Back ] Home ] Next ]

Tampa Bay Chapter - ACFE       http://TampaBayCFE.org          March 2009

The “Red Flags” Rule: Are You Complying with New Requirements for Fighting Identity Theft?

by Tiffany George and Pavneet Singh

The expression “red flag” signals “Danger: Be alert to problems ahead.” For millions of consumers every year, identity theft is more than a threat — it’s their reality. The economic, psychological, and emotional harm to victims can be devastating. But businesses often bear the biggest part of the monetary damage from identity theft.

It’s everyone’s responsibility to do what they can to fight identity theft. But businesses and organizations that offer credit or other financial services can be the first to spot the red flags that signal the risk of identity theft, including suspicious activity indicating that identity thieves may be using stolen information like names, Social Security numbers, account numbers, and birth dates to open new accounts or raid existing ones.

Under the Red Flags Rule, which went into effect on January 1, 2008, certain businesses and organizations are required to spot and heed the red flags that often can be the telltale signs of identity theft. To comply with the new Red Flags Rule — enforced by the Federal Trade Commission (FTC), the federal bank regulatory agencies, and the National Credit Union Administration (NCUA) — you may need to develop a written “red flags program” to prevent, detect, and minimize the damage from identity theft.

Are you covered by the Red Flags Rule? If so, have you put into place the new procedures the Rule requires?

Who Must Comply

Although every business or organization with an ongoing relationship with consumers should keep an eye out for the possibility of identity theft, the Red Flags Rule applies only to “financial institutions” and “creditors." To determine if your business or organization is covered by the Rule and required to develop a written identity theft Program, you’ll need to answer two questions:

Is your business or organization either a “financial institution” or “creditor,” as those terms are defined in the Rule?

If so, do you have “covered accounts”?

A “financial institution” is a bank, savings and loan, credit union, or other entity that holds a “transaction account” belonging to a consumer. A “transaction account” is an account that allows the owner to make payments or transfers. Examples include checking accounts, savings accounts that permit automatic transfers, and share draft accounts. Another example would be a brokerage account that allows consumers to write checks.

Your business or organization is a “creditor” if you regularly:

  • extend, renew, or continue credit;

  • arrange for someone else to extend, renew, or continue credit; or

  • are the assignee of a creditor who is involved in the decision to extend, renew, or continue credit.

Under the Rule, “credit” means an arrangement by which you defer payment of debts or accept deferred payments for the purchase of property or services. In other words, payment is made after the product was sold or the service was rendered. Some examples of creditors are finance companies, automobile dealers, mortgage brokers, utilities, and telecommunications companies. Even if you’re a non-profit or government agency, you still may be a creditor if you accept deferred payments for goods or services. However, simply accepting credit cards as a form of payment does not make you a creditor under the Rule.

If you determine you’re a financial institution or a creditor, the next step is to see if you have “covered accounts.” There are two types of covered accounts. One is an account used mostly for personal, family, or household purposes that involves multiple payments or transactions. Examples include credit card accounts, mortgage loans, car loans, margin accounts, cell phone accounts, utility accounts, and checking or savings accounts.

The other is one for which there is a foreseeable risk of identity theft. For example, one type of account that should be considered for coverage because it may be vulnerable to identity theft is a small business or sole proprietorship

TRAINING OPPORTUNITIES

Tampa Bay Chapter

Dinner Meetings

April 14, 2009
"Red Flags of Fraud"
Debbi Drake, CFS. VP/Sr. Corporate Investigator, Mercantile Bank 

10th Annual Fraud & Computer Crimes Seminar

May 26-27, 2009
Ruth Eckerd Hall
Clearwater, Florida
1111 McMullen Booth Road
Clearwater, FL 33759

Association of Certified Fraud Examiners

20th Annual ACFE Fraud Conference and Exhibition - Las Vegas, NV

2008 - 2009
OFFICERS & DIRECTORS

PRESIDENT
Steve Hooper, CIA, CFE, CCSA, CGAP
Clerk of the Circuit Court Hillsborough County, FL
(813) 276-2029 x3703

