Red Flag Rules Go into Full Effect on August 1, 2009

• Barry Hurewitz
• 7.24.2009

Companies should be aware that the Federal Trade Commission will begin enforcing the "Red Flags Rule" on August 1, 2009 against financial institutions and "creditors." The Fair Credit Reporting Act defines "creditors" to include any entity that regularly extends credit and all entities that regularly permit deferred payments for goods or services. The Federal Trade Commission has made clear that it intends to interpret that term broadly to include mortgage companies; automobile dealers that provide or arrange financing; mortgage brokers; utility companies; telecommunications companies; non-profit and government entities that defer payment for goods or services; and businesses that provide services and bill later, including many lawyers, doctors, and other professionals.

The rule applies only to "covered accounts" held by these entities, which, in brief, are accounts that involve a continuing financial relationship with an individual or small business to allow multiple payments for a product or service, or accounts that otherwise create a risk of identity theft. By August 1st, creditors and financial institutions are expected to have developed and implemented an identity theft prevention program that addresses the company's procedures for responding to identity thefts that are likely to arise with respect to the company's covered accounts. The program must be in writing, and must have been approved by the company's Board or senior management; and its implementation must be overseen by the Board or a designated senior employee.

The Red Flag rules also require issuers of credit cards and debit cards to assess the validity of notifications of changes of address, and provide guidance for users of consumer reports regarding the policies and procedures that should be used when consumer reporting agencies send a notice of address discrepancy.

The Federal Trade Commission extended the effective date of the rules in response to the widespread sense that many companies were unaware of the rules and unprepared for them to go into effect. At this point, however, companies are expected to be on notice of the rules, and there is no expectation of further extensions.