L. 108–159 (text) (PDF)) is a U.S. federal law, passed by the United States Congress on November 22, 2003,[1] and signed by President George W. Bush on December 4, 2003,[2] as an amendment to the Fair Credit Reporting Act.
Financial institutions faced a mandatory deadline of November 1, 2008, to comply with the Red Flags Rule,[10] section 114 and 315 of the Fair and Accurate Credit Transactions (FACT) Act.
However, due to widespread confusion over coverage under the act, specifically whether the term "creditor" applies to particular businesses, members of Congress repeatedly requested that FTC postpone the deadline for compliance with Section 315 until after December 31, 2010.
This significantly expands the definition to include all companies, regardless of size, that maintain, or otherwise possess, consumer information for a business purpose.
Finally, the section requires the Federal Trade Commission to set up a means by which consumers can contact the reporting agencies and creditors with a complaint involving identity theft or fraud.
However, according to U.S. Pirg, "[w]ith the FACT Act, the financial industry won its primary goal: permanent preemption of stronger state credit and privacy laws.
[20] An article dated March 13, 2005 and published in the Washington Post stated that while "[r]esidents of six East Coast states—Maryland, Georgia, Maine, Massachusetts, New Jersey and Vermont—are already eligible for free reports from all three agencies as a result of state laws", the phone numbers provided to request these reports connected to automated systems that the article described as "maddening in their complexity and unforgiving if your circumstances vary from the system's programming."
Furthermore, the article criticised automated systems for forcing consumers to "navigate a thicket of recorded information -- including sales pitches for their products, such as a credit 'score' (an evaluation of your creditworthiness) or a 'monitoring' service to help guard against identity theft".
As the Red Flag rule widely defines creditors, many businesses (such as utilities)[21] are now required to collect personal information (such as SSN and driver's license numbers) that they do not need and have no use for.
This policy is precisely contrary to the FTC's advice to consumers that they should disclose their social security number to companies only when absolutely necessary.
The Act prohibits merchants from including credit- and debit-card expiration dates on electronically printed receipts.