FTC Delays Identity Theft Rule Yet Again 44
coondoggie sends news that the FTC, at the request of several members of Congress, has delayed enforcement of anti-ID-theft rules — for the fourth time since the original implementation date, November 2008. "The [Red Flags] rule requires financial institutions and other creditors to develop and carry out identity-theft prevention programs. ... The problem with the rule revolves around which entities must comply and develop identity-theft prevention programs. ... 'It's the act of delaying payment for services that can sweep in entities you wouldn't normally think of as creditors,' Kuehn said. Already, the American Bar Association, the American Medical Association, and the American Institute of Certified Public Accountants have sued, saying that the Red Flags Rule shouldn't apply to their members."
FDIC is looking (Score:2, Interesting)
I know in our last safety and soundness exam the FDIC looked over our Red Flags program. I'm not saying that is where they spent the majority of their time by any means, though. Right now all the banks are getting hammered on asset quality. The regulatory bodies have written so many MOUs they're having a hard time keeping up.
Re:ok... (Score:5, Interesting)
And at the end of the day, it's all about what costs more/less money where these financial institutions are concerned. If new "red flag" procedures and checks for ID theft cost a bank $25 million per year, and their actuaries tell them they only suffer $10 million per year in ID-theft-related losses, then it's not in their interests to put those "red flag" measures in place.
The human cost to their customers (lost time, mental anguish, etc.) of an incident carries absolutely no weight in their thinking. It's all about the bottom line.
Re:Bad idea in the first place (Score:5, Interesting)
Especially when there are already laws against the behavior in question and these laws already put the onus on the companies. (This isn't original to me, but I'm too lazy to look up the original reference.)
It works like this: If Person A pretends to be me and gets something without paying for it, that's fraud, not "ID theft." But with fraud, I'm not the victim, whoever accepted the fraudulent credentials is.
Over the last 15 years we've seen a new crime called, "ID theft" wherein the victim is no longer the entity with the power to impede the crime, the victim is a third party. That way credit-granting agencies can ignore the warning signs, and then bill the wrong person for the transaction.
If we stopped talking about "ID theft" and just went back to fraud, the companies would already have the motivation to tighten their ID checks.
Re:ok... (Score:5, Interesting)
I agree, but I don't trust politicians to get it done right.
Credit (Equifax...) rating companies, credit card companies, Bank/Loan Sharks... are the one that validate false/stolen IDs. I have always thought the should be the first sued by ID theft victims.
Stupid and confusing (Score:4, Interesting)
There are two entirely different things that are both lumped together as "Identity Theft".
The first one is where someone manages to get a bank or loan company to give them credit based on false credentials. You wake up one morning and discover that you owe lots of people you never even heard of, perhaps as much as a year after the loan was given. This is big trouble, because your success depends on convincing the originator of the loan that they made a mistake. It can take years to clean this up and plenty of money. Fortunately, it is extremely rare.
The second sort of "Identity Theft" is where someone "borrows" your credit card number. It is nothing more than credit card fraud and takes about 10 minutes to clear up. It personally happens to me at least once a year. I believe that many businesses end up selling credit card numbers one way or another, usually through employees looking for some extra income. A valid credit card number is worth maybe $2 on the open market, so if you collect of 50 of them you have yourself $100. Plenty of people could use an extra $100 a week.
Credit card fraud is so incredibly common that nearly all large stores have insurance to cover their losses. So they pretty much don't care when it happens - they file for insurance coverage and are reimbursed. The credit card companies do not care at all and pretty much refuse to even attempt to prosecute the people doing it because it looks bad. So the only loser in this is a small business that gets taken on a credit card sale and doesn't have the insurance that bigger stores have.
With a "no prosecution" stand, credit card fraud is about as rampant as it could possibly be. There are no consequences to doing it. If you walk in to a store and try to use a fraudulent credit card it might not validate - around 1960 they called the cops. Today they take the card and suggest you get lost. I suppose if you insisted they call the police they might, but you wouldn't be charged with anything like credit card fraud because nobody cares. Probably end up getting charged with making an ass of yourself in public.
Yes, I have had a physical credit card stolen and reported to the police. I knew who took it and who used it in a store (successfully, I might add), but the police wouldn't do a thing unless the credit card company wanted to press charges. They never do, so they guy got the stuff from the store and got away with it clean.