Share this Article
Identity theft is an issue that all merchants should worry about, but in the collection industry, it is of even greater concern. An improperly handled claim of identity theft can damage a consumer’s credit score and sometimes take years to correct. Not only this, but you and your clients may be accused of unsafe practices that can damage or even end your agency as well as tarnish the reputations of the clients you collect for.
The CAC’s Collection Boot Camp panel, Kelly Parsons-O’Brien, Shawn Suhr, June Coleman and Courtney Reynaud, understand the serious toll ignoring the signs of identity theft can take. That’s why they addressed the red flag rule and best practices for investigation that can keep your business informed and your consumers safe.
The red flags rule is dictated by the Federal Trade Commission (FTC) in an effort to curb identity theft. Merchants (especially those who routinely use credit reporting in their business) are obligated to keep consumers safe. This can be done by creating policies and procedures which outline how to identify the signs of identity theft, what actions to take when these signs occur, and how to keep your agency’s red flag system current. Clarification of these rules was discussed on insideARM in 2011.
CFPB Proposed Rules for The Red Flag Rule
The CFPB has also weighed in on how these red flags take shape within the collection industry. They recently proposed new rules regarding what investigations/documentation will be required when instances of suspected identity theft occur. Keep in mind that while the CFPB has issued their red flags ruling, they have not yet enforced it. There is still some question whether the legislature will allow this ruling to stand.
Although these red flag rules are not yet in effect, Coleman feels they are helpful to agencies in understanding and identifying red flags within the industry, and knowing how they can be addressed. Here’s a look at what the CFPB has proposed regarding the red flags rule in collection:
Warning Signs of Identity Theft:
- A dispute filed by a consumer.
- The inability to obtain underlying documents in response to a dispute.
- Receiving disputes for a significant percentage of debt in a portfolio. This can either be a large, absolute amount of debt, or considered large relative to other portfolios with similar accounts.
If Red Flags Arise During the Course of Collections:
- Obtain additional support prior to making subsequent claims.
- Remember your agency is responsible for warning signs you have or should have detected.
If a Red Flag Occurs Because of a Dispute:
- Written – Collectors should provide relevant documentation regarding the dispute. This dispute type is expected to prompt a more thorough investigation.
- Oral or Non-Timely – Collectors should review this information to establish reasonable support for debt. This type of dispute is still important to investigate, but may not be considered to carry the same weight as a written dispute.
Safe Harbor for Investigating Red Flags
The CFPB has also proposed a ‘safe harbor’ for those investigating red flags. Obtaining the documents below is not required during your investigation, but your agency is much more likely to be found compliant for relying on the creditor’s representations if you do.
Documentation to Provide or Review:
- A combination of:
- A charge-off statement
- The most recent billing or periodic statement. and/or
- A contract, note, application, or service agreement
- Underlying agreement describing the applicable interest rate or fees or copy of billing or periodic statement covering specified time period.
- One of the following:
- Copy of credit application
- new patient form
- document reflecting information gathered from creditor and a copy of the contract, note, application, or service agreement. and/or
- A copy of the bill of sale or assignment of the debt.
Information Which Should be Forwarded from Clients:
- Payments submitted by the consumer.
- Bankruptcy discharge notices.
- Identity theft reports.
- Any claim by consumer that income and assets are exempt from garnishment.
Red Flag Letters You Will Need
Parsons-O’Brien suggests maintaining several form letters you can have pre-created to save time in responding during red flags investigations.
- Deficient letter to consumer – This is a letter you would send to a debtor who has provided your agency with information in order to prove identity theft occurred (which led to the debt in question). If the information the consumer sends to your agency is deficient, you must send them a notice informing them this is the case.
- Consumer release letter – This letter notifies the consumer in question that your agency has released them.
- Client Letter notifying client that account is cancelled – This letter notifies your client of a cancelled account. Understandably, clients dislike seeing accounts cancelled because this translates into lost revenue when they end up not receiving payment for services they provided, even if services were obtained through fraudulent activity. It is important that your agency educates your clients about the public relations and legal risks of ignoring possible identity theft of consumers. This education on red flags issues will ensure there is no damage to your relationship when they receive these notices.
- Consumer letter for no documents – This letter notifies a consumer that you have not received any documents from them, and cannot begin investigating until they have provided said documents.
- Consumer still liable letter – If after your investigation, you still believe the consumer is liable, you must notify them of this finding. Coleman urges to provide detailed reasoning behind your decision. Make sure the specifics provided are accurate, as they may be contested.
Red Flag Policy – Is Yours Complete?
As with every process within your office, you must have a complete and up-to-date policy for how to address red flags. See our previous article on compliance management to learn how to create and update office policies and procedures. Here is a sample red flag policy which outlines the basics of how a California agency might decide to handle their red flags.
Scope: Red Flag Rules responsibilities (Civil Code 1788.18)
All ID Theft claims received by ABC Company will follow this policy, including those received directly from the consumer and those received through E-Oscar.
This policy is to ensure that all written claims of ID Theft are handled within 10 days of receipt. ABC Company’s policy is to thoroughly investigate all claims of ID Theft in an effort to protect victims of Identity Theft Responsibilities.
Our Red Flag Policy is reviewed annually and updated as needed. Any changes to the policy are to be made by the Compliance Manager.
California Red Flag Rules
Each state will have individual rules regarding red flags rules for identity theft. Because the Boot Camp panel is headquartered in California, they discussed a few rules specific to that state.
- When a consumer claims identity theft, a debt collector shall send notice of its determination to the debtor no later than 10 business days after concluding the review.
- If the debt collector has furnished adverse information to a credit reporting agency, the debt collector shall notify the credit reporting agency to delete the information no later than 10 business days after making its determination.
Be aware that these rules apply to the state in which a consumer lives, not the state where your business is located. If you are collecting across state lines, it is important to understand what is expected of your agency in each place you collect.
Download a best practices guide addressing red flags in collections: