Saturday, Sep. 27, 2008

Businesses prep for new ID theft rules

On the street, they're called con men and pickpockets. On the Internet, they're called phishers and spammers. And whether they're pilfering from mailboxes or inboxes, or looting businesses big or small, they're often as interested in your identity as your money - a trend prompting the federal government to require that financial institutions and creditors implement written identity-theft prevention plans by Nov. 1.

But industry experts say the Federal Trade Commission's mandate, called the Red Flags Rules, extends far beyond bank walls - to any business that offers customers time-payment plans like independent dentists and small-town furniture stores.

These same experts say there's widespread confusion about the rules, potentially putting mom and pops at risk for costly civil suits. Violators can be fined up to $2,500.

Locally, many in the financial-services industry say they're ready for the FTC's November deadline, and have been ramping up identity theft-prevention efforts for some time.

Charles G. Brown III, chairman and chief executive officer of Insignia Bank, said the Sarasota-based company is going to use software to detect tell-tale signs of identity theft.

Brown said the bank is subscribing to the LexisNexis database, which points out inconsistencies between an individual's loan application and credit report - like extra charge cards or anomalous addresses.

LexisNexis, he said, can also indicate whether an applicant has appeared in media reports in the past, providing the bank clues of past criminal or financial misdeeds.

"It's the right thing to do," he said. "It helps them avoid loss."

Brown said the plan's implementation is going to cost in the tens of thousands, mainly because of the LexisNexis subscription. The rest of the costs are in staff hours, he said.

Anne Lee, First Bank Florida retail banking president, said part of the company's plan is to educate the public about identity theft.

There's a Web page on the bank's Web site about identity theft, she said, and a posting on the company's intranet details how to counsel customers about the issue.

First Bank has conducted 14 seminars on the topic since January, Lee said, and is offering the program to groups upon request. And in March, she said, First Bank included a pamphlet on the topic with mailed bank statements.

"We think it's that important," she said.

Car dealerships in the area are also gearing up for the looming deadline.

Matt Woods, Honda Cars of Bradenton general manager, said the dealership's parent company sent him and other subsidiaries a 58-page manual as a guide for local policies.

One method to prevent identity theft is using challenge questions - questions employees ask potential customers when identifying information doesn't add up.

Woods is considering hiring an additional employee specifically trained to handle Red Flags compliance.

"This is going to put additional burdens on the finance department," he said. "This is a big task, here. This is no small undertaking."

Chuck Shields, business director of Red Hoagland Pontiac-GMC, said the dealership has been compliant with the rules for some time, preventing identity theft by not releasing customers' information to third parties, for example.

What's clear for banks and car dealerships, however, might not be for small businesses that offer time payment plans, called "closed accounts" in the financial world, said Ed Goodman, general counsel for identity management consultant Identity Theft 911.

"The reality is that most other businesses are not as far as knowing that this really applies to them," he said.

Jay Foley, executive director of the Identity Theft Resource Center in California, said that the FTC probably isn't going to seek out small businesses, but that consumer-action lawyers might be able to sue if customers' identity is stolen.

"Mom and pop have to realize that the FTC is not the only party out there that's not going to be looking at these laws and rules," Foley said. "Anybody who's in the realm of granting credit should be checking the rules."

Frank Dorman, FTC spokesman, said the commission is going to check businesses if there's a high chance of fraud or identity theft.

"It's not like anybody's going to go walking in their door and say: 'Show me your program,' " he said.