Who must implement a Red Flags Identity Theft Prevention Program?

• A. Only large banks.
• B. Government agencies only.
• C. Retail merchants with no credit accounts.
• D. Financial institutions, creditors with covered accounts, and certain service providers acting on their behalf.

Answer: (D)

The rule targets the entities most likely to create or access consumer account information that could be misused for identity theft. Financial institutions and creditors with covered accounts are required to have a written Red Flags Identity Theft Prevention Program, designed to detect, prevent, and mitigate identity theft. Covered accounts are those that allow multiple payments or extended credit to a consumer, such as banks, credit unions, credit card issuers, and lenders that open or maintain such accounts. In addition, certain service providers that handle covered account information on behalf of these institutions must also implement the program or operate under contracts that require them to follow it. This combination ensures both the institutions themselves and the third parties they rely on are prepared to spot warning signs (red flags) and respond appropriately. Government agencies aren’t subject to this rule, and a retail merchant with no credit accounts wouldn’t be required to implement the program. That broader inclusion is why the correct answer is the comprehensive group: financial institutions, creditors with covered accounts, and related service providers acting on their behalf.