The Red Flags Rule requires a written programme to detect, prevent and mitigate identity theft, and the examples it offers are more pointed than most compliance summaries let on. Supplement A to the Interagency Guidelines lists 26 illustrative red flags, and eight of them describe something a lender can only see by comparing one application with others — flag 14 is "the SSN provided is the same as that submitted by other persons opening an account," flag 15 is an address or phone number "submitted by an unusually large number of other persons opening accounts," flag 12 is an address or phone number already seen "on a fraudulent application" (Appendix A to 16 CFR part 681, Supplement A). A lender reviewing applications one at a time has no way to answer any of them, which means its written programme contains checks it does not perform. Botminds' Synthetic Identity Fraud Detection answers them by construction: every new card and loan application is scored against every earlier one, weighting each shared element, and the applications that group together are drawn as a ring.
This guide takes all 26 examples, says which are answerable from a single application and which are not, and scores them against one ring. The ring is sample data that ships with the solution — a fictional issuer, Corvane Bank, with fictional applicants — and every figure from it is marked as such. The rule text and the research are quoted from the regulation and from the Federal Reserve, linked where they appear.
What the rule's own list of examples actually asks for
26
illustrative red flags in Supplement A to the Interagency Guidelines
5
categories a programme should draw relevant flags from
8
that cannot be answered by looking at one application alone
What the Red Flags Rule actually requires
The rule exists in more than one place — the Federal Trade Commission's version at 16 CFR 681.1, and the federal banking agencies' identically structured rules — but they share one appendix. A financial institution or creditor that offers or maintains covered accounts "must develop and implement a written Identity Theft Prevention Program (Program) that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account," appropriate "to the size and complexity" of the institution and "the nature and scope of its activities" (16 CFR 681.1(d)(1)).
The programme must do four things: identify relevant red flags and incorporate them, detect the ones it has incorporated, respond appropriately to the ones it detects, and update itself periodically as risks change. The identification step is where this guide bites. The Guidelines say a programme "should include relevant Red Flags from the following categories, as appropriate" — alerts from consumer reporting agencies, suspicious documents, suspicious personal identifying information, unusual use of an account, and notice from customers, victims or law enforcement — and that examples from each category "are appended as supplement A."
The word doing the work is relevant. A card issuer cannot plausibly claim that an address submitted by an unusually large number of other applicants is irrelevant to card application fraud. It can, and many do, write the flag into the programme and then operate a process that cannot see it.
The 26 identity theft red flags, and what each one needs
Below is the whole list, abbreviated to its operative test, with two columns added. "Needs" says whether the flag can be answered from the application in front of you — one — or only by comparing it with the rest of the book — the set. The last column names what the solution reads to answer it, which is a configuration rather than a fixed rule.
All 26 illustrative red flags, by what it takes to answer them
| Red flag, abbreviated | Needs | What is read for it |
|---|---|---|
| 1. A fraud or active duty alert on a consumer report | one | Alert read with the report |
| 2. A notice of credit freeze from a consumer reporting agency | one | Freeze notice recorded |
| 3. A notice of address discrepancy | one | Address compared with the report |
| 4. Activity inconsistent with the applicant’s history: a jump in inquiries, many new credit relationships | one | Inquiry velocity and file depth |
| 5. Identification that appears altered or forged | one | Template and altered-field comparison |
| 6. The photograph or description does not match the person presenting it | one | Selfie liveness and face comparison |
| 7. Information on the identification contradicts what the applicant said | one | Document fields against the application |
| 8. Information on the identification contradicts what is already on file | one | Document fields against held records |
| 9. The application appears altered, forged or reassembled | one | Document integrity check |
| 10. Details conflict with outside sources: the address is nowhere on the report, or the number has not been issued | one | Government number check, bureau address list |
| 11. Details conflict with each other: no correlation between the number range and the date of birth | one | Issuance range against stated birth date |
| 12. Details already seen on a fraudulent application — the same address, or the same phone number | the set | Links to confirmed fraud cases |
| 13. Details of a kind associated with fraud: a fictitious address, a mail drop, a prison; an invalid phone or an answering service | one | Address type and phone line type |
| 14. The same number submitted by other people opening accounts | the set | Number matched across applications |
| 15. The address or phone number submitted by an unusually large number of other applicants | the set | Shared-element count across the book |