VICE PRESIDENT
Christine Dever, CPA, CFE
City of Tampa
(813) 274-7166

SECRETARY
Ellen Wilcox, CFE
Florida Department of Law Enforcement
(727) 298-2482

TREASURER
Laura Krueger Brock, CPA/CFF, CFE, CVA
Kirkland, Russ, Murphy & Tapp, P.A.
(727) 572-1400

DIRECTOR
Mark Dubina, CFE
Tampa Port Authority
(813) 241-1893

DIRECTOR
Sharon Shaw, CFE
Tel: (727) 674-8399

DIRECTOR
Debbie Venanzio, CFE
Branch Banking & Trust Co.
Tel: (727) 302-5498

DIRECTOR
Bill Miles, CFE
Florida Department of Law Enforcement
Tel: (863) 701-1474

DIRECTOR
Gary Chapman, CIA, CGAP, CFE
City of Tampa
Tel: (813) 274-7163

CHAPTER TRAINING
Wayne Boytim, CFE
Retired
(813) 274-7167

account. In determining whether you have such an account, consider the risks associated with how the accounts may be opened or accessed — i.e. what type of interaction and documentation is required — as well as your experience with identity theft.

If your business or organization is a financial institution or creditor, but does not have any covered accounts, you don’t need a program. But if you have covered accounts, you must develop a written program to identify and address the red flags that could indicate identity theft.

How To Comply

The Rule doesn’t tell you specifically what your red flags program must look like. Instead, it gives you flexibility to implement a program that best suits your business or organization, as long as it meets the Rule’s requirements.

Your starting point for developing a program is the Guidelines issued with the Red Flags Rule, available at www.ftc.gov/os/fedreg/2007/november/071109redflags.pdf. (The Guidelines are on pages 63773-63774 of the document.) The Guidelines list the issues you must consider in developing and maintaining a program appropriate for your business or organization. You also should draw on your own experience and knowledge about identity theft risks in developing your program.

There are four basic steps to designing a program to comply with the Rule:

  • Identify relevant red flags;

  • Detect red flags;

  • Prevent and mitigate identity theft; and

  • Update your program periodically.

In addition, your program must spell out how it will be administered. The program should be appropriate to the size and complexity of your company or organization, as well as the nature of your operations.

Identify Relevant Red Flags

Under the Rule, financial institutions and creditors with covered accounts must develop a written program to identify the warning signs of identity theft.

The Guidelines describe the following categories of warning signs — red flags — that your program must identify and address:

  • alerts, notifications, or warnings from a consumer reporting agency;

  • suspicious documents;

  • suspicious personally identifying information;

  • suspicious activity relating to a covered account; or

  • notices from customers, victims of identity theft, law enforcement authorities, or other entities about possible identity theft in connection with covered accounts.

When identifying red flags, consider the nature of your business and the type of identity theft to which you might be vulnerable.

Detect Red Flags

Once you’ve identified the red flags that are relevant to your organization or business, you must establish policies and procedures to detect them in your day-to-day operations.

For example, you may spot red flags when you verify a consumer’s identity, authenticate customers, monitor transactions, or verify requests for changes of address. Some red flags may seem harmless on their own, but can signal identity theft when paired with other events, say, a change of address coupled with the use of an address associated with fraudulent accounts.

Prevent and Mitigate Identity Theft

Your program must include appropriate responses to your red flags to prevent and mitigate identity theft. These responses could include monitoring an account, closing an account, not opening a new account, contacting the consumer when you spot a red flag, or a combination. Sometimes you may determine that no response is necessary. In other cases, certain events — such as a recent data breach, a phishing fraud that targeted your business or organization, or another suspicious activity — may raise the risk of identity theft and require specific preventive actions.

Update Your Program Periodically

Because identity theft threats change, your program must describe how you will update it to ensure that you are considering new risks and trends.

Administering Your Program

No matter how good your program looks on paper, the true test is how it works. Your program must describe how it will be administered, including how you will get the approval of your management, maintain the program, and keep it current.

