Now, financial institutions and creditors must update their programs periodically to ensure they reflect changes in risks to protect customers from identity fraud. In other words, the program must remain pliable enough to handle new threats as they emerge.
Who do the rules apply to?The FTC says that financial institutions and creditors that "offer or maintain covered accounts" must implement a red flag rule program.
So what exactly is a covered account?
"Red flag rules apply to financial institutions and creditors like banks, credit unions, auto dealers, mortgage brokers, utility companies and telecommunications companies," says Pavneet Singh, a Federal Trade Commission spokeswoman.
Compliance Coach's Huda says you don't necessarily have to be an account holder for the rules to apply to you.
Credit reporting agencies are exempt from the red flag rules, but at least one, Experian, is getting involved at some level. Experian hosted a red flag rules Web seminar in February that attracted more than 700 clients.
"We tried to make sure that all our existing and prospective clients understood what these red flag rules meant," says Keir Breitenfeld, a senior product manager with Experian's Fraud & Identity Solutions. "We tried to do that educationally."
Experian has also created a Web site with resources designed to help business owners achieve compliance with the new rules.
How will red flag rules benefit you?Red flag advocates say that banks and creditors with sloppy fraud prevention programs will eventually be exposed by litigation and negative publicity.
"The public disclosure of identity theft will create more of an onus for these companies to be up to par," says Huda. "At the end of the day, consumers will eventually benefit because of the higher standards."
Hoofnagle says the prospects of the agencies, such as the Federal Trade Commission and the Federal Deposit Insurance Corp., enforcing red flag rules combined with possible litigation, "will involve some transparency of procedures."
Another added benefit of the red flag rules is that employees may be more vigilant in spotting identity fraud.
Hoofnagle says he has been pushing for a ratings system for banks like the ones that measure vehicle safety. His 2006 study of ID theft incidents among financial institutions reveals a wide variance in frequency of customer complaints.
"You can go online and look at the crash test of your car and the rollover rating and all this is available to consumers now," he says. "It wasn't available 40 years ago, but I think we will have a similar situation with banks."