Identity theft prevention program template, element by element

An identity theft prevention program template is the outline of the written program every bank needs under the Identity Theft Red Flags Rule: what accounts it covers, which red flags the bank watches for, how it detects them, how it responds, how it keeps the program current, who oversees it, how service providers are held to it, and who is trained. The regulators' own guidelines are the closest thing to an official template, and the eight sections below follow them. The difference between a program that passes an exam and one that does not is rarely the wording; it is whether each section is backed by evidence of the work. Botminds' New Account Fraud Detection produces much of that evidence for new accounts as a by-product of deciding them.

What should an identity theft prevention program include?

Four elements and four administration duties, all stated in the rule. The program "must include reasonable policies and procedures" to identify relevant red flags, detect them, respond to them, and ensure the program "is updated periodically" (12 CFR 41.90(d)(2)). The bank must then obtain board or committee approval of the initial program, involve the board or senior management in its oversight, train staff as necessary, and oversee service providers. Finally, the bank "must consider the guidelines in appendix J of this part and include in its Program those guidelines that are appropriate" (12 CFR 41.90(f)).

The size of the document should follow the risk. The FTC's guide puts it well for the businesses it oversees: "While some businesses and organizations may need a comprehensive program to address a high risk of identity theft, a streamlined program may be appropriate for businesses facing a low risk" (FTC, Fighting Identity Theft with the Red Flags Rule). A bank that opens accounts through fintech partners' apps, online and in branches is not low risk, and its program should read like it.

Section 1: scope, covered accounts and the risk assessment

Start with the inventory. List every consumer deposit and credit product, since each is a covered account by definition, then every other account the bank's risk assessment has found carries a reasonably foreseeable risk of identity theft, typically small-business and sole-proprietor accounts. Then record the risk assessment itself, which the rule bases on three facts: the methods the bank provides to open accounts, the methods to access them, and its previous experience with identity theft. Date it, and say when it will be redone; a new opening channel, such as a new fintech partner, is a reason to redo it early.

How do you identify relevant red flags?

From the bank's own risks and its own cases, not by copying the federal list. The guidelines name four factors to consider: "The types of covered accounts it offers or maintains", "The methods it provides to open its covered accounts", "The methods it provides to access its covered accounts" and "Its previous experiences with identity theft". They name three sources: "Incidents of identity theft that the financial institution or creditor has experienced", new methods of identity theft the bank has identified, and "Applicable supervisory guidance" (Appendix J, section II). The 26 examples in Supplement A are a starting list the bank may use, and the 2009 interagency FAQs confirm "There is no requirement that they do so" (2009 FAQs).

Write the result as a register: one row per flag, with its source, how it is detected and the usual response. Supervisory guidance since 2007 supplies many of the newest rows: FinCEN's 2023 alert on mail-theft check fraud and its 2024 alert on deepfake media both list red flags that belong in a deposit program written today.

Section 3: detection, by channel and by system

The guidelines split detection in two: at opening, obtaining identifying information and verifying identity, for example under the customer identification program; in existing accounts, authenticating customers, monitoring transactions and checking change-of-address requests. A template should go one level lower and say, for each channel, which system holds the data and who looks at it. For an account opened in a partner's app, that means naming the partner's identity check, the opening file the bank receives, the device data, the core transaction history and the person who reviews the account in its first weeks. Gaps show up quickly when the section is written this way.

What is the response to a red flag?

One "commensurate with the degree of risk posed", chosen from a range the guidelines spell out: "Monitoring a covered account for evidence of identity theft"; "Contacting the customer"; changing passwords or security codes; reopening with a new account number; "Not opening a new covered account"; "Closing an existing covered account"; not collecting on or selling the account; "Notifying law enforcement"; or "Determining that no response is warranted under the particular circumstances" (Appendix J, section IV). The guidelines also name aggravating factors that should raise the response, such as "a data security incident that results in unauthorized access to a customer's account records".

The template should tie responses to flags and record who may choose them. In the solution, the response is a proposal with reason codes, the decision is a fraud analyst's, and every restriction or closure is checked by a second person. The last option in the guidelines' list deserves its own line in the program: a recorded decision that no response was warranted is evidence the flag was seen, which an empty log is not.

How often should the identity theft prevention program be reviewed?

Whenever its inputs change, and at least once a year through the report to the board. The rule says only "periodically". The guidelines list the triggers: "The experiences of the financial institution or creditor with identity theft"; "Changes in methods of identity theft"; changes in methods to detect, prevent and mitigate it; "Changes in the types of accounts" offered; and "Changes in the business arrangements", including "alliances, joint ventures, and service provider arrangements" (Appendix J, section V). For a sponsor bank, the last one means a new partner is an update.

