Red Flag Rules - A Standardizing of Identity Theft Prevention Programs

Consumers and businesses suffer from identity theft
Identity theft is a major threat for consumers. Often, a consumer doesn't even realize their identity has been stolen until they've been denied credit and then find the delinquent accounts on their credit report. Then, the consumer may have to write letters, make phone calls, and file police reports to clear up the defaulted accounts that were opened or stolen by the thief.

Sometimes it is difficult to prove that the accounts were used or opened by an ID thief, especially in cases that went undetected for some time. Clearing up the damage from an identity thief often takes a few months to about a year, or even longer in extreme cases. In the meanwhile, the victim may have trouble gaining additional credit or miss out on a job opportunity requiring good credit.

Identity theft is also a major threat for businesses. Over the past few years, losses from identity theft have gradually decreased; consumers are now more aware of the threat, and are more diligent in protecting their personal information. But business losses related to identity theft still amounted to 49.3 billion dollars in 2007, quite a hefty number. These losses include unauthorized use of the victim's established accounts and fraudulently opening new accounts, and whether by credit card, bank account, and by on-line or paper thefts. Also included in that number are cases in which the thief used the victim's identity to obtain medical care, for services and utilities, or to rent a house or apartment.

New 'Red Flags Rules' to help the fight against ID theft
The Federal Trade Commission (FTC) explains the new policy on their website: "The FTC, the federal bank regulatory agencies, and the National Credit Union Administration (NCUA) have issued regulations (Red Flags Rules) requiring financial institutions and creditors to develop and implement written identity theft prevention programs, as part of the Fair and Accurate Credit Transactions (FACT) Act of 2003. The programs must be in place by November 1, 2008, and must provide for the identification, detection, and response to patterns, practices, or specific activities - known as "red flags" - that could indicate identity theft."

The Red Flags Rules apply to financial institutions; banks and credit unions, savings and loan institutions, mutual savings banks, or any other entity that holds consumer transaction accounts, such as savings, checking and share draft accounts. Creditors that must also abide by the Red Flags Rules include auto dealers, mortgage brokers, finance companies, utility service companies, and telecommunication providers.

The Rules require that business' ID theft prevention program must state specific policies to detect activity commonly associated with ID theft, the "red flags". The program must also implement a plan to deal with suspected fraudulent activity, as well as keep their program updated periodically to deal with new identity theft concerns. The Rules do not require that all creditors and financial institutions use a "one size fits all" approach to developing their program; creditors and financial institutions are given flexibility to develop an ID theft program that works for the type, size, and complexity of their business.

The FTC has given general guidelines and points to consider to aid businesses in developing their ID theft prevention program, and a long list of 26 red flags to look out for, such as inconsistent information on credit applications and credit reports, documents that appear to be fraudulent, drastic changes in spending or bill payment patterns, bills that are returned undeliverable even though the account is actively in use, and large luxury purchases or big cash withdrawals on new accounts.

Some businesses don't like the Rules requirements
The new Red Flags Rules are intended to standardize fraud prevention among companies that extend credit to consumers. This seems like it should be a good thing, for both consumers and the businesses, but some are not happy about it. Some in the banking industry complain that the Rules are excessive and burdensome, and they don't want to be forced into abiding by more regulations.

Implementing the program will result in additional labor and costs, as well as operational changes within a company. The smaller institutions are likely to have the most difficulty in implementing the program due to limited resources; small-town community banks and small auto dealerships may have to enlist the services of a third-party to ensure they are in compliance with the Rules guidelines.

But even though there are those who are against them, business losses due to fraudulently gained credit should be reduced, and the long-term effects of the program should outweigh the hassle and additional cost of an identity theft prevention program. And it's just good business to show consumers that they care about preventing fraud and identity theft.

How this may affect consumers
Consumers should continue to guard their personal information as closely as they have been prior to the new Rules going into effect. Identity theft will still happen, but creditors and financial institutions may be likely to catch it more often before too much damage is done.

Also, some consumers may feel as they are being inconvenienced by strict documentation requirements when applying for credit, or that their credit card purchases are being questioned by the creditor. Though it may take a moment out of your day, keep in mind that it is for the protection of all involved, and to slow the wide-spread crime of identity theft.

You still have the right to take a luxury vacation and go on a shopping spree with your new credit card, just be aware that it may raise a red flag for suspicious activity with your card issuer, specially if it's something you don't do habitually. Every creditor and financial institution will decide what they believe should be cause for concern, and some may react differently to your use of credit.

My own experiences with creditors' fraud and identity theft prevention programs
I have already had fraud prevention experiences with three of the institutions that I do business with; one of them was my credit union. I had put a fairly large "luxury" purchase on my debit card. My credit union called me on my mobile number within ten minutes to verify that it was really me who made the purchase. I confirmed that it was, they apologized for bothering me, and that was the end of it.

My second experience was through a major card issuer. I took a long-distance, all-day driving trip to visit my family, and used a credit card for all my fuel stops. Close to the end of my trip, I received a phone call from the card issuer. They wanted to make sure that it was me using the card, and that somebody didn't steal my credit card and flee the state.

The last experience was from another major card issuer. I rarely used this particular card, but one day I planned to use it for a variety of errands and grocery shopping. Most charges were pretty small, and two were for over a hundred dollars. My card was declined on my 6th stop, for a grocery bill of a couple hundred dollars. I thought it should be impossible, since I was nowhere near my credit limit. Good thing I had another card to put my groceries on.

After getting home from the store, I called the card issuer to ask what the problem was. They ask about my charges that day, and told me that my account was temporarily frozen for suspicious activity, since I used it so many times in one day. They explained that the cashier was supposed to have me call them while I was at the check out counter, to confirm that it was me using the card. Apparently, she didn't get that part of the instructions. The freeze was lifted immediately, and I haven't had a problem like that again.

I was glad when my card issuers called me to verify that I was the one making the purchases; it made me feel safer knowing that they would be likely to catch a crook before they ran up too many charges. But it was irritating and embarrassing to have my card declined when I knew it should have worked. That day, having another card to use saved me from having to come back to shop for the same groceries all over again.

The best way to prevent inconveniences due to creditors' identity theft program is to be familiar with the types of activity that may get their attention (and may cause them to react by freezing your account). You can give them a quick call if you plan to do a lot of shopping or plan to travel the world to let them know that you'll be using your account more often than usual. Or you could just make sure you always have a back-up card, just in case.



Sources:
ftc.gov
idtheftcenter.org
privacyrights.org