How does a property management business comply with the FTC Red Flags Rule?

Identity theft has become a multi-million dollar business, causing many people both financial and emotional harm. There are endless stories of credit card theft, credit card rings, and financial fraud. These problems led to the creation of the “Red Flags Rule” by the FTC.

The FTC defines “Identity Theft” as a fraud committed or attempted using the identifying information of another person without authority.[i]

Originally, Congress passed the Fair and Accurate Credit Transactions Act (FACTA) in 2003 to develop rules and guidelines for detection, prevention, and mitigation of identity theft for financial institutions and creditors. Then, the Fair Trade Commission (FTC) created the “Red Flags Rule” for businesses in 2007 and imposed active enforcement November 1, 2009. This rule requires that business have a written Identify Theft Prevention Program to detect the warning signs or “red flags” of identity theft in daily operations.

The FTC has defined “red flags” as suspicious patterns or practices, or specific activities that indicate the possibility of identity theft. [ii]

The Red Flags Rule applies to “financial institutions” and “creditors.” It may seem, at first glance, that property management companies are not subject to this rule because they are not a financial institution or a credit card company. However, when you read the definition of creditor in the ruling, it covers a very broad area and the information makes it clear that Property Management companies do fall under the Red Flags Rule.

The FTC defines “identifying information” as “any name or number that may be used, alone or in conjunction with any other information, to identify a specific person, including, but not limited to: name, social security number, date of birth, official state or government driver’s license or identification number, alien registration number, government passport number, employer or taxpayer identification number. [iii]

There have been many cases of property managers renting to tenants with false information. Now many companies take credit cards and use ACH transactions for rental payments. In addition, companies require owners to supply social security numbers and/or tax ID so that they can file 1099 statements with the Internal Revenue Service. If you look around your office, you will find a lot of “identifying information” that can be stolen.

How do you comply? The FTC requires four steps to comply with this ruling.

1. Identify relevant red flags
2. Detect red flags
3. Prevent and mitigate identity theft
4. Update your program periodically

It may seem this is just another policy to maintain but you can choose the glass half-empty or half-full attitude. If your glass is half-empty, you can ignore the ruling as another government requirement. If you choose to have a glass half-full, you can use this document to train your Personnel to avoid the painful complications and legal issues connected with identity theft, a benefit for your business. Finding out that your new tenant provided false information is not only embarrassing but can be very expensive as well.

Currently, there are no criminal penalties for failing to comply with the Red Flags Rule; however, you could be subject to civil monetary penalties. It is simply good business to comply and shows your clients that you are providing care for their information and/or properties.

The Federal Trade Commission provides business owners with a helpful publication, Fighting Fraud with the Red Flags Rule, a How-to Guide for Business. There is of course, more to the rule than in this article and you can print out this document and review it.

LandlordSource has developed a Red Flags Rule Office Policy available for Property Managers at a very reasonable cost. Why reinvent the wheel when you are busy – with our help, you can implement a Red Flags Rule policy quickly and easily.