Anthony LaFaziaCEO, Atlantic Training · CEO at Atlantic Training | EdTech & Safety Compliance Leader

Conducting the Red Flags Risk Assessment: A Manager's Guide to Corporate Identity Theft Prevention

11 Jun 2026 · 2 min

Watch on YouTube

1:35

In this instructional video, the presenter walks managers through the process of conducting a Red Flags risk assessment to comply with identity‑theft prevention regulations. The discussion begins by outlining the three core factors the assessment must address: (1) the types of covered accounts the organization offers, defined as personal, family, or household accounts that involve multiple payments or any account identified as having a foreseeable identity‑theft risk; (2) the methods used to open and access those accounts, emphasizing the need for digital verification tools when services are offered online and distinguishing between prevention controls (e.g., multi‑factor authentication) and detection procedures (e.g., monitoring IP spoofing or unusual transaction patterns); and (3) the organization’s own history of identity‑theft incidents, urging a review of recent account‑takeover events. The presenter then illustrates the assessment with a concrete scenario: a mid‑size regional medical clinic that has added an online patient portal allowing users to change billing addresses. The new access point creates a vulnerability where stolen credentials could be used to redirect billing to a drop‑house, bypassing the traditional front‑desk ID verification. The video shows how the risk assessment identifies this gap and recommends updating the policy to require additional verification for any billing‑address changes made through the portal. A brief promotional interjection follows, advertising Atlantic Training’s Wave management platform for employee training. The overall message stresses that without a tailored risk assessment, organizations remain non‑compliant and exposed to fraud.

Chapters

So, how do you ensure the program is relevant? You conduct a risk assessment. You can't copy-paste a policy from the internet. You have to look at your vulnerability. The rule requires you to consider 3 main factors: First, the types of covered accounts you offer. A covered account is an account for personal, family, or household purposes that involves multiple payments or transactions, but it also includes any other account type that your organization has identified through its risk assessment as having a reasonably foreseeable risk of identity theft. Second, the methods you provide to open and access those accounts. This is huge. Do you open accounts online? Over the phone? In person? If you operate entirely online, checking the photo ID isn't a relevant detection method without additional steps. You need digital verification tools. Now, don't confuse prevention with detection. You might implement multi-factor authentication to prevent unauthorized access. That's a great control. But your red flags program still needs detection procedures, like monitoring for IP address spoofing or unusual transaction patterns, to catch the fraud that slips past your MFA. Third, your previous experience with identity theft. Look at your own data. Have you had account takeovers in the last year? How did they happen? Let's walk through a real-world assessment scenario to see how this works.
Is your employee training scattered across spreadsheets and emails? There's a better way to grow your team. Atlantic Training provides world-class HR and soft skills courses, all hosted inside our Wave management platform. From onboarding automation to tracking leadership development, Wave tracks it all. And you get the software for free when you choose your training plan. Click the link below to build your custom plan now.
Imagine you manage a mid-sized regional medical clinic. You've always done intake in person with a clipboard and a pen. Your red flags program says, verify ID at the front desk, Simple. But you just launched a new patient portal where patients can log in, view records, and, crucially, change their billing address and billing method. This is a new method of access. So, you sit down for your risk assessment. You ask, "What are the vulnerabilities here?" Well, if a hacker steals a patient's password, which happens constantly, they can log in. They can change the billing address to a drop house. Then, they can order expensive medical equipment or prescription drugs billed to the patient's insurance. The "Verify ID at the front desk" rule is now useless for this transaction because there is no front desk in the app. So, your assessment identifies a gap. The "update" to your program might be: "Require additional verification for any changes to billing addresses in the portal." That's the risk assessment in action. You identified a new access point, recognized the new threat, and updated the policy to block it. If you hadn't done that assessment, you'd be wide open to fraud and you'd be non-compliant.