On December 4, 2018, the Federal Trade Commission (“FTC”) announced that it is seeking comment on whether to change the “Red Flags Rule” and the “Card Issuers Rule” (the identity theft rules codified at 16 CFR Part 681) as part of the FTC’s systematic review of all of its current regulations and guides.

The Red Flags Rule requires financial institutions and some creditors to establish written identity theft prevention programs to detect, prevent and mitigate identity theft.  The Card Issuers Rule requires debit or credit card issuers to establish policies and procedures to assess the validity of change of address requests if, shortly after receiving such a request, the issuer also receives a request for an additional or replacement card for the same account.  The Card Issuers Rule also bars card issuers from issuing additional or replacement cards until it notifies the cardholder of the request or otherwise assesses the validity of the address change.

The Red Flags Rule and the Card Issuers Rule were first published by the FTC in November 2007, pursuant to the Fair and Accurate Credit Transactions Act (“FACTA”) enacted in December 2003.  FACTA required the FTC and other federal agencies to establish and maintain guidelines for financial institutions and creditors to identify patterns, practices and activities that might indicate identity theft; prescribe regulations requiring financial institutions and creditors to establish reasonable policies and procedures for implementing the established guidelines; and prescribe regulations requiring debit and credit card issuers to validate notifications of changes of address under certain situations.

The FTC seeks comment on a number of issues relating to the Red Flags Rule and Card Issuers Rule, including, among others: the need for the rules; benefits that the rules provide to consumers and businesses; costs that the rules impose on consumers; modifications that would increase benefits or reduce costs; the level of industry compliance with the rules; and whether there are types of creditors that should be but are not currently subject to the Red Flags Rule.

The deadline for submitting comments is February 11, 2019. The text of the FTC Federal Register Notice, which includes instructions for submitting comments, is available here.