Antitrust Law Daily Wrap Up, CONSUMER PROTECTION NEWS: FTC Releases Revised Guidance on Identity Theft Rule Compliance, (Jun 12, 2013)

By Tobias J. Gillett, J.D., LL.M.

The FTC has issued revised guidance intended to help businesses comply with its Red Flags Rule, which requires certain businesses to monitor and respond to signs of identity theft.

Who is covered. The guidance, titled “Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business,” clarifies which businesses are subject to the Rule. If a business does not “defer payment for goods and services or bill customers,” does not “grant or arrange credit,” and does not “participate in the decision to extend, renew, or set the terms of credit,” then it is not subject to the Rule.

If it does, and if it also “get[s] or use[s] consumer reports in connection with a credit transaction,” “give[s] information to credit reporting companies in connection with a credit transaction,” or “advance[s] funds to—or for—someone who must repay them, either with funds or pledged property (excluding incidental expenses in connection with the services [the business provides]),” then the business is a creditor covered by the Rule.

Businesses that are subject to the Rule should determine whether they have any covered accounts, according to the FTC. The rule covers consumer accounts that involve or allow “multiple payments or transactions,” as well as “[a]ny other account that a financial institution or creditor offers or maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness of the financial institution or creditor from identity theft, including financial, operational, compliance, reputation, or litigation risks.” Businesses without covered accounts do not need written programs, but should conduct periodic risk assessments, the guidance states.

How to comply. The guidance also outlines proper methods to comply with the Rule. Businesses should consider risk factors associated with their covered accounts and should consider possible sources of “red flags.” Common categories of red flags include alerts, notifications, and warnings from a credit reporting company; suspicious documents; inconsistent, false, or missing personal identifying information; unusual account activity; and notices from other sources, such as a customer, a victim of identity theft, or a law enforcement authority.

Businesses should also incorporate means for detecting red flags into their compliance programs, the guidance states. For new accounts, appropriate procedures may include “getting a name, address, and identification number and, for in-person verification, checking a current government-issued identification card, like a driver’s license or passport,” and comparing the information to that obtained from other sources. For existing accounts, the program “may include reasonable procedures to confirm the identity of the person [with which a business is dealing], to monitor transactions, and to verify the validity of change-of-address requests.”

A properly designed compliance program should also provide appropriate procedures to respond to red flags. Examples of these procedures may include monitoring a covered account for evidence of identity theft, contacting the customer, changing passwords, security codes, or other ways to access a covered account, closing an existing account, reopening an account with a new account number, not opening a new account, not trying to collect on an account or not selling an account to a debt collector, notifying law enforcement, or determining that no response is warranted under the particular circumstances , among other possibilities.

Finally, the guidance emphasizes that businesses should update their programs to account for technological changes and new tactics employed by identity thieves. A member of a business’s board of directors, or a member of the business’s senior management if the business does not have a board of directors, must approve the initial plan, although a senior employee may develop and administer it. Staff must be trained “as necessary,” and businesses should monitor the activities of their service providers. The administrator of the program should report at least annually to the board of directors or senior management.

News: ConsumerProtection FederalTradeCommissionNews