Businesses extending credit, holding customer accounts that permit multiple payments and transactions, or with other foreseeable risk of ID theft are now required to have prevention programs. This includes banks, car companies with loan-financing divisions, and casinos that set up accounts and lines of credit for customers.

Under the so-called "red flag" rules, these businesses are obliged to have the programs designed to identify and respond to red flag events signaling ID theft. These include: presenting suspicious documents on account opening, and unusual use of an account. Among the suggested actions are: account monitoring, customer notification, and contacting law enforcement authorities.

Banks often have to adapt existing programs to comply with the new rules. Stephen Kenneally, vice president of the Center for Regulatory Compliance at the American Bankers Association (Washington, DC, USA) explained that the banks already check customers' photo identification. “If someone's face obviously doesn't match their driver's license, you wouldn't want to open their account. That would be a red flag... Now we're officially... going to be ... putting it into our written identity theft prevention program."

Another challenge is to devise a protocol for assessing which accounts are most at risk of ID theft. According to Keith Monson of Premier Bank (Missouri, Illinois and Texas, USA), for his bank, the most difficult part of compliance with the rules is assessing risks and determining whether the program should apply to business accounts.

Danny Shaw, a consultant on red-flag rule compliance for Milwaukee-based Jefferson Wells auditing and consulting firm (Milwaukee, WI, USA), agrees that risk assessment is where many of his clients were lagging behind. "If they already have security things in place... companies believe they have got themselves covered, but they [may] have not verified that through a true identity [theft] review."

Not surprisingly, the regulation is harder on smaller banks. "The bottom line [is that] if you're a smaller bank, and you only have one-and-a half full-time employees devoted to compliance.... it is a lot bigger burden than if you're a bank that has a hundred people in compliance," said Kenneally.

Another issue is account monitoring. Priscilla J. Barnes, vice president of regulatory risk management at Oklahoma-based Stillwater National Bank (Stillwater, OK, USA) claimed that her bank could not afford the technology to help them comply with the rules to monitor all accounts.

The new ID theft rules should not be regarded as a burden, or as Shaw put it, "[Are] your reputation and loss of money, both, worth not getting it [complying with the new rules] done?" Can such rules achieve their objective? As Barnes pointed out, since they do not have control over customers' lives and information, "it is impossible for any organization to develop a program that will ensure the prevention of identity theft."

Related links:
Center for Regulatory Compliance at the American Bankers Association
Premier Bank
Jefferson Wells auditing and consulting firm
Stillwater National Bank