I'm just beginning to GAP the new ID Theft Red Flags, and have a potential issue already.

The first four red flags require a financial institution to use information from a consumer reporting agency to detect, mitigate and prevent ID theft on covered accounts. We do not currently run our deposit account customers through a credit check, but these accounts will mostly be covered in our ID Theft Program. Will my bank need to begin pulling CRA info to be compliant on these deposit customers?

The rules do require you to use a CRA.

Thanks for the feedback ahou.

We do use Chex Systems, however given the specifics of these red flags I'm not sure that will be enough.

Do "most" banks already run deposit customers through a consumer report other than Chex Systems? Any other thoughts on this?

We will continue to use Chex Systems and will not pull a 'credit report' for deposit accounts. Doesn't Chex Systems alert you if what they have in their files is different than what you submit? I would think for your deposit accounts, your program should include how you will address those discrepancies in name/TIN mismatch, address discrepancy, etc. when notified from Chex Systems.

We do not and have no plans to begin obtaining credit reports for new deposit accounts. We use ChexSystems and run all new consumers through Lexis Nexis for identity verification. I don't think we'll be doing anything in addition to that.

That would be correct. The rules do not require the use of a CRA. The rules apply when you use a CRA.

I appreciate everyone's feedback -very helpful.

Do the ID Theft Red Flag rules still apply when you don't pull a credit report? While you may not have address discrepancies, fraud alerts, or other alerts from a CRA, you may still have forged documents and other red flags when opening "covered" deposit accounts.

Yes, you need an Identity Theft Prevention Program for all covered accounts, and consumer deposit accounts are covered accounts.

Is anyone going to Beef up their Identity Theft Program with the Red Flags, or make a whole new program just for them?

I have a few questions about Chex Systems reports and hope someone can answer them for me. They pertain to the first 4 red flags.

1. Does it provide a fraud alert or active duty alert?

2. Does it provide an notice of credit freeze?

3. Does it provide a notice of address discrepancy?

4. Does it provide enough information to determine a pattern of active inconsistent with what is normal for a customer?

Thank you for your help.

We are currently working on a Identity Theft Program. We have a task force that is currently woirking on risk assessments, then we will review current procedures. We will use our current procedures as a base, then add the red flags and procedures etc. We will then present the program to the Board of Directors, train and implement the program.