On December 4, the Federal Trade Commission announced that it is seeking comment on whether the agency should make changes to rules requiring that financial institutions and creditors take certain steps to detect signs of identity theft that may affect their customers.

In a press release, the FTC stated that as part of its periodic review of its rules and guidelines, it is seeking comment on whether modifications should be made to the Red Flags Rule and the Card Issuers Rule.

The Red Flags Rule requires financial institutions and certain creditors to not only implement a written identity theft prevention program aimed at detecting “red flags” of identity theft in their daily operations, but also take steps to prevent identity theft and mitigate its damage.

Similarly, the Card Issuers Rule requires debit or credit card issuers to implement policies and procedures to validate a change of address request if, within a short period of time after receiving the request, the issuer receives a request for an additional or replacement card for the same account.  The Card Issuers Rule prevents a card issuer from issuing another card until it has notified the cardholder about the request or otherwise assessed the validity of the address change.

In the Press Release, the FTC noted that identity theft was one of the largest areas of consumer complaints in 2017 and 2018.

Some of the questions on which the FTC seeks comment include the following:

  • What are the costs and the benefits of the Rules to consumers?
  • What significant costs, if any, have the Rules imposed on businesses, including small businesses?
  • Are there any types of creditors that are not currently covered by the Red Flags Rule but should be, because they offer or maintain accounts that could be at risk of identity theft?

Any changes in the Rules may have far-reaching implications by imposing additional regulations on financial institutions and creditors.  Already, the definition of “creditor” under the Red Flags Rule is defined broadly to include third-party debt collectors.

The request for comments, along with instructions on how to submit comments, will be published in the Federal Register shortly.  The deadline for submitting comments is February 11, 2019.