Federal Trade Commission (FTC)

The Federal Trade Commission is the US agency responsible for protecting consumers and promoting competition. On fraud and identity theft it does three things that matter to businesses: it enforces against deceptive and unfair practices, it collects the country’s largest body of consumer fraud reports, and it writes rules that impose identity and data security duties on private firms.

It is not a financial regulator. It has no prudential role and does not supervise banks, which sit with the federal banking agencies and the CFPB.

What the FTC requires of businesses

The Red Flags Rule requires financial institutions and creditors holding covered accounts to maintain a written identity theft prevention program — identifying the warning signs relevant to their business, detecting them, and responding. “Creditor” is broader than it sounds, reaching many businesses that extend deferred payment terms.

The Safeguards Rule requires non-bank financial institutions under the Gramm-Leach-Bliley Act to maintain an information security program. Its amended form is markedly more prescriptive than the original, specifying a qualified individual accountable for the program, written risk assessments, access controls, encryption, multi-factor authentication, and notification obligations. It reaches auto dealers, mortgage brokers, tax preparers and similar businesses that do not think of themselves as financial institutions.

The Disposal Rule governs secure destruction of consumer report information.

Behind all of them sits Section 5. The FTC has brought a long series of data security cases on the theory that failing to maintain reasonable security is itself an unfair practice — which means a business can face action without breaching any specific rule. Orders commonly run for twenty years and impose mandated programs and independent assessments.

What the FTC’s data shows

The Consumer Sentinel Network aggregates reports from consumers, law enforcement, the Better Business Bureau and others, and is the most cited source on US consumer fraud.

For 2024, the FTC reported consumers losing more than $12.5 billion to fraud, a 25% increase on the prior year, from roughly 6.5 million total Sentinel reports. Notably, the increase was not driven by more reports — report volume was stable — but by a higher share of people who reported losing money. Investment scams accounted for $5.7 billion, more than any other category, with imposter scams second at $2.95 billion. Identity theft reports through IdentityTheft.gov exceeded 1.1 million.

The caveat matters as much as the figures: this is reported loss, not measured loss. Sentinel is a voluntary complaint database, and fraud is heavily under-reported, particularly where victims feel embarrassed or believe nothing will come of it. The totals are a floor and a trend indicator, not a measurement — and any analysis presenting them as the size of US fraud is overstating what the data can support.

Why it matters for identity verification

The FTC is the reason many non-bank US businesses have identity obligations at all.

A bank’s identification duties come from the Bank Secrecy Act and the customer identification program rules. An auto dealer, a mortgage broker or a tax preparer has no such obligation — and does fall under the Safeguards Rule and, where it extends credit, the Red Flags Rule. For a large population of firms, the FTC is the source of the requirement to verify who they are dealing with and protect what they collect.

Both rules are also written around demonstrability. A Red Flags program must be documented, approved, and kept current; Safeguards requires written risk assessments and reporting to a board or equivalent. That makes evidence the operative concept: a control that cannot be shown to have been applied is, for these purposes, close to a control that was not.

There is a tension worth naming. The Safeguards Rule requires protecting customer information, and identity verification requires collecting some of the most sensitive information a business can hold. Collecting a passport image to satisfy one obligation creates an exposure under the other. This is a strong argument for extracting only the attributes needed and retaining as little as possible — and part of why on-device processing is more than a performance choice.

What the FTC does not do

It does not supervise banks. Depository institutions answer to the federal banking agencies and the CFPB. The FTC’s financial jurisdiction covers non-bank entities.

It does not resolve individual complaints. Sentinel feeds investigations and law enforcement; filing a report does not produce an outcome in the reporter’s case, and the FTC does not act as a consumer’s representative.

IdentityTheft.gov does not fix anything by itself. It produces a recovery plan and the affidavit institutions accept. The work of disputing accounts and correcting records still falls on the victim.

It does not certify vendors. There is no FTC-approved list for identity verification or security products. A claim of FTC approval describes something that does not exist.

Frequently asked questions

What is the Red Flags Rule?

An FTC rule requiring financial institutions and creditors with covered accounts to maintain a written identity theft prevention program — identifying relevant warning signs, detecting them in practice, responding appropriately, and updating the program as risks change. It must be approved and overseen at board or senior management level.

Does the FTC regulate banks?

No. Banks, credit unions and other depository institutions are supervised by the federal banking agencies and the CFPB. The FTC’s authority over financial services covers non-bank entities — which is a large population including auto dealers, mortgage brokers and tax preparers.

How reliable are the FTC’s fraud loss figures?

They are reliable as a floor and as a trend, not as a measurement. Consumer Sentinel is a voluntary reporting database, and fraud is substantially under-reported, so reported losses understate actual losses by an unknown margin. They are the best available US data and should be described as reported rather than total.

What does the Safeguards Rule require?

A written information security program for non-bank financial institutions under Gramm-Leach-Bliley, with a qualified individual accountable for it, periodic written risk assessments, access controls, encryption of customer information, multi-factor authentication, service provider oversight, and notification duties. The amended version is considerably more prescriptive than the original.

Related reading

• Identity theft — what IdentityTheft.gov and the Red Flags Rule address
• Third-party identity fraud — the use stage of stolen identity data
• Data breach — the exposure the Safeguards Rule aims at
• California Consumer Privacy Act — the state regime that sits alongside FTC authority