Who approves an identity theft prevention program?

The board, or a committee of it, approves the first version: the rule requires the bank to "Obtain approval of the initial written Program from either its board of directors or an appropriate committee of the board of directors" (12 CFR 41.90(e)(1)). After that, oversight can sit with the board, a committee or "a designated employee at the level of senior management", whose job the guidelines describe as "Assigning specific responsibility for the Program's implementation", reviewing staff reports, and "Approving material changes to the Program as necessary to address changing identity theft risks" (Appendix J, section VI(a)). The template should name the role, not the person, and say which changes are material.

How do you document service provider oversight?

Name each provider that performs an activity "in connection with one or more covered accounts", say what it does, and record how the bank checks it: contract terms, the reports it sends, the reviews the bank performs. The guidelines' own example is a contract requiring the provider to detect relevant red flags and either report them or act on them. For a sponsor bank this section is long, and the red flags rule vendor management page sets out what a partner agreement and partner reports should contain.

What goes in the annual red flags report to the board?

The guidelines list it: the report "should address material matters related to the Program and evaluate issues such as: the effectiveness of the policies and procedures of the financial institution or creditor in addressing the risk of identity theft in connection with the opening of covered accounts and with respect to existing covered accounts; service provider arrangements; significant incidents involving identity theft and management's response; and recommendations for material changes to the Program" (Appendix J, section VI(b)(2)).

Effectiveness is the hard word in that list, because it needs numbers. How many new accounts reached review, how many were restricted, how many restrictions were reversed, how much was held before release, and how long each partner took to act on a notice: those are the figures that make the report an evaluation rather than a description. In the solution they are read from the decisions themselves, and the audit trail can be exported as an examiner pack. The settings behind them, thresholds, reason codes, notice windows, retention and masking, are versioned, so the report can also say what changed during the year and why. Replaying the settings on closed accounts supplies the effectiveness evidence for any change the report recommends.

One trail of people and agents, exported as an examiner pack

Section 8: training and the duties that sit beside the program

Training is required "as necessary", which a template should translate into roles: new-account staff, contact centre agents who can change addresses or devices, fraud analysts and partner risk managers. The guidelines then list related legal requirements a program should be "mindful of": filing suspicious activity reports, the FCRA rules on extending credit when a fraud or active duty alert is present, the duties of furnishers to correct inaccurate information, and the bar on selling or placing for collection debts that result from identity theft. The template should cross-refer to the bank's BSA and FCRA procedures rather than repeat them, and should say who connects the two when an identity theft case also needs a SAR.

"Whenever a financial institution or creditor engages a service provider to perform an activity in connection with one or more covered accounts the financial institution or creditor should take steps to ensure that the activity of the service provider is conducted in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft."

Appendix J to 12 CFR part 41, section VI(c)

A template is only as good as the work it describes. The red flags rule in banking explains why the agencies judge the program by its effect rather than its wording. To see the decisions, reasons and reports a program needs produced on your own new accounts, start from New Account Fraud Detection.

The program’s settings, versioned and approved

Questions people ask

Is there a sample identity theft prevention program?

No regulator publishes a fill-in-the-blanks program for banks. The interagency guidelines in Appendix J to each agency's rule are the official outline, and the FTC publishes a how-to guide for the businesses it oversees. A bank's program should be written from its own accounts, channels and fraud cases.

Can the identity theft program be part of another policy?

Yes. The guidelines let a bank incorporate its existing policies, procedures and other arrangements that already control identity theft risk. Many banks keep a short program document that points to the customer identification, fraud and information security procedures where the detail lives.

Does the program need to list all 26 red flag examples?

No. The examples are illustrative, a bank may use none or some of them, and the agencies judge the program on its overall effectiveness. Listing all 26 without detection procedures behind them adds length, not compliance.

Who should own the identity theft prevention program?

A named senior manager or committee, with day-to-day implementation assigned to specific staff. In practice the fraud function usually runs detection and response, compliance owns the document and the annual report, and the board or its committee approves material changes.

How long should identity theft program records be kept?

The Red Flags Rules themselves set no retention period, according to the agencies' 2009 FAQs: "These three Rules do not contain specific record retention requirements." Banks keep the records long enough to demonstrate compliance and to meet other rules, such as the five-year retention for SAR supporting documentation.