| 16. The applicant does not supply all the required information, or ignores a request to complete it | one | Completeness check |
| 17. Details that contradict information already held by the lender | one | Application against held records |
| 18. The applicant cannot answer anything beyond what a wallet or a report would show | one | Step-up questions |
| 19. Soon after an address change, a request for a new card or for authorized users to be added | the set | Account events joined to applications |
| 20. A new revolving account used in a known fraud pattern: cash advances, easily resold goods, or no first payment | the set | Early account behaviour on booked cards |
| 21. Use inconsistent with the account’s established pattern | the set | Behaviour on booked accounts |
| 22. A long-dormant account suddenly used | the set | Dormancy and reactivation |
| 23. Mail repeatedly returned undeliverable while the account keeps transacting | the set | Returned mail against activity |
| 24. The customer says paper statements are not arriving | one | Service record |
| 25. The lender is told of unauthorized charges on the account | one | Dispute record |
| 26. A customer, a victim, law enforcement or anyone else reports a fraudulent account | one | Case intake |
Which red flags a synthetic identity trips, one application at a time
Fewer than a lender would hope, and that is the structural problem rather than a failure of effort. A well-built synthetic identity is designed to pass exactly the eighteen flags in the table marked one. There is no fraud alert, because nobody has reported anything. There is no freeze, because the number belongs to a child. There is no address discrepancy, because the address on the application is the address the bureau has — the ring put it there. The identification is not altered, because the ring made it from scratch. The applicant answers every question, because the answers are the ring's own invention.
Three of the eighteen do bite, and they are the three worth building for. Flag 10 covers a number that "has not been issued," which is what the consent-based government check is for. Flag 11 covers "a lack of correlation between the SSN range and date of birth," which catches a number first issued after the applicant claims to have been born. Flag 13 covers an address that is "fictitious, a mail drop, or a prison" and a phone number that is "invalid, or is associated with a pager or answering service" — the mail-receiving store and the voice-over-internet line, written into federal regulation in 2007.
Flag 4 is the interesting near-miss. It covers "an unusual number of recently established credit relationships" and "a recent and significant increase in the volume of inquiries," both of which a cultivated synthetic identity shows. But it is also what a recent immigrant, a young adult or someone rebuilding after a bankruptcy shows, which is why it cannot carry a decision on its own. The Federal Reserve is explicit about the cost of leaning on that one signal, and the warning is quoted in full further down.
The eight that cannot be answered without every other application
These are the flags the rule asks for and a one-at-a-time process cannot deliver. Six of them are about the application; two are about the booked accounts the ring has already opened.
Six red flags drawn as the links of one ring
12
What the rule asksAn address or phone already seen on a fraudulent application
What the ring didThe voice-over-internet line appears on 13 of the ring’s 14 applications
Linked onPhone, weight 20
14
What the rule asksThe same number submitted by other people opening accounts
What the ring didNine of ten names fail the government number check; the tenth is genuine
Linked onNumber, with the check result
15
What the rule asksAn address or phone used by an unusually large number of applicants
What the ring didA mail-receiving store at one street address on 4 applications
Linked onAddress, weight 15, doubled for a mail-receiving store
19
What the rule asksAuthorized users added, or a card requested, soon after an address change
What the ring didOne borrowed card appears on 7 of the 14 credit files
Linked onBorrowed authorized-user card
20
What the rule asksA new revolving account used in a known fraud pattern, or no first payment
What the ring didThree line-increase requests on cards booked between February and April
Linked onFunding account, weight 30
23
What the rule asksMail returned undeliverable while the account keeps transacting
What the ring didStatements to a mailbox, transactions from addresses 340 miles away
Linked onDevice, weight 30, and IP location
The other two in the set of 8 — flags 21 and 22, unusual use of an established account and a dormant account waking up — matter after the ring is booked rather than at application. They are the signals that catch the cultivation phase, and the reason the solution pauses limit increases on booked cards while a ring is open rather than waiting for the applications to be decided.
The Federal Reserve arrived at the same list from the other direction. Its 2019 detection paper recommends looking "for unusual recurring patterns and relationships between transactions," naming "multiple account applications from the same IP address or device, or assigned to the same name, SSN or physical address," and gives the sharpest example in the literature: these checks "help identify indicators of possible fraud networks – for example, individuals without a common city or surname who appear as authorized users on multiple accounts" (Federal Reserve, October 2019). That is flag 19 and flag 14, read together.
