Phone: 630-495-2282 Fax: 630-495-2260 Map/Directions



Red Flags Reprieve: FTC extends compliance deadline 6 months

November 17, 2010

The Federal Trade Commission on Oct. 22 suspended enforcement of the new "Red Flags Rule" until May 1, 2009, to give creditors and financial institutions more time to develop and implement written Identity Theft Prevention Programs (ITPP).

But while dealers and other creditors now have six extra months to prepare an ITPP, the FTC action did not affect the Address Discrepancy Rule; its compliance deadline still is Nov. 1.

The Red Flags Rule is an outgrowth of the Fair and Accurate Credit Transactions Act of 2003. The new Rule forces compliance by "financial institutions" and "creditors." Dealerships are swept up in the matter because the FTC defines dealerships as creditors. As such, they must develop an ITPP to identify, detect, and respond to patterns, practices, or specific activities that could indicate identity theft.

The Address Discrepancy Rule is a separate but related identity theft prevention regulation that requires dealers and other users of consumer credit reports to adopt policies and procedures to verify that a consumer report relates to the correct individual when the user receives a Notice of Address Discrepancy from a consumer reporting agency.

Consumer reporting agencies must submit the notice to dealers who order a consumer credit report, when the consumer’s address as submitted by the dealer differs substantially from the address the agency has on file for the consumer.

While sharing similar goals, the new Rules should not be confused with another ID theft-prevention rule, the FTC Safeguards Rule. Simply put, the Safeguards Rule seeks to prevent data maintained by the dealer from being stolen, while the Red Flags and Address Discrepancy Rules seek to prevent would-be ID thieves from using stolen data, from whatever source, to fraudulently obtain credit.

The National Automobile Dealers Association produced a comprehensive guide to help dealers comply with both the new Rules, and in August it mailed all its members a free copy of "A Dealer Guide to the FTC Red Flags and Address Discrepancy Rules: Protecting Against Identity Theft." Additional copies can be purchased by NADA members for $40; by nonmembers for $80. Call 800-252-6232 ext. 2.

The publication includes an ITPP template that dealers can customize for their stores. Senior management must be involved in approving the initial written program and implementing and administering the program thereafter.

The program must be updated periodically to reflect changing identity theft risks; staff must be trained to implement the program; and appropriate oversight of any service providers must be exercised.