In response to the growing threat of identity theft, the United States Congress passed the Fair and Accurate Credit Transactions Act of 2003 (FACTA). On November 9, 2007, the Federal Trade Commission circulated the final rules, known as the “Red Flag” rules, which have an effective date of November 1, 2008 and an enforcement date of November 1, 2009 that has now been extended to December 31, 2010. These rules, implementing sections 114 and 315 of FACTA, require “financial institutions” and “creditors” with “covered accounts” to enact certain policies and procedures that would enable the institution to mitigate, identify, detect, and respond to patterns, practices, or specific activities—known as “red flags”—that could indicate identity theft.
Reason for the Policy: The policy is designed to detect, prevent and mitigate identity theft in connection with the opening of a covered account or an existing covered account and to provide for continued administration of an Identify Theft Detection Program. The Program shall include reasonable policies and procedures to:
- Identify relevant red flags for covered accounts it offers or maintains and incorporate those red flags into the program;
- Detect red flags that have been incorporated into the Program;
- Respond appropriately to any red flags that are detected to prevent and mitigate identity theft; and
- Ensure the Program is updated periodically to reflect changes in risks to Students and to the safety and soundness of the creditor from identity theft.
The program shall, as appropriate, incorporate existing policies and procedures that control reasonably foreseeable risks.
Colleges and Universities that participate in federal or institutional loan programs, or make available payment plans and/or promissory notes (extending credit), or who generate credit report inquiries for loans are considered “creditors” with “covered accounts” and are therefore subject to the Red Flag regulations.
The Red Flag Rule applies to Clark due to our participation in the Perkins Loan program, our institutional loan program, and our extension of credit for student accounts. Our analysis of the type and scope of activity covered in the regulation, and our risk assessment of potential identity theft opportunities has resulted in a determination that there is a low level risk of possible identity theft at Clark University.