Red Flag Rule Added to FACTA

By Steven Hastert | July 17, 2008 | 3 minute read

Enacted in 2003, The Fair and Accurate Credit Transactions Act, or FACTA, requires that all businesses, regardless of size or industry, protect and dispose of sensitive and personal data they collect about their customers.

The Federal Trade Commission has issued new regulations to the Fair and Accurate Credit Transactions Act (FACTA) known as the Red Flags Rules. The

This rule, which was ordained by the Federal Trade Commission (FTC), doesn’t discriminate based on the size of your business.  If you aren’t compliant with FACTA, you’re breaking the law.  Are you FACTA compliant?  Here’s some questions that you can use to find out.

1. Does your company have written policies and procedures in place that detail how documents are maintained and shredded?
2. Do you have regularly scheduled shredding occurring on a consistent basis?
3. Is document storage and shredding covered in your company handbook?
4. Does your business offer regular training in regards to storage and shredding of documents for all personnel?
5. Does your company have a disposal plan in place for electronic media? FACTAs rules apply to magnetic media (floppy disks, CDs, DVDs, hard drives, etc.), so all businesses need to include any of these that might contain sensitive and personal information in their shredding management plan.

These questions are some of the guidelines to help your business become FACTA compliant- but it’s just a start.  Implement a solid document management plan and take the proper steps to protect your business and your customers.

New Regulations Added To Facta: Red Flags Rules

New rules require financial institutions to create prevention programs to detect and respond to “patterns, practices, or specific activities that could indicate identity theft.” The program must be in place by November, 1 2008.

According to the rule a financial institution is defined as banks, savings and loan associations, credit unions, and creditors. Creditors does not include every business that accepts credit cards but does include any business that extends credit. For example, finance companies, automobile dealers, mortgage brokers, utility companies, and telecommunications companies.

Some red flags that covered entities must be monitoring are:

• Alerts, notifications, or warnings from a consumer reporting agency
• Suspicious documents
• Suspicious information
• Unusual use of a covered account
• Notices from customers, law enforcement authorities, or other businesses

This represents the biggest changes to the FACTA law since it was enacted in 2003