Red Flag Rules

QMS offers compliance with the new FACTA “Red Flags” Identity Theft Prevention as required by the FTC.

FTC Issues Final Rules on FACTA Identity Theft Definitions

The Federal Trade Commission has issued its final rules under the Fair and Accurate Credit Transactions Act (FACTA) regarding further definition of the terms “identity theft” and “identity theft report”; the duration of active duty alerts; and the appropriate proof of identity needed by consumers to block fraudulent trade lines in their consumer reports, place or remove fraud or active duty alerts, or truncate their Social Security number in their file disclosures.

FACTA, which was enacted on December 4, 2003 and amends the Fair Credit Reporting Act (FCRA), enables identity theft victims to place “fraud alerts” on their credit files and work with creditors and credit bureaus to “block” information in their credit reports resulting from identity theft. FACTA also allows military personnel to place an alert on their credit file if they are deployed, and allows consumers to request that a credit bureau truncate their Social Security number on credit reports sent to the consumers.

The FTC’s final rule defines “identity theft” as a fraud that is committed or attempted; using a person’s identifying information without authority. The rule also states that “identifying information” should have the same meaning as “means of identification” in the federal criminal statute defining identity theft. Consumers need “identity theft reports” to place an extended fraud alert on their credit file and to block information resulting from identity theft from appearing in their credit files. To prevent misuse of identity theft reports for credit repair scams, the FTC’s rule requires that consumers allege the identity theft with as much specificity as possible and enables credit bureaus or creditors to request, with certain limitations, reasonable additional information to help them determine if identity theft actually occurred.

Finally, the final rule addresses the “appropriate proof of identity” needed to block fraudulent information on a consumer’s credit report, place or remove a fraud alert, or truncate consumers’ Social Security numbers in their file disclosures. The rule requires the credit reporting agencies to develop “reasonable requirements” to ensure, at a minimum, that consumers are matched with their files. The FTC’s rule recommends that the “requirements” for a file match include the consumer’s full name, current or recent full address, full Social Security number, and/or date of birth; and for additional proof of identity, copies of government-issued identification documents, utility bills, and other authentication methods such as answering questions only the consumer would know.