Q-CERT banner

main navigation areas

Identity Theft Red Flags Scheme

September 25, 2008

Based on a recent rise in global identity theft and fraud risks, the U.S. government has issued an amendment to the financial regulation to tackle the issue. This new addition is the Identity Theft Red Flag scheme.

Under this scheme, financial institutions and creditors must develop a written program that identifies and detects the relevant warning signs—or "red flags"—of identity theft. These signs may include unusual account activity, fraud alerts on a consumer report, or attempted use of suspicious account application documents. The program must also describe appropriate responses that would prevent and mitigate the crime and detail a plan to update the program. The program must be managed by the Board of Directors or senior employees of the financial institution or creditor, must include appropriate staff training, and must provide for oversight of any service providers.

The rule is composed of 26 red flags for companies to implement. These red flags cover major identity fraud controls and focus on the following areas:

This rule has been in effect from January 2008, and compliance must be met by November 2008.

One of the things this rule shows is how much governments have to enforce best practices to minimize risks faced by the financial sector, since it is a critical sector for a country's economy. The U.S. has always been a leader in this type of financial regulation, and the proposed controls are quite discernable for many companies. Identity theft is a worldwide threat that is not limited to the boundaries of one country, so other countries could adopt similar regulation by following or adapting these main ideas.

Here in the Middle East, recent issues related to fraud in payment card systems, for example, should help regulators think about adopting similar processes and ideas. Trends show that bringing more security to the market should help to gain global confidence and enforce better governance. The Middle East is still a young and growing marketplace; therefore, more maturity in regulation is welcome.

The initial 26 red flags are listed below, but they do not represent an exhaustive list, because companies will use their own experience to implement more appropriate controls: