The Red Flags Rule
The Red Flags Rule requires financial institutions and creditors to maintain written identity-theft detection programs that spot and respond to red flags. The Red Flag Program Clarification Act of 2010 narrowed "creditor," excluding entities extending credit only for expenses incidental to a service.
The rule applies to financial institutions (all banks, savings and loans, credit unions, and others holding a consumer transaction account) and creditors. Confusion over who counted as a creditor delayed enforcement until a 2010 clarification.
The Red Flag Program Clarification Act of 2010 removed entities that extend credit only "for expenses incidental to a service" (e.g., doctors and attorneys who let clients pay later). The rule still covers those who, regularly and in business, use consumer reports for credit, furnish to CRAs for credit, or advance funds (beyond incidental expenses).
There is no fixed checklist; each organization must build its own red-flags list and update it. FTC examples include CRA alerts, suspicious identification documents, suspicious identifying data, and unusual account use.