In recent e-lerts and webinars, JSI has informed clients of the new Federal Trade Commission (FTC) Red Flag rule that requires telecommunications companies and other entities (known as creditors) that defer payment for goods or services to develop and implement written identity theft prevention programs.  Last week, the FTC suspended enforcement of the Red Flag rule until May 1, 2009.  JSI encourages companies that have not yet finalized their programs to do so in the coming weeks to allow adequate time for implementation and training, which are also required by the rule. 

Clients should be aware that the delay does not apply to two other FTC identity theft rules related to the Red Flag rule.  When the Red Flag rule was adopted and added to the Code of Federal Regulations, the FTC included two other rules that also pertain to identity theft prevention.  One of these rules applies to companies that use credit reports, and the other applies to companies that issue calling cards.  These two rules do become effective on November 1, and we have summarized them below. 

For Companies that Use Credit Reports  

If a company makes use of credit reports, it must develop reasonable policies and procedures to employ when it receives a "notice of address discrepancy" on the credit report furnished by a nationwide consumer reporting agency (CRA).  A "notice of address discrepancy" occurs when a CRA notifies the company of a substantial difference between the consumer's address provided by the company to the CRA and an address for the consumer maintained in the CRA's files.

Under these rules, the company must have policies and procedures in place to establish a reasonable belief that the credit report relates to the consumer about whom the report was requested.  The policies and procedures at a minimum must involve:

• Comparing information in the credit report to information the company:
  • obtains and uses to verify the consumer's identity;
  • maintains in its own records, such as applications, change of address notifications, other customer account records; or,
  • obtains from third-party sources; and,
• Verifying information in the report with the consumer.

If the company can reasonably confirm that the address provided by the consumer is accurate, the company must provide the CRA with that address under certain conditions.

For Companies that Issue Calling Cards

If a company issues calling cards, it must establish procedures to ensure that appropriate actions are taken to evaluate the validity of an address change when the company receives a change notice for an existing account and also receives a request for an additional or replacement card for the same account within a short period of time (during at least the first 30 days).

The procedures that should be established under this rule should, at minimum, deny issuing additional calling cards to a customer under such circumstances unless the company can determine the validity of the change of address request through one of three methods:

• By notifying the cardholder of the request at the cardholder's former address and providing the cardholder with a means to promptly report an incorrect address;
• By notifying the cardholder of the address change request by another means of communication previously agreed to by the issuer and the cardholder; or
• By using other means of evaluating the validity of the address change.

If you would like assistance in complying with these Red Flag-related rules or in developing or implementing your company's written identity theft prevention program, including assistance with staff training, or if you have any questions concerning these issues, please contact John Kuykendall (jkuykendall@jsitel.com) or John Becci (jbecci@jsitel.com) in JSI's Maryland office, at 301-459-7590, or Craig Cook (ccook@jsitel.com) in our Texas office, at 512-338-0473.