Red Flag Rules Deadline Approaching

The Nov. 1 deadline for new federal identity theft regulations requiring financial institutions and other creditors that provide financing is fast approaching, reports eWeek. Known as FACTA (Fair and Accurate Credit Transactions Act), the rules require covered organizations to re-examine their ID theft prevention policies and implement new procedures and business practices.

More specifically, FACTA requires a written ID theft prevention policy that includes polices that identify ?patterns, practices or specific activities that could indicate identity theft,? according to the FTC (Federal Trade Commission). Violators of the new rules can be subject to civil penalties of up to $2,500 per violation.

The new regulations ? also known as Red Flag rules ? have long been thought to only apply to financial institutions such as banks, savings and loans, mortgage lenders and credit unions, but as the compliance deadline nears, SMBs (small and midsize businesses) are concerned the rules may also cover them. While clearly targeting financial institutions, the rules also cover ?any person or business? that arranges for customer credit.

The agency defines a creditor as ?any entity that regularly extends, renews, or continues credit; any entity that regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who is involved in the decision to extend, renew, or continue credit.?

A business alert issued by the FTC adds, ?Accepting credit cards as a form of payment does not in and of itself make an entity a creditor.?
The FTC added the Red Flag rules to FACTA in January. Businesses are required to define policies for recognizing red flags in identity verification. Typical red flags include discrepancies in address histories, fraud alerts on consumer reports, questionable use of Social Security numbers, credit freeze notifications and unusual patterns of customer activities.

Once those definitions are in place, companies are then required to define appropriate courses of action when a red flag drops.

Senate Approves New ID Theft Legislation

Senate Approves New ID Theft Legislation August 1st, 2008
According to SC Magazine, the Senate passed an amended bill that will place harsher restrictions on cyberattacks and allow identity theft victims to recoup costs in federal court.

The legislation, known as the Identity Theft Enforcement and Restitution Act, had unanimously passed the Senate in November but was stalled in the House. It allows identity theft victims to recoup costs associated with the loss of time and money spent restoring their credit standing. It also lowers the bar for what is prosecutable as a felony by eliminating the requirement that sensitive information must have been stolen using a computer through interstate or foreign communications. This means criminals can be more easily prosecuted if they hack a computer in the same state.

The bill also would make it a felony to use spyware or keyloggers to damage 10 or more computers, regardless of the amount of destruction caused. In addition, the definition of cybercrime also would be expanded to include cyberextortion cases, where malware is removed or DDoS attacks halted in return for a ransom.