What action should an organization take upon identifying red flags in consumer information?

• A. Detect and respond to identity theft
• B. Ignore the flag
• C. Notify only customers
• D. Delete the data

Answer: (A)

Red flags signal potential identity theft, so the right action is to detect and respond to identity theft. Under the Red Flags Rule, organizations must have an identity theft prevention program that not only identifies warning signs but also lays out steps to address them promptly. Responding means more than just noticing the flag: verify the activity, monitor for additional suspicious behavior, and take appropriate remediation steps such as notifying affected individuals, placing fraud alerts, involving law enforcement or credit bureaus as needed, and adjusting controls to prevent recurrence. Ignoring the flag would leave consumers at risk, and deleting data or merely notifying customers without a broader containment plan wouldn’t adequately address the threat.