Identity Theft Prevention: How to Catch a Thief

Jonathan Foxx, PhD, MBA

Chairman & Managing Director

Here are four scenarios involving identity theft that mortgage originators encounter from time to time. Read them and then keep them in mind as I discuss how to ask for additional information in order to prevent identity theft.

1.       A law enforcement report containing detailed information about the identity theft and the signature, badge number, or other identification information of the individual law enforcement official taking the report should be sufficient on face value to support a victim’s request.

Question: Without an identifiable concern, such as an indication that the report was fraudulent, would it be reasonable for an information furnisher or Consumer Reporting Agency (CRA) to request additional information or documentation?

Answer: It would not be reasonable.

2.       A consumer might provide a law enforcement report similar to the above report, but certain important information such as the consumer’s date of birth or Social Security number may be missing because the consumer chose not to provide it.

Question: The information furnisher or CRA could accept this report, but would it be reasonable to require that the consumer provide the missing information?

Answer: It would be reasonable.

3.       A consumer might provide a law enforcement report generated by an automated system with a simple allegation that an identity theft occurred to support a request for a tradeline block or cessation of information furnishing.

Question: Would it be reasonable for an information furnisher or CRA to ask that the consumer fill out and have notarized the Commission’s ID Theft Affidavit or a similar form and provide some form of identification documentation?

Answer: It would be reasonable.

4.       A consumer might provide a law enforcement report generated by an automated system with a simple allegation that an identity theft occurred to support a request for an extended fraud alert.

Question: Would it be reasonable for a consumer reporting agency to require additional documentation or information, such as a notarized affidavit?

Answer: It would not be reasonable.

In these scenarios, a financial institution should be responsive in accordance with certain guidelines. Specificity of action must be appropriate, reasonable and proportional to the challenge. However, total reliance on the CRA is inappropriate.

Red Flags Rule: Deadline - This time they really mean it!

At the request of Congress, the Federal Trade Commission delayed enforcement of the "Red Flags" Rule through December 31, 2010.

We notified you of this deadline on June 3, 2010.

The FTC's Enforcement Policy Statement did not affect other federal agencies' enforcement of the original November 1, 2008 deadline for institutions subject to their oversight to be in compliance.

For those who have not been following the long timeframe to the deadline at the end of this month, the Red Flags Rule became effective on January 1, 2008, with full compliance for all covered entities originally required by November 1, 2008. The Commission issued several Enforcement Policies delaying enforcement of the Rule. Most recently, the Commission announced in October 2009 that at the request of certain members of Congress, it was delaying enforcement of the Rule until June 1, 2010, to allow Congress time to finalize legislation that would limit the scope of business covered by the Rule.

The Commission then received another request from Congress for another delay in enforcement of the Rule beyond June 1, 2010. In response, the Commission extended the stay through December 31, 2010.

The Commission continually urged Congress to pass legislation that will resolve any questions as to which entities are covered by the Rule, thereby obviating the need for further enforcement delays.

Barring Congress passing legislation limiting the scope of the Red Flags Rule with an effective date earlier than December 31, 2010, the Commission will begin enforcement as of that effective date.

Effective Date: December 31, 2010

Call to Action -

Time is Running Out!

Mortgage Loan Originators (Brokers, Lenders, "Creditors")

Implement immediately an Identity Theft Prevention Program, Red Flags Rule, and Customer Identification Program.

(1) The FTC provides information about designing and implementing some of these programs. FTC Red Flags website.

(2) There are many vendors that provide them for relatively low cost.

(3) Lenders Compliance Group provides the Identity Theft Prevention Program - Policies and Procedures - Red Flags Rule and Address Discrepancies, a low cost, comprehensive, easy to implement program that incorporates all three of the aforementioned areas.

Investors, Wholesale and Correspondent Lenders, Servicers, "Creditors"

You are not exempt from the proper due diligence to ensure that you are doing business with entities that are compliant with the Red Flags Rule! It should be part of your year-end updates and clients approval procedures to require some form of certification that your clients have actually implemented the statutory requirements.

(1) Develop a certification or attestation to be signed by the covered entities with which you conduct business.

(2) Lenders Compliance Group has developed a one-page Identity Theft Prevention Certification expressly for this purpose. We will offer this important Certification to you free as a courtesy. Please email your request to Jonathan Foxx, our Managing Director.

Visit Library for Issuances

Identity Theft Prevention and Red Flags Rule

LENDERS COMPLIANCE GROUP is the first full-service, mortgage risk management firm in the country, specializing exclusively in mortgage compliance and offering a full suite of hands-on and automated services in residential mortgage banking.