The FACTA “Red Flags Rule” and residential property management: Part 1 of 2

Yet another new rule for business is on the horizon.  Around the corner is June 1, 2010, when the new Red Flags rule finally comes into full effect.  So what is it and what does it mean for those of us who own or manage residential housing? 
 

 

What is the FACTA “red flags rule”?

The red flags rule was promulgated under the Fair and Accurate Credit Transactions Act (FACTA), in which Congress directed that regulations be developed requiring covered businesses to address the ever increasing risk and mounting economic problem of identity theft. The resulting “red flags rule” requires financial institutions and creditors that have “covered accounts” to develop and implement written identity theft prevention programs. 

 

The purpose of those identity theft programs is to help identify, monitor for, detect, and respond to patterns, practices, or specific activities – known as “red flags” – that could indicate that an instance of identity theft had occurred or might occur in the future. (See “FTC Extends Enforcement Deadline for Identity Theft Red Flags Rule” October 30, 2009 at http://www.ftc.gov/opa/2009/10/redflags.shtm.)

 

And what is a red flag? A red flag includes unusual account activity, fraud alerts on a consumer report, or attempted use of suspicious account application documents, as well as other atypical, strange or suspicious activity related to an individual’s personal information.

 

Five general red flag categories and 26 specific potential red flags events are identified by the Federal Trade Commission in a supplement to the Red Flag guidelines. The general categories include:

• alerts, notifications, or warnings from a consumer reporting agency;
• suspicious documents;
• suspicious personally identifying information, such as a suspicious address;
• unusual use of – or suspicious activity relating to – a covered account; and
• notices from customers, victims of identity theft, law enforcement authorities, or other businesses about possible identity theft in connection with covered accounts.

Who is covered by the rule?

Coverage for the “red flags rule” can be broken down into two basic questions. First, who and what are the covered businesses under the rule? Financial institutions and creditors are covered by the law. While determining who is a financial institution is a fairly straight forward analysis, defining a creditor under the law is more complicated. 

 

Under the red flags rule you are a creditor if you:

• extend, renew, or continue credit;
• arrange for someone else to extend, renew, or continue credit; or
• are the assignee of a creditor who is involved in the decision to extend, renew, or continue credit.

Under the red flags rule, “credit” means an agreement in which payment is deferred or made subsequent to the purchase of property or services. 

 

What is a Covered Account?

If you are a covered financial institution or creditor, the second test for the “red flags rule” is: do you have covered accounts? There are two types of covered accounts:

• a consumer account which involves multiple payments or transactions such as credit card accounts, mortgage loans, car loans, margin accounts, cell phone accounts, utility accounts, and checking or savings accounts; or
• an account where there is a reasonably foreseeable risk of identity theft. Coverage here can be triggered by the vulnerability of the business due to business type, size or available resources, along with other factors. 

What must a covered business do?

Once it is determined a business is covered by the red flags rule and the company or sole proprietorship has covered accounts, the business must develop, adopt, implement, maintain and update an Identity Theft Prevention Program (ITPP) to combat identity theft in connection with any new or existing customer account(s). The ITPP must include reasonable policies and procedures to identify, monitor for and detect, prevent, and mitigate identity theft.  The ITPP must enable the covered business to:

1. Identify relevant patterns, practices, and specific forms of activity that are “red flags” signaling possible identity theft and incorporate those red flags into the Program;
2. Monitor for and detect red flags that have been incorporated into the ITPP;
3. Respond appropriately to any red flags that are detected, in order to prevent and mitigate identity theft; and
4. Ensure the ITPP is updated periodically to reflect changes in risks from identity theft.

 

Coming in Part 2 of 2

“The FACTA “Red Flags Rule” and residential property management”

Are property owners and managers covered under the “red flags rule”?  And if property owners and managers are covered by the Red Flags Rule, what must they accomplish to be in compliance and by when must it be done?

 

Resource List:

• Fighting Fraud with the Red Flags Rule - http://www.ftc.gov/bcp/edu/microsites/redflagsrule/index.shtml
• Protecting Personal Information - http://www.ftc.gov/bcp/edu/microsites/infosecurity/
• The Red Flags Rule: Are you Complying with New Requirements for Fighting Identity Theft?  - http://www.ftc.gov/bcp/edu/pubs/articles/art10.shtm

 

---

 

This article was first published on Examiner.com.