The Red Flags Rule requires covered financial institutions and creditors to maintain an identity-theft prevention programme for covered accounts. Scope depends on the organisation and the accounts it maintains, including the reasonably foreseeable risk of identity theft. The programme must be appropriate to the size and complexity of the business and the nature of its activities.

The programme identifies relevant warning signs, detects their occurrence, responds to prevent or mitigate harm and is updated as risks change. Red flags can arise during account opening, access, use or servicing; the point is to connect those signals to an appropriate response rather than treat each alert as proof of fraud.

Governance includes approval and oversight, staff training where needed and oversight of relevant service-provider arrangements. Separate card-issuer provisions address change-of-address situations associated with requests for additional or replacement cards. These controls help prevent an attacker from exploiting account administration to obtain access.

The Rule is an identity-theft control framework. It should be distinguished from AML customer identification, sanctions screening and reimbursement rules, even though those processes may share data and staff. Its practical outcome is a repeatable, risk-based response to signs that an account or identity is being misused.