| The Federal Trade Commission
(FTC) has announced another 90-day delay in the enforcement of
its Red Flags Rule until Nov. 1, 2009.
The Red Flags Rule sets out how certain businesses and
organizations must develop, implement, and administer their
Identity Theft Prevention Programs. Your Program must include
four basic elements, which together create a framework to
address the threat of identity theft:
First,
your Program
must include reasonable policies and procedures to identify the
“red flags” of identity theft you may run across in the
day-to-day operation of your business. Red flags are suspicious
patterns or practices, or specific activities that indicate the
possibility of identity theft. For example, if a customer has
to provide some form of identification to open an account with
your company, an ID that looks like it might be fake would be a
“red flag” for your business.
Second, your Program must be designed to detect the red flags you’ve
identified. For example, if you’ve identified fake IDs as a red
flag, you must have procedures in place to detect possible fake,
forged, or altered identification.
Third: your Program must spell out appropriate actions you’ll take when
you detect red flags.
Fourth, because identity theft is an ever-changing
threat, you must address how you will re-evaluate your Program
periodically to reflect new risks from this crime. |
