DON'T IGNORE THE RULES - The Rules provide for PENALTIES at the Federal level if affected businesses do not have a free-standing written identity theft prevention program. In addition, State “unfair and deceptive acts and practices” laws typically view a Federal violation as a State violation, so there could also be sanctions at the State level. Just as important, ignoring the Rules heightens exposure to civil lawsuits.

Small businesses aren’t front-line targets for the FTC but a complaint to them from an identity theft victim could trigger an audit. More likely is that you expose your business to legal action for not following Best Practices in protecting customers and the public from a known problem. If a consumer sues, the financial impact could be enormous.