Seeing Red (Flags): The Credit Report Compliance Check Every Business Needs to Know
Every industry has its boogeyman. For businesses that use credit reports, that boogeyman has a name: identity fraud. And the federal government’s answer to it, baked into a rule most businesses either misunderstand, underestimate, or quietly ignore, is called the Red Flags Rule.
If you extend credit, pull credit reports, or open accounts for customers, you need to know what this rule is, why it exists, and what happens when you don’t take it seriously. Spoiler: it gets expensive.
What Are "Red Flags," Exactly?
In everyday life, a red flag is anything that makes you pause and say, “Wait a second…” — a date who asks to borrow money on the first outing. A job applicant who can’t name their previous employer. A check that’s already been cashed.
In the world of credit and financial compliance, red flags are formal warning signals: specific patterns, information inconsistencies, fraud alerts, or suspicious activities that may indicate identity theft or fraud. They’re not just a gut feeling. They’re a federally defined list of indicators that certain types of businesses are required to watch for, document, and respond to.
The Red Flags Rule was established in 2007 under the Fair and Accurate Credit Transactions Act (FACTA) and is enforced by the Federal Trade Commission (FTC). The rule requires covered businesses to develop and implement a written Identity Theft Prevention Program that identifies red flags, detects them when they occur, responds to them appropriately, and updates the program over time.
What Counts as a Red Flag?
- Alerts, notifications, or warnings from a consumer reporting agency: This includes fraud alerts placed by consumers, credit freezes, and active-duty alerts from military personnel.
- Suspicious documents: A driver’s license that looks altered. An ID whose photo doesn’t match the person presenting it. Documents that appear forged or inconsistent with information provided.
- Suspicious personal identifying information: A Social Security Number associated with a deceased individual or used by multiple people. An address that doesn’t match the one on file. A phone number or address tied to known fraudulent activity.
- Unusual use of, or suspicious activity related to, a covered account: A new account being used to request a large cash advance immediately after opening. A significant change in payment behavior. A customer who can’t answer basic security questions about their own account.
- Notices from customers, law enforcement, or other businesses: A customer calls to say they never opened the account in question. Law enforcement notifies you of an identity theft investigation connected to one of your customers. Any one of these, or a cluster of them, should trigger your response protocol. They’re the breadcrumbs that often lead to a fraudster. Ignore them, and you may end up funding a deal, approving a loan, or extending credit to someone who doesn’t exist.
Who Is Required to Comply?
Here’s where many businesses make a dangerous assumption: they assume the Red Flags Rule is someone else’s problem. It isn’t.
The rule applies to financial institutions and creditors that maintain covered accounts, which the FTC defines broadly as any account that involves or is designed to permit multiple payments or transactions. If you offer financing, extend credit, defer payments, or open accounts for customers, you are almost certainly a covered entity.
That includes:
Banks and credit unions: Traditional financial institutions were among the first targets of the rule and have generally built compliance into their systems. But “generally” isn’t the same as “always.”
Auto dealerships: Here’s where it gets interesting. Dealers who arrange financing, which is nearly every car dealer in America, are creditors under the FTC’s definition. That means every dealership in the country is required to have a Red Flags compliance program. The FTC is not ambiguous about this. Yet audits consistently reveal that a significant portion of dealers either have an outdated program collecting dust or no program at all. The consequences range from regulatory fines to fully funded fraudulent deals that the dealer eats. See how Red Flags Rule compliance for dealerships works in practice.
Business lenders and commercial finance companies: Any company that extends credit to businesses, including working capital loans, equipment financing, lines of credit, must screen for red flags in the accounts they open and maintain.
Mortgage lenders and servicers: Mortgage fraud is a multi-billion-dollar problem, and red flag procedures are a frontline defense. When a credit applicant’s identity can’t be verified, or their documents raise questions, the Red Flags Rule requires action.
Healthcare providers: Yes, healthcare. If you bill patients after services are rendered, the FTC considers you a creditor. Medical identity theft is one of the fastest-growing fraud categories in the country, and healthcare organizations that routinely skip Red Flags compliance are leaving themselves wide open.
Utilities and telecom companies: Subscription and account-based service companies that allow deferred billing are also covered. If you open an account today and bill a customer tomorrow, the rule likely applies to you.
Retailers and lease companies: Any business offering in-house financing or installment plans has the same obligation. Jewelry stores, furniture retailers, and rent-to-own companies are all covered.
Why This Matters More Than Ever
Identity fraud isn’t slowing down. It’s accelerating and getting smarter.
Synthetic identity fraud, where criminals combine real and fabricated information to create an entirely fictitious person, has become one of the most difficult fraud types to catch with the naked eye. A synthetic identity has a Social Security Number (sometimes a real one, sometimes manufactured), a fabricated name, a constructed credit history, and a backstory designed to pass basic verification. These “identities” can be aged for months or years before a fraudster is cashed out: buying a car, taking out a loan, maxing out credit lines, and disappearing.
For auto dealers specifically, the exposure is acute. A vehicle lost to a fraudulent deal can represent $50,000 to $100,000 or more in losses. Point Predictive estimates the total auto lending fraud risk for 2026 at $9.2 billion. That’s an industry-level crisis playing out one bad deal at a time.
The Red Flags Rule doesn’t eliminate fraud risk, but it creates a framework that requires businesses to pay attention, to look for the inconsistencies, to ask the follow-up question, to verify the document, or to pause before funding the deal that doesn’t feel quite right.
What Good Red Flags Compliance Looks Like
A written program that sits in a binder on a shelf is not compliance. Real Red Flags compliance is embedded in the workflow. It happens automatically at every customer touchpoint, every credit application, every account opening. It surfaces warnings in real time, prompts the right response, and documents the outcome. When a regulator or auditor comes knocking, every decision can be traced, justified, and defended.
For auto dealers, that means Red Flags Rule checks should happen before the desk, not as a last-minute box to check in F&I. Identity verification, document validation, and fraud screening should be woven into the steps that happen the moment a customer’s information enters the system.
The businesses that get this right aren’t just avoiding fines. They’re avoiding losses. They’re avoiding lawsuits. They’re avoiding the reputational damage that comes when a fraudulent deal makes the news and your name is attached to it.
The Bottom Line
A Red Flags process is not bureaucratic busy work. It is a warning system that pays for itself the first time it catches something real.
Whether you’re a dealership financing vehicles, a lender approving commercial credit, a healthcare provider billing after treatment, or a retailer offering payment plans, the Red Flags Rule applies to you. The question isn’t whether you need a program. The question is whether yours actually works.