your seat.
The Chapter’s two-day “Fraud and Computer Crimes Seminar” is set
for May and promises to be the best ever. As far as topics and
presenters, it is definitely on the world-class level. Christine
Dever has put a lot of hard work into locating these speakers
and persuading them to come to the Clearwater/St
Petersburg/Tampa area to share their experiences with us. I
understand Christine has already started working on out 2010
seminar. Thanks Christine for all you do for the chapter.
And let us not forget that April is here with its one day of
jokes. Hal Borland, a well-known American author summed up April
this way…” April is a promise that May is bound to keep.”
Steve Hooper, CFE, CIA, CGAP, CCSA
President, Tampa Bay Chapter - ACFE |
|