If the rule applies, what do I have to do? The FTC has provided an easy online PDF form to help "low-risk" businesses take the necessary steps at http://www.ftc.gov. This is essentially a blank piece of electronic paper, containing the following headings:

The red flags we have identified
How we'll detect the red flags we have identified
How we'll respond to the red flags we have identified
Our Program has been approved by ___ (board of directors, board committee, or senior manager)
The person who will administer our Program is ___
Categories of employees we'll train and how we'll provide training
Service providers we'll contact about complying with the Red Flags Rule," and
How we'll keep our Program current.

You're kidding, right? No, that is really what the form says. It does not say what a red flag is, what possible responses are, or who should do the training. It does convey the essential idea that "creditors" must identify red flag events, detect when they occur, have a response plan in place, get senior approval for the plan, conduct training and communicate with vendors, and regularly update the plan. That last sentence pretty well sums up the 59 densely worded pages of the Federal Register where the red flags rule lives, plus the simplified, 22 megabyte booklet (Fighting Fraud With The Red Flags Rule, A How-To Guide for Business). The good news is it's fairly easy to prepare your red flags plan, and by doing so you'll be able to say, "Here it is," when you are the victim of a data breach and the FBI asks you for your red flags document. Otherwise, the FBI agent likely will communicate with FTC and you will likely be in the penalty box.

Special Reports /

Avoiding E&O- Red flags mean danger ahead

Related Stories

Recommended For You