According to the Rule, your program must be approved by your Board of Directors or, if your business or organization doesn’t have a Board, by a senior employee. The Board or designated senior employee also must approve any material changes to the program. Your program should include staff training as appropriate, and provide a way for you to monitor the work of your service providers. The keys are to maintain oversight of the program, keep it relevant and current, and ensure that all necessary members of your staff — from the boardroom to the mail room — are on board. A program that stays in a filing cabinet isn’t a good program.

Penalties for Noncompliance

Although there are no criminal penalties for failing to comply with the Red Flags Rule, financial institutions or creditors that violate the Rule may be subject to civil monetary penalties. But there’s an even more important reason for compliance: It’s just plain good business. It assures your customers that you are doing your part to fight identity theft.

Have questions about how health care providers can comply with the Rule? Email RedFlags@ftc.gov.

* On October 22, 2008, the Federal Trade Commission issued an Enforcement Policy statement that delays enforcement of the Red Flags rule until May 1, 2009 (http://www.ftc.gov/opa/2008/10/redflags.shtm). Although the Rule is in effect, the FTC will wait until May 2009 to enforce it. This does not affect enforcement of the address discrepancy and credit card issuer rules. Nor does it affect compliance for entities not under the jurisdiction of the Commission.

Tiffany George and Pavneet Singh are attorneys in the Federal Trade Commission’s Division of Privacy and Identity Protection.


News from the ACFE

Fraud risks are heightened in the current economic climate. Learn the strategies and skills you need to keep ahead of the fraudsters at the 20th Annual ACFE Fraud Conference & Exhibition, July 12-17, 2009 in Las Vegas.


Chapter News

FY2009 - 2010 Chapter Election Ballot

Chapter Elections will run through April 13th, 2009.  According to the Tampa Bay Chapter's Bylaws, only Chapter Members and Chapter Associates may vote.  Results will be announced at the Chapter's Annual Meeting on April 14, 2009. Go to: http://www.tampabaycfe.org/ballot.htm to vote.


Dinner Meeting News

Our next Dinner Meeting is scheduled for April 14, 2009

Deborah H. Drake, VP/Corporate Investigations, Mercantile Bank a Division of Carolina First Bank, will be presenting "Red Flags of Fraud." The presentation will encompass various topics including identifying and recognizing red flags as they relate to Check Fraud, Check Kiting, Online Schemes and Scams, and Identity Theft.

Debbi has approximately 28 years experience in the banking industry and over half of that in the security and fraud related fields.  Graduating from the University of Michigan with a BA in Business Administration and a minor in Economics, she began her career with Barnett Bank where she learned the basics of banking by working as a Teller, Loan Processor, Auditor, and as Assistant Cashier.  Her career took her then to Citizens National Bank where she worked as an AVP Cashier, and began her work in Security.  As mergers took her from CNB to Mercantile Bank she moved from Fraud, Forgeries and Compliance supervising 3 counties, where she now specializes in Corporate Investigations and Fraud which includes fraud training for Tampa Bay, and Central Florida.  She works directly with the FBI, Secret Service, FDLE, Postal Inspector, and all the local Law Enforcement Agencies in Florida.


FTC Warns Consumers About Economic Stimulus Scams

The FTC is warning consumers that they could get stung by an economic stimulus scam.  The scams come in different forms. 

Right now, on the Web and in e-mail, scammers are telling consumers they can help them qualify for a payment from President Obama's economic stimulus package.  All they have to do is provide a little information or a small payment.

E-mail messages may ask for bank account information so that the operators can deposit consumers' share of the stimulus directly into their bank account.  Instead, the scammers drain consumers' accounts of money and disappear.  Or bogus e-mail may appear to be from government agencies and ask for information to "verify" that you qualify for a payment.  The scammers use that information to commit identity theft.  Some e-mail scams don't ask for information, but provide links to find out how to qualify for funds.  By clicking on the links, consumers have downloaded malicious software or spyware that can be used to make them a victim of identity theft.  

"Web sites may advertise that they can help you get money from the stimulus fund.  Many use deceptive names or images of  President Obama and Vice President Biden to suggest they are legitimate.  They're not," says Eileen Harrington, Acting Director of the FTC's Bureau of Consumer Protection.  "Don't fall for it.  If you do, you'll get scammed."

