A Red Flag is a pattern, practice or specific activity that indicates the possible existence of identity theft.

As part of a mandate from the Fair and Accurate Credit Transactions Act, auto dealerships must establish a written Identity Theft Prevention Program. The new "Red Flags" Law became effective on January 1, 2008 with an original mandatory compliance date of November 1, 2008 however the FTC has suspended the enforcement deadline until May 1, 2009. Dealerships failing to create and maintain a good faith compliance effort around a "Red Flags" program run the risk of fines for each violation of the law and exposure to a public relations disaster.

This section applies to users of credit reports who get a notice of address discrepancy from a consumer reporting agency. A notice of address discrepancy is a notice that the address included in the user’s request for a consumer report and the address or addresses in the consumer reporting agency’s files are substantially different. Inconsistencies could result from a harmless typo by the dealer, or attempted fraud by the applicant. This section requires dealers to implement policies, training and procedures for handling a notice of address discrepancy.

"Red Flag" fraud alerts provide a vital service by issuing a warning about information that appears to be genuine on the customer’s application, but may be questionable. These warning messages focus on high-risk applicants. The final rule also states: "While an institution or creditor may determine that particular guidelines are not appropriate to incorporate into its program, the program must nonetheless contain reasonable policies and procedures to meet the specific requirements of the final rules."