FTC Business Alert

Federal Trade Commission Bureau of Consumer Protection Division of Consumer & Business Education

New ‘Red Flag’ Requirements for Financial Institutions 

and Creditors Will Help Fight Identity Theft

Identity thieves use people’s personally identifying information to open new accounts and misuse 

existing accounts, creating havoc for consumers and businesses. Financial institutions and creditors soon 

will be required to implement a program to detect, prevent, and mitigate instances of identity theft. 

The Federal Trade Commission (FTC), the federal bank regulatory agencies, and the National 

Credit Union Administration (NCUA) have issued regulations (the Red Flags Rules) requiring financial 

institutions and creditors to develop and implement written identity theft prevention programs, as part 

of the Fair and Accurate Credit Transactions (FACT) Act of 2003. The programs must be in place by 

November 1, 2008, and must provide for the identification, detection, and response to patterns, practices, 

or specific activities — known as “red flags” — that could indicate identity theft.

Who must comply with the Red Flags Rules?

The Red Flags Rules apply to “financial institutions” and “creditors” with “covered accounts.”

Under the Rules, a financial institution is defined as a state or national bank, a state or federal savings 

and loan association, a mutual savings bank, a state or federal credit union, or any other entity that holds 

a “transaction account” belonging to a consumer. Most of these institutions are regulated by the Federal 

bank regulatory agencies and the NCUA. Financial institutions under the FTC’s jurisdiction include statechartered credit unions and certain other entities that hold consumer transaction accounts. 

A transaction account is a deposit or other account from which the owner makes payments or 

transfers. Transaction accounts include checking accounts, negotiable order of withdrawal accounts, 

savings deposits subject to automatic transfers, and share draft accounts.

A creditor is any entity that regularly extends, renews, or continues credit; any entity that regularly 

arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor 

who is involved in the decision to extend, renew, or continue credit. Accepting credit cards as a form 

of payment does not in and of itself make an entity a creditor. Creditors include finance companies, 

automobile dealers, mortgage brokers, utility companies, and telecommunications companies. Where 

non-profit and government entities defer payment for goods or services, they, too, are to be considered 

creditors. Most creditors, except for those regulated by the Federal bank regulatory agencies and the 

NCUA, come under the jurisdiction of the FTC. 

A covered account is an account used mostly for personal, family, or household purposes, and that 

involves multiple payments or transactions. Covered accounts include credit card accounts, mortgage 

loans, automobile loans, margin accounts, cell phone accounts, utility accounts, checking accounts, and 

savings accounts. A covered account is also an account for which there is a foreseeable risk of identity 

theft – for example, small business or sole proprietorship accounts.
June 2008

Complying with the Red Flags Rules

Under the Red Flags Rules, financial institutions and creditors must develop a written program that 

identifies and detects the relevant warning signs — or “red flags” — of identity theft. These may include, 

for example, unusual account activity, fraud alerts on a consumer report, or attempted use of suspicious 

account application documents. The program must also describe appropriate responses that would prevent 

and mitigate the crime and detail a plan to update the program. The program must be managed by the 

Board of Directors or senior employees of the financial institution or creditor, include appropriate staff 

training, and provide for oversight of any service providers.

How flexible are the Red Flags Rules?

The Red Flags Rules provide all financial institutions and creditors the opportunity to design and 

implement a program that is appropriate to their size and complexity, as well as the nature of their 

operations. Guidelines issued by the FTC, the federal banking agencies, and the NCUA 

(ftc.gov/opa/2007/10/redflag.shtm) should be helpful in assisting covered entities in designing their 

programs. A supplement to the Guidelines identifies 26 possible red flags. These red flags are not a 

checklist, but rather, are examples that financial institutions and creditors may want to use as a starting 

point. They fall into five categories:

• alerts, notifications, or warnings from a consumer reporting agency;

• suspicious documents;

• suspicious personally identifying information, such as a suspicious address;

• unusual use of — or suspicious activity relating to — a covered account; and

• notices from customers, victims of identity theft, law enforcement authorities, or other businesses 

about possible identity theft in connection with covered accounts. 

More detailed compliance guidance on the Red Flags Rules will be forthcoming. For questions about 

compliance with the Rules, you may contact RedFlags@ftc.gov.

The FTC, the nation’s consumer protection agency, works to prevent fraudulent, deceptive, and unfair 

business practices in the marketplace and to provide information to help consumers spot, stop, and avoid 

them. To file a complaint or to get free information on consumer issues, visit ftc.gov or call toll-free, 

1-877-FTC-HELP (1-877-382-4357); TTY: 1-866-653-4261. The FTC enters Internet, telemarketing, 

identity theft, and other fraud-related complaints into Consumer Sentinel, a secure online database 

available to hundreds of civil and criminal law enforcement agencies in the U.S. and abroad.

Your Opportunity to Comment

The National Small Business Ombudsman and 10 Regional Fairness Boards collect comments from 

small businesses about federal compliance and enforcement activities. Each year, the Ombudsman 

evaluates the conduct of these activities and rates each agency’s responsiveness to small businesses. Small 

businesses can comment to the Ombudsman without fear of reprisal. To comment, call toll-free 1-888-

REGFAIR (1-888-734-3247) or go to www.sba.gov/ombudsman.

1-877-FTC-HELP FOR THE CONSUMER

FEDERAL TRADE COMMISSION ftc.gov