Red flag 11 after Social Security number randomisation
Flag 11's example — "a lack of correlation between the SSN range and date of birth" — was written in 2007, when the first three digits of a Social Security number encoded the state it was issued in and the rest ran roughly in sequence. That stopped. "On June 25, 2011, the SSA began to randomly assign SSNs," the Federal Reserve records. "Randomization eliminated the geographical significance of the first three digits of the SSN (also called the area number), which previously helped financial institutions determine an individual's state of origin. As a result of randomization, geographic checks are no longer effective for newly issued SSNs" (Federal Reserve, July 2019).
What survives is narrower and still useful: some number ranges were only ever issued after randomisation began, so a number from one of those ranges held by someone claiming to have been born decades earlier is a genuine inconsistency. That is the check in the sample data — a number "from a range issued after 2011 against a 1984 birth" — and it is flag 11 operating in its post-2011 form. What does not survive is the older practice of inferring a state of origin, and any control still doing that is reading a signal that has not existed for fifteen years.
The Federal Reserve lists "SSN issued after 2011" among the common characteristics of synthetic identities for exactly this reason. It is also, by itself, true of every young adult, which is the recurring theme of this rule: the flags are individually weak and jointly strong.
"Looking only at the length of a credit history could unnecessarily disadvantage or deny credit to certain types of legitimate customers – such as immigrants and formerly impoverished or incarcerated people who only recently gained access to credit."
Federal Reserve, Detecting Synthetic Identity Fraud in the U.S. Payment System, October 2019, page 8
What "respond appropriately" means, and what it does not
The Guidelines set out the responses they consider appropriate, and the list is wider than most people expect. A lender may monitor the account for evidence of identity theft, contact the customer, change security credentials, re-open the account with a new number, decline to open a new account, close an existing one, decline to collect or to sell the debt, notify law enforcement — or determine "that no response is warranted under the particular circumstances." Responses should be "commensurate with the degree of risk posed," and the Guidelines name aggravating factors to weigh, such as a data security incident that exposed the customer's records.
Two things follow for a ring. First, "no response is warranted" is a legitimate answer the rule itself provides, which is what makes clearing a genuine applicant a compliant outcome rather than a risk taken. In the sample data a genuine applicant linked only by her employer's name is cleared to underwriting, and that decision is as much a response to a detected red flag as the nine declines beside it. Second, there is a graded middle: the solution's step-up band asks an applicant between the pass line and the hold line for a photo identification and a selfie rather than stopping them, which is the Guidelines' "contacting the customer" and "authenticating customers" in operational form.
What "respond appropriately" does not mean is declining on a flag. Nothing in the rule authorises an adverse decision, and nothing in it excuses one; the reason given to the applicant is governed by Regulation B and is a different problem, worked through in the guide on what a decline notice may and may not say.
The honest limit: a red flag is a question, not a finding
The rule's own name says it. A red flag is defined as "a pattern, practice, or specific activity that indicates the possible existence of identity theft" — possible, not probable, and certainly not established. The design consequence is that a control built to fire on one flag will spend most of its time wrong, and the people it is wrong about will be the thinnest-filed, most recently arrived and least able to argue applicants on the book.
This is why the solution's identity verifier is set never to decide on one signal, and why the links carry different weights rather than a single yes or no: a device shared by seven applications is worth more than an email pattern, a mail-receiving store is worth double an ordinary address, and a surname or any protected characteristic is worth nothing at all. The Federal Reserve's own conclusion is the same: "it is important to look across multiple characteristics and data sources to identify synthetics" (Federal Reserve, July 2020).
It is also why the test of a detection programme is two-sided. A programme that reports how many rings it found, without reporting how many genuine applicants it held, has reported half a result. The method for measuring both on your own closed files is in the guide on back-testing detection.
One identity against the rule: seven checks, each with the source behind it
Who approves the Program, and what the record has to show
The rule puts the programme's approval in a specific place. The institution must "obtain approval of the initial written Program from either its board of directors or an appropriate committee of the board of directors," involve the board, a committee or a designated senior manager in oversight and administration, train staff "as necessary to effectively implement the Program," and exercise oversight of service providers.