Some sites suggest that for a small sum of money - as little as $1.99 in some cases - consumers can get a list of economic stimulus grants they can apply for.  But two things can happen: the number of the credit card the consumer uses to pay the fee can fall into the hands of scam artists, or the $1.99 can be the down payment on a "negative option" agreement that may cost hundreds or thousands of dollars if the consumer does not cancel.  

"Consumers who may already have fallen for these scams should carefully check their credit card bills for unauthorized charges and report the scam to the FTC," Harrington said. 


BBB on Differences Between Debt Consolidation, Debt Negotiation and Debt Elimination Plans

Consumers are being battered on all fronts and offers from companies to help get them out of debt are extremely tempting in troubling times. Offers of debt negotiation, debt settlement, and debt elimination are three different options available to consumers. Better Business Bureau advises consumers to ensure they understand these critical differences before enlisting the help of a company to manage their debt or they could end up making their current financial situation worse. 

The unemployment rate in the US rose from 7.2 to 7.6 percent in January according to the U.S. Department of Labor and more families are struggling to make ends meet. While the unemployment rate continues to rise, so do complaints filed with BBB against companies that claim to help consumers manage their debt. In fact complaints against debt consolidation and negotiation companies rose by almost 19 percent in 2008 over the previous year.

“Consumers are bombarded every day with ads and e-mails offering services to manage or reduce debt and it’s hard to know which offer will work for them, let alone if the company can be trusted,” said Steve Cox, BBB spokesperson. “Families in debt may think their situation can’t get any worse, but trusting the services of some debt negotiation, consolidation or elimination firms can actually lead to increased debt and bigger headaches.”

To help consumers understand various options for dealing with debt, BBB offers a brief explanation of debt negotiation, consolidation and elimination services and tips on finding help to deal with debt:

Debt Negotiation/Settlement
Debt negotiation companies claim that they will negotiate with a consumer’s lenders to lower the total amount of debt owed for an upfront fee.  Unfortunately, some consumers who paid for debt negotiation services found out that the company never contacted their lenders, but instead, took their money and ran. Because the debt negotiation company made it sound like they had everything under control, the consumer stopped talking directly with their lenders and ended up slipping deeper into debt. Relying on debt negotiation firms could also put a dent in a consumer’s credit report.

Debt Consolidation
Debt consolidation companies offer to roll up various debts allowing the debtor to make one lower payment to the company, rather than many payments to the different lenders. While debt consolidation can make paying monthly bills more manageable, some companies tack on high fees and charge exorbitant interest rates, which means the consumer is paying much more in the long run. 

Debt Elimination
Companies that offer debt elimination rely on many different schemes but they all hinge on the notion that credit lines are illegal. Debt elimination companies typically provide, for an upfront fee, a document for the lender that supposedly absolves the consumer of the debt. Unfortunately, the document has no bearing whatsoever on the debt owed and consumers paying for such services have found that they’ve wasted money on a debt elimination scheme that would have been better spent on actually paying back their debts.

Before enlisting the help of a business to manage debt, BBB offers the following advice for consumers.

• Stay in contact with lenders and try to work out a plan with them first before enlisting outside help.
• Always check the company out first with BBB. BBB Reliability Reports on debt negotiation, consolidation, and elimination companies are available online for free at www.bbb.org.
• Start with a credit counseling service. Credit counseling services are often nonprofits that offer financial guidance for a small fee, or even for free. Click here for more advice on choosing a credit counseling agency.
• Beware of offers that sound too good to be true. There is no easy fix for reducing debt and any company that makes huge claims and guarantees, probably can’t deliver.


FTC Releases List of Top Consumer Complaints in 2008

The Federal Trade Commission today released the list of top consumer complaints received by the agency in 2008. The list, contained in the publication “Consumer Sentinel Network Data Book for January-December 2008,” showed that for the ninth year in a row, identity theft was the number one consumer complaint category. Of 1,223,370 complaints received in 2008, 313,982 – or 26 percent – were related to identity theft.

