# Run the FTC Red Flags Rule two-part creditor test if you check credit before financing customer equipment > The FTC’s Red Flags Rule requires financial institutions and some creditors with covered accounts to keep a written identity theft prevention program. Billing customers later is not enough to qualify, but regularly using consumer reports in credit decisions is, even when a third party pulls the reports. - Canonical URL: https://update.dsesecurity.com/updates/ftc-red-flags-rule-creditor-test-identity-theft-prevention-program/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-18T21:00:58+00:00 - Modified: 2026-10-18T22:22:08+00:00 - Last reviewed by DSE: 2026-10-18 - Resource type: Explainer - DSE priority: Advisory - Topics: Business Continuity, Cybersecurity - Reading time: 2 minutes ## What you need to know The FTC’s Red Flags Rule requires financial institutions and some creditors with covered accounts to keep a written identity theft prevention program. Billing customers later is not enough to qualify, but regularly using consumer reports in credit decisions is, even when a third party pulls the reports. ## Potentially affected Businesses that finance equipment or services, run consumer credit checks, report to credit bureaus or lend money, including service companies that offer monthly payment plans to residential customers. ## DSE recommendation DSE recommends documenting a Red Flags Rule applicability analysis for any business that regularly uses consumer reports in connection with customer credit. ## Article The FTC’s Red Flags Rule requires financial institutions and some creditors with covered accounts to keep a written identity theft prevention program. Billing customers later is not enough to qualify, but regularly using consumer reports in credit decisions is, even when a third party pulls the reports. ## Source facts The FTC’s [Red Flags Rule guide](https://www.ftc.gov/business-guidance/resources/fighting-identity-theft-red-flags-rule-how-guide-business) says the Rule requires many businesses to implement a written identity theft prevention program. The program must identify the red flags that may occur in daily operations, detect them, spell out the actions taken when they are detected, and detail how it will be kept current. The Rule applies to financial institutions and some creditors, and a written program is required only if the business has covered accounts. A business is a creditor only if it regularly defers payment, bills customers or arranges credit and also regularly gets or uses consumer reports in a credit transaction, furnishes information to credit reporting companies, or advances funds. Deferring payment alone is not advancing funds, accepting credit cards alone does not make a business a creditor, and checking credit reports to screen job applicants does not trigger the Rule. The Rule applies whether a business uses credit reports directly or a third party evaluates them for it. Covered accounts include consumer accounts that allow multiple payments, and other accounts with a reasonably foreseeable risk of identity theft. Even a low-risk business needs a written program approved by its board or an appropriate senior employee. ## Applicability Use this for businesses under FTC jurisdiction; banks and some other financial institutions follow their own regulators’ versions of the Rule. Whether a specific business is covered depends on its facts, so keep counsel involved in the conclusion. ## DSE recommendation DSE recommends documenting a Red Flags Rule applicability analysis for any business that regularly uses consumer reports in connection with customer credit. If covered, write a proportionate program that names the red flags seen in your sales and billing process, such as mismatched identification or a new account used in unusual ways, and assign a senior employee to approve it. Repeat the risk assessment when financing or billing practices change. ## Verification Keep the written applicability analysis, program approval and annual review with compliance records, and sample new financed accounts each quarter to confirm the identity checks in the program were performed. ## Official reference [Federal Trade Commission — Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business](https://www.ftc.gov/business-guidance/resources/fighting-identity-theft-red-flags-rule-how-guide-business). Reviewed October 18, 2026. ## Primary reference - Name: Federal Trade Commission — Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business - Authority: Federal Trade Commission - URL: https://www.ftc.gov/business-guidance/resources/fighting-identity-theft-red-flags-rule-how-guide-business - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Run the FTC Red Flags Rule two-part creditor test if you check credit before financing customer equipment,” DSE Security, https://update.dsesecurity.com/updates/ftc-red-flags-rule-creditor-test-identity-theft-prevention-program/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.