Skip to Content

Red Flags Rule Program

List of Red Flags


It is a vital component of the program that any faculty member, staff member, or student that has responsibility for covered accounts (see Definition of Terms), or transactions that are posted to covered accounts, is familiar with the red flags indicating the possibility of identity thieves using someone else's identifying information at the University to commit fraud.

These are common examples of Red Flags, and you may find that some of those listed here apply to your process while others may not. Additionally, we are looking to you and to your supervisors to help identify other Red Flags that may not be listed here, but may apply to your particular process


Over-the-Counter Transactions


Suspicious Personal Identifying Information

  • Identification document or card that appears to be forged, altered or inauthentic;
  • Identification document or card on which a student or patient's photograph or physical description is not consistent with the person presenting the document;
  • Identifying information presented that is inconsistent with other information the student or patient provides (for example, inconsistent birth dates);
  • Identifying information presented that is inconsistent with other sources of information (for instance, an address on identification not matching an address in the student system);
  • Identifying information presented that is the same as information shown on other applications that were found to be fraudulent;
  • Identifying information presented that is consistent with fraudulent activity (such as an invalid phone number or fictitious billing address);
  • Social security number presented that is the same as one given by another student or patient;
  • An address or phone number presented that is the same as that of another student or patient;
  • A student or patient fails to provide complete personal identifying information on an application when reminded to do so (however, by law social security numbers must not be required);
  • A student or patient’s identifying information is not consistent with the information that is on file for the customer; and
  • A student or patient who has an insurance number but never produces an insurance card or other physical documentation of insurance.

Suspicious Documents
  • Identification document or card that appears to be forged, altered or inauthentic;
  • Identification document or card on which a student or patient's photograph or physical description is not consistent with the person presenting the document;

Account Oversight


Notifications and Warnings from Credit Reporting Agencies
  • Report of fraud accompanying a credit report;
  • Notice or report from a credit agency of a credit freeze on a customer
    or applicant;
  • Notice or report from a credit agency of an active duty alert for an
    applicant; and
  • Indication from a credit report of activity that is inconsistent with a
    customer's usual pattern or activity.

Suspicious Account Activity or Unusual Use of Account
  • A complaint or question from a student or patient based on the person's receipt of:
    1. a bill for another individual;
    2. a bill for a product or service that the student or patient denies receiving;
    3. a bill from a higher education institution or health care provider that the student or patient never patronized;
    4. a notice of insurance benefits (or Explanation of Benefits) for services never received.

  • Change of address for an account followed by a request to change the account holder's name;
  • Payments stop on an otherwise consistently up-to-date account;
  • Account used in a way that is not consistent with prior use (for example, very high activity);
  • Mail sent to the account holder is repeatedly returned as undeliverable;
  • Notice to the University that a customer is not receiving mail sent by the University;
  • Breach in the University's computer system security;
  • Notice to the University that an account has unauthorized activity;
  • Unauthorized access to or use of student account information; and
  • A notice or inquiry from an insurance fraud investigator for a private insurance company or a law enforcement agency.

Alerts from Others
  • Notice to the University from a customer, identity theft victim, law enforcement or other person that it has opened or is maintaining a fraudulent account for a person engaged in Identity Theft.


Questions about the University of Virginia's Red Flag Rule Program? Contact us at: redflagsrule@virginia.edu.