Federal Trade Commission Protecting America's Consumers

Skip to Main Content

Privacy Policy
Advanced Search
En Español

Home

About the FTC

Commissioners

Offices & Bureaus

Inspector General

Jobs

FOIA

Budget & Performance

News

About Public Affairs

Public Events

Speeches

Testimony

Webcasts

Blogs

Reporter Resources

Noticias en Español

Competition

About BC

Premerger Notification

Enforcement

Guidance

Advocacy Filings

En Español

Consumer Protection

About BCP

Consumer Information

Business Information

Resources

File a Complaint

Protección del Consumidor en Español

Economics

About BE

Research

Events

Presentations

Educational Materials

Economía en Español

General Counsel

FOIA

Policy Studies

Amicus Briefs

Legal Authority

Statutes

About the Office of General Counsel

Actions

Rules

Documents

Cases (by name)

All Actions (by date)

About the Office of the Secretary

Congressional

Newsletter

Senate/House Links

Appropriations

Testimony

About Congressional Relations

Policy

Reports

Advocacy Filings

About Policy Planning

International

Technical Assistance

Foreign Authorities

Cooperation Agreements

Consumer Protection

Competition

About Intl. Affairs

For Release: 07/29/2009

FTC Announces Expanded Business Education Campaign on 'Red Flags' Rule

To assist small businesses and other entities, the Federal Trade Commission staff will redouble its efforts to educate them about compliance with the "Red Flags" Rule and ease compliance by providing additional resources and guidance to clarify whether businesses are covered by the Rule and what they must do to comply. To give creditors and financial institutions more time to review this guidance and develop and implement written Identity Theft Prevention Programs, the FTC will further delay enforcement of the Rule until November 1, 2009.

The Red Flags Rule is an anti-fraud regulation, requiring “creditors” and “financial institutions” with covered accounts to implement programs to identify, detect, and respond to the warning signs, or “red flags,” that could indicate identity theft. The financial regulatory agencies, including the FTC, developed the Rule, which was mandated by the Fair and Accurate Credit Transactions Act of 2003 (FACTA). FACTA’s definition of “creditor” includes any entity that regularly extends or renews credit – or arranges for others to do so – and includes all entities that regularly permit deferred payments for goods or services. Accepting credit cards as a form of payment does not, by itself, make an entity a creditor. “Financial institutions” include entities that offer accounts that enable consumers to write checks or make payments to third parties through other means, such as other negotiable instruments or telephone transfers.

The FTC’s Red Flags Web site, www.ftc.gov/redflagsrule, offers resources to help entities determine if they are covered and, if they are, how to comply with the Rule. It includes an online compliance template that enables companies to design their own Identity Theft Prevention Program through an easy-to-do form, as well as articles directed to specific businesses and industries, guidance manuals, and Frequently Asked Questions to help companies navigate the Rule.

Although many covered entities have already developed and implemented appropriate, risk-based programs, some – particularly small businesses and entities with a low risk of identity theft – remain uncertain about their obligations. The additional compliance guidance that the Commission will make available shortly is designed to help them. Among other things,
Commission staff will create a special link for small and low-risk entities on the Red Flags Rule Web site with materials that provide guidance and direction regarding the Rule. The Commission has already posted FAQs that address how the FTC intends to enforce the Rule and other topics – www.ftc.gov/bcp/edu/microsites/redflagsrule/faqs.shtm. The enforcement FAQ states that Commission staff would be unlikely to recommend bringing a law enforcement action if entities know their customers or clients individually, or if they perform services in or around their customers’ homes, or if they operate in sectors where identity theft is rare and they have not themselves been the target of identity theft.

The three-month extension, coupled with this new guidance, should enable businesses to gain a better understanding of the Rule and any obligations that they may have under it. These steps are consistent with the House Appropriations Committee’s recent request that the Commission defer enforcement in conjunction with additional efforts to minimize the burdens of the Rule on health care providers and small businesses with a low risk of identity theft problems. Today’s announcement that the Commission will delay enforcement of the Rule until November 1, 2009, does not affect other federal agencies’ enforcement of the original November 1, 2008, compliance deadline for institutions subject to their oversight.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC’s online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 1,500 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s Web site provides free information on a variety of consumer topics.

MEDIA CONTACT:
Office of Public Affairs
202-326-2180

(Red Flags July 09)

Related Items:

Federal Trade Commission Extended Enforcement Policy:  Identity Theft Red Flags Rule, 16 C.F.R. Part 681.1

Frequently Asked Questions

About Us
Contact Us
Jobs
Recovery Act
No FEAR Act Data
Performance and Accountability Report
FOIA
Site Map

Website Policies
Accessibility
Privacy Policy
Browser Plug-ins
Related Sites
USA.gov
For FTC Staff

Last Modified: Wednesday, 29-Jul-2009 11:03:00 EDT