Subscriber Login

Q: Under FACTA’s Red Flags Rule, is my business required to use an identity verification scan to verify and authenticate my customer’s actual identity?

A: While the Red Flags Rule doesn’t come right out and say ID verification scans are required when opening a new covered account, one must first look at the main purpose for the Rule’s existence... the prevention of identity theft. The definition of a “red flag” is at best ,vague, and requires interpretation by your staff member trying to detect a “red flag” within the identifying information presented – in other words, a guess. Unfortunately, what one staff member views as a red flag, another staffer may not. Just one simple misinterpretation (guess) by one of your staff could lead to federal involvement and possible civil litigation.

Q: Our business is paying extra for our credit bureau to perform a scan to verify the identity of our customers. Are these scans compliant with the Rule, and are we getting our money’s worth?

A: Not even close; they are two distinct processes that go hand in hand with identity theft prevention. Verification under the Rule means to verify the identity information presented by an individual. An example would be making a copy or simply checking an individual’s driver’s license, which in and of itself, is not compliant with the Red Flags Rule. In today’s world where documentation can be forged with incredible accuracy and any teenager with a computer can get to someone’s personal information, additional steps must be taken beyond the verification of data to prevent fraud.

For instance, the individual physically in your place of business may actually be an identity thief presenting you with stolen identity information, thus you are only verifying stolen information exposing your business to liability.

Authentication means the act of ensuring that the person presenting the information , is in fact, whom they represent themselves to be. To that end, the Rule suggests that businesses form “Challenge Questions” framed in such a manner that only the person whose identity is in question, can answer correctly.

Here’s the catch. The Red Flags Rule mandates that these questions cannot be formed from, “...information contained in a consumer credit report, or information generally contained in a wallet.”

In other words, simply looking over a credit report and asking the consumer where they have their car financed is not compliant. Hence, another reason to consider a reputable identity verification scan which makes Challenge Questions available, although usually for an additional cost.

Q: Our business is paying extra for our credit bureau to perform a scan to verify the identity of our customers. Are these scans compliant with the Rule, and are we getting our money’s worth?

A: We, like you, can only guess. However, it appears that some CRA’s do nothing more than take the information your business obtained from the individual, and cross-check it against the information on the credit report on file for that individual. If it matches, they then give you the thumbs-up on your customer.

We’ll let you decide if that’s compliant. And by the way, most CRA’s will not provide you with Challenge Questions, and if they do, check to see if the Challenge Questions concern information on the credit report. If so, they are not compliant.

A true identity verification scan searches across hundreds, if not thousands, of data sources such as all SSN Verifications Services, SSN Death Master File, state and national data and real estate bases to confirm DOB, all known previous addresses, telephone number assignment, OFAC, Interpol, and sex offenders lists, etc.

And as far as getting your money’s worth, businesses end up wasting a lot of money because most credit bureaus charge for the scan every time you obtain an individual’s credit report. Unfortunately, many consumers may not qualify for credit to finance your product or services, say a car or a home.

To that end, it only makes good business sense to perform an identity scan on an individual when it’s apparent they qualify for credit you have arranged - not just because you’re checking their credit.

Therefore, you’ll have to be the judge if you are getting your money’s worth with your CRA.