Under the Red Flags Rule,
every financial institution and "creditor" is required to establish an
Identity Theft Prevention Program tailored to its size, complexity and
the nature of its operation. The program must contain reasonable
policies and procedures to: