Slashdot Mirror
FTC Backs Off Red Flag Rules Again
coondoggie writes to tell us that the Federal Trade Commission has yet again backed off of the new Red Flag Rule designed to protect consumer information. Complaining about cost of implementation, the enforcement date of the rule has been pushed back to August 1, 2009 to give businesses and institutions time to implement identity theft-prevention programs. "The FTC, federal bank regulatory agencies, and the National Credit Union Administration (NCUA) issued the Red Flags Rules as part of the Fair and Accurate Credit Transactions (FACT) Act of 2003. The final rules require financial and credit institutions that hold any consumer account, or other account for which there is a reasonably foreseeable risk of identity theft, to develop and implement an Identity Theft Prevention Program for combating identity theft in connection with new and existing accounts, the FTC said."
But someone who was able to steal their did.
Honestly, I don't mind them delaying it a bit. It's not like they weakened it; they'll get there eventually
In comparison with the operating budget of a typical hospital, I hardly think $10,000 is a major expense. They probably spend more than that waxing the floors every year.
What's the average cost incurred by a single victim of identity fraud? Last I heard it was over $5k. So for the hospital to save its petty $10k in implementation costs, how many patients are they willing to screw over? (All of 'em, it seems.)
[Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
Free, instant access to any credit bureau.
It's ridiculous the information they can store about me and then turn around and charge ME to look at it more than once a year. And my credit score, that should be free for me to view as well.
I've already had two mistakes on my credit and I'm 25 (1 identity theft and 1 Verizon decided I didn't return FiOS equipment - of course I didn't return it, it's still in use!).
Making this information free and accessible would be a start.
They are separate and generally speaking do not follow the same rules.
For example, Bank of America and Chase would not be required to follow these rules.
The 'backing off' doesn't surprise me one bit as the NCUA is probably in as much trouble as the FDIC with failed credit unions, and lack of funds to protect depositors.
http://www.cutimes.com/Pages/News.aspx
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Though the article summary touts the Red Flag Rule(s) as something that is designed to protect consumer information, I have serious doubts as to the efficacy of such a system.
As stated in the article, it's just a system/rule to force banks/creditors/etc. to identify any suspicious activity (i.e. red flags) in their accounts. It doesn't seem to mention anything about any liability or culpability for false positives or worse--completely missing identity theft in action. That said, I still can't believe (provided the inforamtion is true) that companies continue to balk at this. The sums mentioned in the article--$10,000 to comply--are chump change, even if it's a repeated annual expenditure.
The so called red flag rules are an added cost to small businesses and don't really do that much to help prevent identity theft. They apply to anyone who sells a product on any terms other than cash or credit card. This includes your local home heating oil dealer, local appliance store that might offer you a payment plan right down to a bar that lets you keep a tab until pay day.
You can nominally comply with these rules by downloading a template over the internet and designating a person to "review" red flags. They are overly broad, and treat businesses that keep customer records on index cards in a file cabinet the same as the bank that holds your mortgage.
These rules are much like PCI compliance. They sound impressive, but mean very little. Heck RBS Worldpay/Lynk is still processing credit cards but they lost their PCI compliance, after suffering a data breach jeopardizing 1.5 million payroll cards and at least 1.1 million Social Security numbers.
PCI and red flag rules foist the onus of data protection onto small merchants, while the monopolists who benefit from Visa/Mastercard transactions don't have to change anything.
Visa/Mastercard should be tasked with making the whole system more secure. Forcing the burden of data protection in a broken system onto small merchants is like blaming the depositors in a bank when it gets robbed.
I've got my doubts about what this will accomplish.
As a point-of-sale vendor, we ran across this recently. Some bozo was slinging stolen cards at some of our clients, and we TRIED to report it. No calls back, no interest from the local PD, the FBI, the FTC, or even the Secret Service. It just wasn't big enough to make their radar and assign manpower to it.... even after 2 grand in fake charges.
I'd like to see them do more when people with all the evidence they would want call them, rather than implement a new program that will drain even more manpower from enforcement.
Don't tell me to get a life. I'm a gamer; I have LOTS of lives!
serious case of identity theft could cost a single one of their "customers" more than $10,000 I think it is reasonable to expect them to do it.
I work for a financial institution who is regulated by the FRB and OFIS. We were requried to have a Red Flag program in place by Nov 2008 and we were examined at the beginning of 2009. Red Flags was part of that examination. The delay of implementation is not across the board.
To be honest though, all financial institutions do have policies and procedures in place for every potential red flag. "Red Flags" is nothing more than yet another Risk Assessment where all of those programs are brought together under one umbrella.
The Red Flag rule had the effect of requiring any company that provided product or services before payment was billed, had to comply with non-trivial requirements for protection, detection and reporting. If the lawn mowing service billed you, they had to meet Red Flag rules.
Why would one use these applications instead of say Tor?
Complaining about cost of implementation, the enforcement date of the rule has been pushed back to August 1, 2009 to give businesses and institutions time to implement identity theft prevention programs.
I hate it when enforcement dates start complaining on their own.
I hate it almost as much as when participles start dangling right in the middle of sentences, in full view of children.
Red Flags Rule: It is time to do the right thing.
On April 30, less than a day before the Federal Trade Commission (FTC) was to begin enforcing the Red Flags Rules, the agency extended the deadline for compliance for the second time, until August 1. The 11th hour reprieve by the FTC reflects the fact that far too many organizations have either failed in their efforts to develop identity theft prevention programs, or simply ignored the governmentâ(TM)s mandate to do so.
The Red Flags Rule requires financial institutions and creditors to develop and implement programs to identify, detect, and respond to indications of identity theft. The rules apply to a wide set of businesses including retailers, hospitals, colleges, universities, and utilities.
Unfortunately, businesses have not stepped up to protect their customers, members or patients. Two weeks ago Identity Force released a report that warned of non-compliance in the hospital industry. The report, available at www.identityforce.com/redflagsrulesreport.pdf, revealed that over 80 percent of hospitals were not yet in compliance.
Identity theft and data breaches should be taken much more seriously by businesses and by the government. Data breaches are increasing exponentially, organized cybercrime networks are attacking computer systems daily, and every year millions of Americans become victims of identity theft. What more will it take before organizations do the right thing?
Forty-four states now have identity theft laws on the books, and the FTC eventually will enforce Red Flag Rules. However, regardless of the letter of the law, identity theft and data breaches are clearly inevitable in todayâ(TM)s society. Complying with new laws and regulations and protecting the public is not an option; it is a necessity for organizations that want to survive in our new economy. Businesses must take action or face significant financial risk and reputation damage.
Some organizations may feel that complying with the new rules and combating identity theft and data breaches is a complex and burdensome task. In reality it is not. Turn-key identity protection, compliance and data breach solutions are available for businesses that will immediately bring an organization in line with all state and federal laws. These solutions will also drive down risk, and have the potential to save businesses millions of dollars.
Executives and managers should not hem, haw, stall or delay any longer. When asked if they are prepared to do the right thing regarding identity theft protection, their answers should be one word â" âoeYes.â
Steven Bearak is the CEO of Identity Force. For more information, visit www.identityforce.com/ProtectBusiness.php.