By Adam Elliott
Sept. 25, 2008
CUES' Credit Union Management's Web-only "On Compliance" column runs the fourth Thursday of every month.
Q. What are the FACT Act Red Flag rules?
A. Section 114 of the FACT Act requires financial institutions and creditors to establish a written identity theft prevention program designed to "detect, prevent and mitigate identity theft in connection with existing accounts, and the opening of new accounts."
Additionally, section 114(B) requires issuers of credit and debit cards to verify the validity of a change-of-address request matched with requests for additional or replacement cards.
Section 315 deals with identity theft in the new account environment, specifically when there is a discrepancy between the consumer address on an application and the address held on file by the credit bureau.
Because identity thieves commonly attempt to open new credit accounts at a different address than where their victim resides, Section 315 requires that a creditor first must form a reasonable belief of "true identity" when they observe an address mismatch between the application and what is on record with the bureau.
Q. What kinds of concerns are financial institutions and creditors expressing about the FACT Act?
A. Now that the Office of Thrift Supervision has unveiled its FACT Act Red Flags examination procedures, financial institutions are getting the first concrete look at what can be expected during an examination. With roughly a month to go before the Nov. 1 compliance deadline, many financial institutions are realizing that they need to expedite implementation of the necessary policies and procedures. Many of the institutions we've been talking with have been counting on some flexibility in the degree to which they comply with the deadline, but based on the OTS examination procedures, Nov. 1 means Nov. 1. OTS audit requirements state that Board of Director meeting minutes prior to Nov. 1 must indicate a board's approval of the financial institution's FACT Act compliance program. This likely means that all system changes, policies, procedures and training programs must also be in place by the deadline.
Realizing that the Nov. 1 compliance date is just around the corner, many teams are putting the finishing touches on their FACT Act compliance programs. Over the past several months, they've been addressing several concerns, including:
Q. Which compliance approaches are organizations considering?
A. Compliance solutions can be based on any of the three verification options outlined by the FACT Act:
Option 1: Notify the cardholder of the request at the former (or "from") address and provide a means of promptly reporting an incorrect (or fraudulent) address change.
Cardholder notification via U.S. mail is already being performed as a fraud-control practice by some card issuers. However, very few issuers wait for the customer to receive the notification letter and report back an unauthorized change of address. Instead, they go ahead and issue an additional or replacement card immediately, to maximize the number of active cards in circulation.
Per FACT Act section 114(B), any customer notification must be sent in a "clear and conspicuous" manner, and provide the cardholder with means to "promptly report an incorrect address." Given these requirements, a financial institution or credit issuer opting to comply with customer notifications via U.S. Mail will not be able to issue a new card to the customer immediately - and will likely need to wait several days for a letter to be created, sent, received and responded to.
With the letter-mailing strategy, profitability, customer satisfaction and operational efficiency can suffer. Consider that it could cost at least $2 to send each address-verification letter. This estimate includes both fixed costs, such as postage and materials, as well as the soft-dollar costs, like employee initiation and follow-up. When the issuer considers potential volume, these costs can quickly become overwhelming.
Additionally, the letter-mailing strategy is slow. Some financial institutions and card issuers may need one to three days to discover the link between an address change and card request. After that, they may need another day or two to produce the letter. The U.S. Postal Service also needs a few days. Then there's the problem of confirming notification? Will a signature approach be required, e.g. registered mail? And what about cardholders who happened to be out of town when the letter arrives? Before you know it, the unhappy cardholder has been without a card for a week or more. U.S. consumers are dependent on payment cards, so this is a long time to wait.
Expedited delivery of credit and debit cards to the consumer is a widely accepted practice for card issuers. These expedited card-delivery programs provide an important service to the customer, while driving transaction volume to the issuer. With the new requirements of FACT Act 114(B), customer mail notification and expedited card delivery programs cannot co-exist, resulting in lost revenue opportunities and damaged customer service.
Alternatively, a card issuer could opt to send mail to all customers requesting address changes at the time of request, alleviating the need to match a subsequent card request. While this strategy relieves some of the fixed overhead involved with building systems to match the two events, it would multiply the cost of materials, postage and staff time several times over.
Option 2: Notify the cardholder of the address change request through other means of communication previously agreed to by the card issuer and cardholder, such as e-mail.
Even as our society becomes more comfortable with digital and wireless communication, the physical address is still the primary communication link between cardholders and issuers. When cardholders select an electronic or wireless method of communication with their financial institution or credit issuer, complying with the measures of FACT Act 114(B) presents challenges.
With e-mail, for instance, the biggest challenge is overcoming the requirement to ensure that the message provides a "clear and conspicuous" notification, as required by FACT Act. Because of the proliferation of e-mail phishing scams, it may be very difficult for cardholders to discern between legitimate e-mail notifications coming from their issuer, and a fraudulent one coming from a scammer. There is also the risk that a genuine e-mail from the issuer will not get through to the cardholder. It is very difficult for today's e-mail filters and screening mechanisms to segregate legitimate financial institution correspondence from fraudulent activity. Oftentimes, critically important, legitimate messages coming from a financial services company end up in the recipient's "junk" folder.
Reaching cardholders by phone can also be problematic. There is the issuer's cost of making the call, but more important is the fact that many consumers don't trust unsolicited calls from financial institutions or credit issuers. Careful consumers will not discuss their personal information during a phone call that was not self-initiated.
Option 3: Use automated means to assess the validity of the address change, in accordance with reasonable policies and procedures.
This option allows the most flexibility to card issuers, and opens the door to the easiest, most effective method for compliance: an automated solution. ID Insight data has shown that the most effective strategy for Red Flag compliance is to verify each address change as it happens. Making address verification part of standard operating procedure ensures credit and debit card issuers can respond immediately to requests for cards, as well as additional products and services, as soon as the customer asks. Not only does this improve customer service, but it can also improve revenue.
To significantly reduce investigational time and expense, issuers looking at automated address change verification solutions should see one that answers the fundamental question: "Does this address change make sense?"
An automated solution that compares the old address with the new one can answer this very question for credit and debit card issuers. For example, the creditor would be alerted to the fact that very profitable and long-time customer "John Smith" has suddenly moved from his own 3,000-square-foot home in suburbia to a vacant lot in an urban area 500 miles away. This requires a system that compares billions of data elements from the old address with billions of data elements from the new one. Using this methodology could reduce manual reviews to approximately 5 percent. Also, with all the focus on "going green," moving to a paperless, automated solution can achieve green objectives and be touted as such to customers (i.e. conserving paper and ink, reducing mailing and therefore conserving fuel, and reducing the amount of waste added to landfills).
Performing automated address verification can be cost effective. It can happen behind the scenes, and with no manual intervention. And, as electronic transactions, verifications are completed in less than a second, and can cost as little as $3 per day.
Adam Elliott is president of Minnesota-based ID Insight, the innovator in using access-point intelligence to reduce fraud. Reach him at 877.749.8731
About ID Insight
ID Insight, the innovator in Access-Point Intelligence, knows more about people and their access points — physical addresses, phone numbers and other points where fraud occurs — than any other identity-fraud risk-assessment company. Based in Northfield, Minn., the company combines its massive collection of data on people and access points with patent-pending analytics to help companies prevent fraud, reduce costs and capture more business. ID Insight provides next-generation verification, authentication, and fraud solutions to financial services companies, credit issuers, retailers, online merchants and wireless providers nationwide. For more information, visit www.idinsight.com.
# # #