Recently, during the Q&A session following a speaking engagement, an attendee asked how other utilities handle online applications for service. Specifically, the question was about verifying photo ID, which led to a discussion of the Red Flags Rule. I was surprised how many people in the room weren’t familiar with the Red Flags Rule.
Do you remember the Red Flags Rule?
The Red Flags Rule was born out of the Fair and Accurate Credit Transactions Act (FACTA) of 2003. One of the key components of the rule is to fight identity theft. It’s probably best remembered because of all the delays and deadline extensions before it was finalized. Originally, it was scheduled to take effect on November 1, 2008. Finally, after three delays, it went into effect on January 1, 2011. You can read more about the Red Flags Rule on the FTC website.
A four-step process
Every utility should have a documented Red Flags Rule policy which has been adopted by your board. Complying with the Red Flags Rule is a four-step process. These four steps are:
- Identify Relevant Red Flags
- Detect Red Flags
- Prevent and Mitigate Identity Theft
- Update the Program
Let’s look at the four steps and what is involved for each step:
Identify relevant red flags
In the first step, identify the kinds of activities that should raise suspicion of fraudulent activity for your utility. This could be a photo ID that appears to have been altered or the name the applicant is trying to use doesn’t match the closing documents or lease agreement.
Detect red flags
Detecting red flags requires your customer service staff to keep a keen eye out for anything that falls under the red flags you identified in the first step. For example, does the name on the photo ID match the name on the application?
If the applicant is applying for service in person, does the photo on the ID match the applicant’s physical appearance? And if you allow customers to apply for service online or over the phone, how do you verify their photo ID?
Prevent and mitigate identity theft
This step defines what course of action your staff should take if they encounter a red flag. For example, if an applicant for service presents an altered photo ID, should they call law enforcement? Or should they merely deny service to the applicant? These are all decisions you need to make when formulating your Red Flags Rule policy.
Update the program
Finally, the final step is to update your Red Flags Rule policy as necessary. This could be due to new software or changes in technology. It could also be required if you are alerted to new scams being perpetuated by identity thieves.
Is your Red Flags Rule policy up-to-date?
If your utility need to update your Red Flags Rule policy, or simply create one, please give me a call at 919-673-4050 or e-mail me at gary@utilityinformationpipeline.com to find out how a business review could help you accomplish that.
© 2023 Gary Sanders