For a fraud team that is a short but awkward list, because it means the thresholds are not an operational detail. If the hold line, the step-up band and the link weights are the mechanism by which the board-approved programme detects flags 12, 14, 15 and 19, then changing them changes the programme, and the change needs to be on the record with a date and a person against it. In the solution those thresholds and weights are settings whose changes are versioned, which is the same requirement expressed as software rather than as a memo.
The federal court record supplies the detail that makes flag 13 concrete, and it is worth reading before deciding a mail drop is an edge case. In a 2022 case in the Central District of California, a defendant sentenced to 94 months "maintained a commercial mail receiving agency space called 'Pak Mail' in Georgia where he and his co-conspirators received correspondence related to the synthetic identities, including bank account and credit card statements, while insulating their personal addresses from detection" (U.S. Attorney, Central District of California, August 2022). More of the record is in six federal cases, from the court record, and the first question to settle before any of this — what a synthetic identity actually is — is in the guide on the applicant who does not exist.
Six tests of a programme that can answer flags 12, 14, 15 and 19
- Every application is compared with every earlier one, not with a watchlist
Flags 14 and 15 are about the volume of other applicants sharing an element. A list of known-bad values cannot answer them, because the first ring is not on any list.
- Address type is resolved, not just validated
Flag 13 names a mail drop specifically. An address that is deliverable can still be a mailbox at a commercial mail receiving agency, and the two checks are different.
- Phone line type is read
Flag 13’s other half: a voice-over-internet or answering-service line. Format validation does not touch this.
- Tradeline type, not just score, is read from the file
Flag 19 and the authorized-user pattern need to know that a history was borrowed, and that the same card appears on other applicants’ files.
- Confirmed fraud cases feed back into the comparison
Flag 12 is explicitly about details "already seen on a fraudulent application". That is only true if last year’s findings are still in the data, which is why a ring coded as a credit loss breaks the flag.
- Every weight and threshold change is dated and attributable
The board approved a programme, not a number. If the number is how the programme detects, the change belongs on the record.
Read that way, the Red Flags Rule is less a compliance obligation than an unusually good specification: written in 2007, it already describes the comparison that synthetic identity rings are caught by. To see the 6 at-application flags answered on your own applications, start from Synthetic Identity Fraud Detection.
Questions people ask
What is a covered account under the Red Flags Rule?
An account a financial institution or creditor "offers or maintains, primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions" — the rule names credit card accounts, mortgage loans, car loans, margin accounts, mobile phone accounts, utility accounts and deposit accounts. It also covers any other account where identity theft would create a reasonably foreseeable risk to customers or to the institution's safety and soundness.
Does the Red Flags Rule require link analysis?
Not in those words. It requires a programme that identifies and detects relevant red flags, and its own list of examples includes flags that are only answerable by comparing applications — the same number submitted by other applicants, an address or phone used by an unusually large number of applicants, details already seen on a fraudulent application. If those are relevant to your products, a process that cannot answer them is not detecting the flags you wrote down.
Can a red flag on its own be a reason to decline an application?
The rule neither authorises nor forbids it; it lists appropriate responses, from monitoring and contacting the customer to declining to open the account, and expects the response to be commensurate with the risk. It also allows a determination that no response is warranted. What the reason given to the applicant may say is governed by Regulation B, not by this rule.
How many of the 26 red flags matter for application fraud?
Roughly half. The flags about account behaviour — dormancy, returned mail, unauthorized charges, disputes — belong to existing accounts, which matters for the cultivation phase rather than the application. Of those that apply at application, three are directly useful against a well-built synthetic identity, and six more only work if you compare the application with the rest of the book.
Who has to approve the identity theft prevention program?
The initial written programme must be approved by the board of directors or an appropriate board committee, and the board, a committee or a designated senior manager must be involved in its oversight, development and administration. Staff must be trained as necessary, and service providers overseen. The programme must also be updated periodically as risks change.
Is the Red Flags Rule the same for banks and for other lenders?
The structure is. The Federal Trade Commission's rule at 16 CFR 681.1 covers creditors under its enforcement, and the federal banking agencies have their own rules for the institutions they supervise. All of them rest on the same Interagency Guidelines on Identity Theft Detection, Prevention, and Mitigation and the same Supplement A list of 26 examples, which is why the examples are worth reading whichever rule applies to you.