Red Flag Warning | Compli.com

Red Flag Warning
By Michael A. Benoit*
Unless you've been living under a rock, you all know that Southern California has had its
share of devastating wildfires over the last several months. If you live in Southern
California, you've experienced the hot Santa Ana winds and the "red flag warnings" that
accompany them - that is, warnings of the potential for such a catastrophe.
Well, the federal government has announced its own "red flag warning" with the recent
publication of the Red Flag Rules and Guidelines (the "Rule") mandated by the Fair and
Accurate Credit Transactions Act of 2003 ("FACTA") as a means of combating identity
theft. The Red Flag Rule is effective January 1, 2008, and compliance is mandatory for
auto dealers and others on November 1, 2008. This may sound like there is time to get
your house in order, but don't dally - there's a lot to do.
The Rule requires auto dealers who engage in financing activities to establish an Identity
Theft Prevention Program that is designed to detect, prevent, and mitigate identity theft.
For most dealers, this means creating a written Program with respect to new credit
accounts. For those of you in the Buy Here, Pay Here community, your Program will
need to address your existing accounts as well. All consumer accounts are covered by
the Rule, as well as business accounts to the extent you determine that there is a
reasonably foreseeable risk to the business customer or yourself from identity theft.
Your Program must be composed of four distinct elements containing reasonable
policies and procedures to:
1. Identify relevant "red flags" (patterns, practices, or activities that indicate the
possibility of identity theft) relevant to the credit origination process;
2. Detect and evaluate these "red flags" in connection with individual customer
transactions;
3. Respond to red flags you detect in an appropriate way to prevent identity theft;
and
4. Ensure your Program is updated periodically to reflect changes in risks to
customers from your experiences and new identity theft activity.
The term "Red Flag" refers to a pattern, practice, or specific activity that indicates the
possible existence of identity theft. There are some examples in the Rule as to what
these might be, but you will need to make a determination for yourself as to what these
are in the context of your business.
The Rule does contain a list of potential red flags you may consider for incorporation into
your Program. The list is provided for guidance to help you identify relevant red flags.
While you will not need to justify to the Federal Trade Commission your failure to include
a specific red flag from the list in your Program, you may find yourself having to account
for the overall effectiveness of your Program. So, if a particular red flag makes sense in
Copyright © 2008 CounselorLibrary.com LLC. All rights reserved. This article appeared in Spot
Delivery®. Reprinted with express permission from CounselorLibrary.com.
the context of your business to include in your Program and you didn't include it, you
may still find yourself in hot water if you experience an identity theft incident.
The Rule also provides final guidance regarding actions a user of consumer reports
must take when a consumer reporting agency sends the user a notice of address
discrepancy. When you receive such a notice, you must use policies and procedures
you have designed to enable you to form a reasonable belief that the consumer report
relates to the actual person standing in the dealership or otherwise applying for credit.
To the extent you furnish information to consumer reporting agencies, you must also
furnish a corrected address for the consumer.
This new Rule is involved and complicated, and, as always, such things create
opportunities for commerce. You'll soon be set upon by vendors with snappy products
and services who will tell you that they have the “complete solution.” In reality, I have
yet to see an automated solution that can walk around your dealership, identify risks,
and record your policies and procedures.
Simply put, technology solutions can be great, but you’ll still have to make some effort.
Be wary of any vendor that tells you otherwise. Many parts of the Rule lend themselves
to technological solutions, but others require some good old fashioned judgment calls.
Be sure you know which parts are which, and you'll keep the regulatory wildfires to a
minimum.
*Michael A. Benoit is a partner in the Washington, DC office of Hudson Cook LLP.
Michael is a frequent speaker and writer on a variety of consumer credit topics. He can
be reached at 202.327.9705 or by e-mail at mabenoit@hudco.com.
Copyright © 2008 CounselorLibrary.com LLC. All rights reserved. This article appeared in Spot
Delivery®. Reprinted with express permission from CounselorLibrary.com.