The report breaks out complaint data on a state-by-state basis and also contains data about the 50 metropolitan areas reporting the highest per capita incidence of fraud and other complaints.  In addition, the report sets forth the 50 metropolitan areas reporting the highest incidence of identity theft.

The report states that credit card fraud was the most common form of reported identity theft at 20 percent, followed by government documents/benefits fraud at 15 percent, employment fraud at 15 percent, phone or utilities fraud at 13 percent, bank fraud at 11 percent and loan fraud at four percent.

The top 20 complaint categories were:

Rank

Category

Complaints

%

1

Identity Theft

313,982

26

2

Third Party and Creditor Debt Collection

104,642

9

3

Shop-at-Home and Catalog Sales

52,615

4

4

Internet Services

52,102

4

5

Foreign Money Offers and Counterfeit Check Scams

38,505

3

6

Credit Bureaus, Information Furnishers and Report Users

34,940

3

7

Prizes, Sweepstakes and Lotteries

33,340

3

8

Television and Electronic Media

25,930

2

9

Banks and Lenders

22,890

2

10

Telecom Equipment and Mobile Services

22,387

2

11

Computer Equipment and Software

21,442

2

12

Business Opportunities, Employment Agencies and Work-at-Home

20,286

2

13

Internet Auction

17,294

1

14

Advance-Fee Loans and Credit Protection/Repair

17,263

1

15

Health Care

16,275

1

16

Auto Related Complaints

14,278

1

17

Travel, Vacations and Timeshare Plans

13,200

1

18

Credit Cards

13,196

1

19

Magazines and Buyers Clubs

10,188

1

20

Telephone Services

9,300

1

The FTC collects consumer complaints from more than 125 other organizations and makes them available to more than 1,600 civil and criminal law enforcement agencies in the U.S. and abroad via Consumer Sentinel, a secure, online database. Copies of the “Consumer Sentinel Network Data Book” can be found at http://www.ftc.gov/sentinel.


President's Message

We had a tremendous turn out for our March 10th dinner meeting and I want to thank all who attended. I also want to thank our first time attendees. They were:

Charles Young – Robert Half Management Services
Bob Ingham – Gregory, Sharer & Stuart
Tim Farrell – Gregory, Sharer & Stuart
Ed Hancock – Surety & Construction Consultants
Laura Hughes – Pinellas County Department of Justice & Consumer Protection
Mark Simon – Guest of Penny Borjas
Cynthia Lawrence – Guest of Susie Adams

I want to thank Richard Campbell, for his excellent presentation on the subject of “Contractor Fraud."
Our CFE Exam Prep Study Group is going strong with six participants attending the weekly three-hour session. We meet every Tuesday (except on dinner meeting nights we meet on Thursday) at 6pm at the Fifth Third Bank on Kennedy Blvd, which is close to the Westshore Blvd intersection. I publicly want to thank Pamela Ranney and Consuelo Herrera for volunteering to help facilitate the session. If you are interested in joining us, contact me at hooper@hillsclerk.com or at the chapter website www.tampabaycfe.org.

Our nominations for the Association’s chapter and individual recognitions are almost complete and will be finalized by mid April. I think we have an excellent chance for recognition in this year’s competition.
Our next dinner meeting on April 14 will feature Debbie Drake, CRE, VP/Senior Corporate Investigator for Mercantile Bank. Her topic is “Red Flags of Fraud.” We have been having excellent turnouts this year so make your reservations early to guarantee your seat.

The Chapter’s two-day “Fraud and Computer Crimes Seminar” is set for May and promises to be the best ever. As far as topics and presenters, it is definitely on the world-class level. Christine Dever has put a lot of hard work into locating these speakers and persuading them to come to the Clearwater/St Petersburg/Tampa area to share their experiences with us. I understand Christine has already started working on out 2010 seminar. Thanks Christine for all you do for the chapter.

And let us not forget that April is here with its one day of jokes. Hal Borland, a well-known American author summed up April this way…” April is a promise that May is bound to keep.”

Steve Hooper, CFE, CIA, CGAP, CCSA
President, Tampa Bay Chapter - ACFE