Activity-Specific Requirements

Each unit that performs or outsources any of the covered activities of the Red Flags Rule must meet follow general requirements. Account activities and card activities have additional requirements, provided on this page.

To determine whether your unit must comply with the Red Flags Rule, read Covered Activities.

Account Activities

Whether your unit administers accounts for itself or any other unit(s), two additional requirements apply for you to comply with the Red Flags Rule.

Monitor Account Activity

Your unit must have systematic procedures in place to monitor for red flags. When identifying red flags for your account(s) and how to watch for them, consider the entire "life cycle" and patterns of your patrons' business. Suspicious activity can occur when an account is first established, during its everyday use, even when accounts are closed. Consider inconsistencies of personal information, time and timing, and amounts or volume of activity. Examples of Red Flags covers some common patterns you may encounter.

Verify Addresses When Using Credit Reports

If your unit uses consumer credit reports, such as those issued by Equifax, TransUnion, and Experian, you must confirm that the addresses you provide to the reporting agency are accurate. If a credit agency notifies your unit of an address discrepancy, you must confirm that the address you provided is accurate. You may do this by:

• Checking with the person about whom you requested the report, provided that you have verified that person's identity
• Checking third-party sources, such as phone books or address listings on the web—but not relying on any single such source as authoritative.

You must report the verified address back to the credit agency during the same reporting period that it establishes a relationship with the individual.

Card Activities

Card-issuing units have two additional requirements to meet in order to comply with the Red Flags Rule.

Issue Cards in Person Whenever Possible

Issue cards in person whenever possible, and only do so after you have verified the patron's identity with a current, valid government-issued photo ID. Read Verify Identity for in-person services for related requirements.

For online students and other populations that cannot present in person, arrange for another University unit to verify the identity of intended cardholders and to distribute cards. In the arrangement, include a requirement for each cardholder to show a government-issued photo ID before receiving a card.

Verify Addresses for Mailed Cards

If there is an unavoidable business need to mail a card directly to a cardholder, have procedures in place to verify the cardholder's address.

For replacement card requests, have procedures in place to know whether a cardholder's address has changed within 30 days. If an address has changed recently, email the cardholder at his or her University email account to confirm the new address is correct before you mail a replacement card.

Who to Ask

Direct any questions to the Red Flags Steering Committee: rfsc@uillinois.edu.

Last Updated: January 27, 2016