The FACTA “Red Flags Rule” and residential property management: Part 1 of 2

Yet another new rule for business is on the horizon.  Around the corner is June 1, 2010, when the new Red Flags rule finally comes into full effect.  So what is it and what does it mean for those of us who own or manage residential housing? 
 

 

What is the FACTA “red flags rule”?

The red flags rule was promulgated under the Fair and Accurate Credit Transactions Act (FACTA), in which Congress directed that regulations be developed requiring covered businesses to address the ever increasing risk and mounting economic problem of identity theft. The resulting “red flags rule” requires financial institutions and creditors that have “covered accounts” to develop and implement written identity theft prevention programs. 

 

The purpose of those identity theft programs is to help identify, monitor for, detect, and respond to patterns, practices, or specific activities – known as “red flags” – that could indicate that an instance of identity theft had occurred or might occur in the future. (See “FTC Extends Enforcement Deadline for Identity Theft Red Flags Rule” October 30, 2009 at http://www.ftc.gov/opa/2009/10/redflags.shtm.)

 

And what is a red flag? A red flag includes unusual account activity, fraud alerts on a consumer report, or attempted use of suspicious account application documents, as well as other atypical, strange or suspicious activity related to an individual’s personal information.

 

Five general red flag categories and 26 specific potential red flags events are identified by the Federal Trade Commission in a supplement to the Red Flag guidelines. The general categories include:

• alerts, notifications, or warnings from a consumer reporting agency;
• suspicious documents;
• suspicious personally identifying information, such as a suspicious address;
• unusual use of – or suspicious activity relating to – a covered account; and
• notices from customers, victims of identity theft, law enforcement authorities, or other businesses about possible identity theft in connection with covered accounts.

Who is covered by the rule?

Coverage for the “red flags rule” can be broken down into two basic questions. First, who and what are the covered businesses under the rule? Financial institutions and creditors are covered by the law. While determining who is a financial institution is a fairly straight forward analysis, defining a creditor under the law is more complicated. 

 

Under the red flags rule you are a creditor if you:

• extend, renew, or continue credit;
• arrange for someone else to extend, renew, or continue credit; or
• are the assignee of a creditor who is involved in the decision to extend, renew, or continue credit.

Under the red flags rule, “credit” means an agreement in which payment is deferred or made subsequent to the purchase of property or services. 

 

What is a Covered Account?

If you are a covered financial institution or creditor, the second test for the “red flags rule” is: do you have covered accounts? There are two types of covered accounts:

• a consumer account which involves multiple payments or transactions such as credit card accounts, mortgage loans, car loans, margin accounts, cell phone accounts, utility accounts, and checking or savings accounts; or
• an account where there is a reasonably foreseeable risk of identity theft. Coverage here can be triggered by the vulnerability of the business due to business type, size or available resources, along with other factors. 

What must a covered business do?

Once it is determined a business is covered by the red flags rule and the company or sole proprietorship has covered accounts, the business must develop, adopt, implement, maintain and update an Identity Theft Prevention Program (ITPP) to combat identity theft in connection with any new or existing customer account(s). The ITPP must include reasonable policies and procedures to identify, monitor for and detect, prevent, and mitigate identity theft.  The ITPP must enable the covered business to:

1. Identify relevant patterns, practices, and specific forms of activity that are “red flags” signaling possible identity theft and incorporate those red flags into the Program;
2. Monitor for and detect red flags that have been incorporated into the ITPP;
3. Respond appropriately to any red flags that are detected, in order to prevent and mitigate identity theft; and
4. Ensure the ITPP is updated periodically to reflect changes in risks from identity theft.

 

Coming in Part 2 of 2

“The FACTA “Red Flags Rule” and residential property management”

Are property owners and managers covered under the “red flags rule”?  And if property owners and managers are covered by the Red Flags Rule, what must they accomplish to be in compliance and by when must it be done?

 

Resource List:

• Fighting Fraud with the Red Flags Rule - http://www.ftc.gov/bcp/edu/microsites/redflagsrule/index.shtml
• Protecting Personal Information - http://www.ftc.gov/bcp/edu/microsites/infosecurity/
• The Red Flags Rule: Are you Complying with New Requirements for Fighting Identity Theft?  - http://www.ftc.gov/bcp/edu/pubs/articles/art10.shtm

 

---

 

This article was first published on Examiner.com. 

Introducing the social media background check for rental applications!

 

Most responsible property owners and managers use the three-tier approach of income, credit and background check to implement a fair and non discriminatory application protocol. Such application guidelines are well accepted and generally considered “best practice” guides for the housing industry. Individual and company guidelines will vary with risk tolerance levels, such as how many late payments are acceptable or what income ratio is appropriate. However some sort of combination of income, credit and background evaluation is the norm when evaluating a rental application. 

The Social Media Fingerprint

Fast forward to 2010 and personal background information has now morphed into something more than before – the social media fingerprint.  Today not only do we have an electronic fingerprint of our credit, but we have electronic versions of our personalities residing on the Internet.  And they are public for the world to see and judge.  How should the property owners and managers of today deal with this new type of personal information?

Today, many employers now include electronic social media investigations and searches as a routine part of their background evaluation of a prospective employee.  It is only logical that property owners and landlords should also include some level of social media search for information about a prospective resident as part of their routine background verification. However, the prospective resident should be evaluated for their ability to follow the mandates of the lease and community rules and no more. 

Limited Scope and Purpose

It is not the job of the landlord or owner to make personal judgments or to determine if a prospective resident will “fit in.”  Whatever that means, that’s going too far. A social media or electronic background review should be limited in scope to obvious “red flags” such as inconsistencies in background information revealing potential identity theft issues, or to obvious behavioral issues suggesting the prospect would be unable or unwilling to follow the proposed rental agreement.

The Challenge

This is not an easy road to walk. This is new ground and undoubtedly mistakes will be made.  Some landlords will go too far, using social media information to reject prospective residents for inappropriate or legally impermissible reasons.  Some landlords will not investigate at all. An inappropriate resident will be approved, engage in dangerous behavior that was foreseeable, and the landlord will be sued by the injured party.  It will take time, trial and error to get the delicate balance between unacceptable social media evaluation and social media privacy; if there is such a thing as social media privacy.

The Future

Over time, the acceptable guidelines and uses of social media information will be developed through  routine practice and the Courts. Eventually the government will codify rules and provide some safe harbors and guidelines, but only after the use of social media to evaluate prospective residents becomes commonplace. In the interim, we will all struggle with developing rules that allow us to make reasonable inquiries and good application decisions, backed by sound business judgment. 

Do you have a prospective resident social media background investigation protocol?  Have ideas on what might be included? If so, please share them through the Comments feature. 

Interested in how social media can improve your rental marketing program?  Contact Lightner Property Group to put the power of Lightner Solutions to work for you today!