Red Flags Rule Enters with a Whimper
Today is the day the Red Flags Rule goes into effect for financial services companies and other organizations. What is this rule? According to the FTC, "The Red Flags Rule requires many businesses and organizations to implement a written Identity Theft Prevention Program designed to detect the warning signs – or "red flags" – of identity theft in their day-to-day operations."
While there was some talk about this late last year, the overall volume of the discussion has been very light. A quick Google search turns up just 57 articles on the topic over the past week as the deadline approached. The blogosphere has been more active, but this is a relatively quiet topic.
This is not a Rule with little impact. The Federal Trade Commission projects it will affect more than 11 million creditors and 3,500 financial institutions. It impacts any business that extends credit to customers, uses credit reports to make credit decisions or extends, renews or continues credit. According to the release this includes many service companies such as: "finance companies; automobile dealers that provide or arrange financing; mortgage brokers; utility companies; telecommunications companies; non-profit and government entities that defer payment for goods or services; and businesses that provide services and bill later, including many lawyers, doctors, and other professionals (emphasis mine)."
Of course, as of yesterday, today really isn't the day, as the FTC announced another delay in enforcement of the new rules - this time until August 1. More information on the Red Flags Rule is available from the FTC here.
This is more than just a compliance requirement. It provides services companies an opportunity to communicate with their customers and reassure them of their security commitment and plans. Keeping customers informed of your compliance with these rules can help build a deeper bond and allay any fears they may have. This is a key issue that is often overlooked - compliance reporting can be leveraged to help businesses. In this era of transparency Red Flags Rules should be discussed more and should be a key part of organizational communications around fighting identity theft.
Posted by Mark McClennan on May 1, 2009 at 11:45 AM
