The US Red Flags Rule requires an identity-theft programme for covered accounts at institutions and creditors with foreseeable risk. Detection, response and control updates sit alongside provider oversight and address-change validation, with risk assessments and governance records.
TL;DR:
- Covered institutions and creditors need written identity-theft detection and response programmes.
- Risk assessment, governance, training and supplier oversight determine relevant account controls.
- Separate provisions address card replacement after address changes; not every invoice issuer is covered.
Summary
Covered institutions and accounts
Part 681 of Title 16 contains the FTC's identity-theft rules for institutions and creditors within its enforcement jurisdiction. The programme requirement depends on whether the business maintains covered accounts, including accounts presenting the relevant foreseeable identity-theft risks. The statutory and regulatory definitions matter. A payment-related business should therefore assess its activities and account relationships rather than assuming that all firms collecting money have the same coverage.
Identify, detect and respond to warning signs
The written identity-theft prevention programme must be appropriate to the business's size, complexity and activities. It identifies relevant red flags, provides for their detection and establishes appropriate responses to prevent or mitigate identity theft. The programme must also be updated as risks change. Examples and guidance support the assessment, but the institution needs controls that fit its own accounts and services rather than copying a list of warning signs without an operational response.
Governance and providers supporting the programme
The rule addresses programme approval and involvement by the board, an appropriate committee or designated senior management. Staff must be trained as needed, and relevant service-provider arrangements require oversight. These requirements connect the programme to the people and external functions that actually open, administer or access accounts. Outsourcing a part of the customer relationship does not make the institution's account-level identity-theft risk disappear.
Address changes and subsequent card requests
A separate section addresses card issuers receiving a change of address followed within the specified period by a request for a new or additional card. The issuer must follow the applicable validation process before issuing the card. That targeted control is different from the wider written programme and from general customer identification under banking AML rules. Together, the provisions address how identity-theft risks can develop after an account has already been opened.
Keywords
- Red Flags
- identity theft
- covered accounts
- risk assessment
- warning signs
- response procedures
- staff training
- provider oversight
- address changes
- replacement cards