If a company says your information was exposed, secure the affected accounts before filing anything. The FTC Red Flags Rule isn't a general data breach complaint form. It covers certain financial institutions and creditors with covered accounts, and those organizations must keep a written identity theft prevention program.

A breach alone doesn't prove the rule was violated. A report won't guarantee an investigation, payment, or response. Report the problem through the route that matches the actual harm.

What the FTC Red Flags Rule actually covers

Section 114 of the Fair and Accurate Credit Transactions Act requires covered financial institutions and creditors to create and operate a written Identity Theft Prevention Program. The FTC describes the framework in its Red Flags Rule guide and 16 CFR Part 681.

Four tasks sit at the center of the program: identify relevant red flags, detect them, respond to them, and keep the program current. The program must fit the organization's size, complexity, and activities. Management oversight is required.

Covered accounts often include consumer credit accounts that allow repeated payments or transactions. Another account can qualify if identity theft creates a reasonably foreseeable risk. Storing personal information alone doesn't bring every business under the rule.

Examples of red flags include inconsistent identification documents, unusual account activity, an address change, a fraud alert, or a warning from a customer, law enforcement agency, or service provider. An exposure involving credentials may affect an organization's risk assessment. It doesn't, by itself, prove a violation.

What the Red Flags Rule does not promise

The rule doesn't tell every business to report every breach to the FTC. Thing is, it also doesn't create a universal 30-day notice deadline. Those duties usually come from a state law or a sector-specific rule that applies to the incident.

It doesn't guarantee free credit monitoring, reimbursement, account deletion, or automatic damages. The company's notice and remediation offer, the type of fraud, other laws, and the available evidence can affect the result.

The rule doesn't replace a bank's fraud department, a credit reporting dispute, or a state breach-notification process. Several reporting tracks can apply to one incident.

After a breach, take these steps first

Secure the account before you write the complaint. The breach notice may be all you have at first, so keep it and add suspicious activity as it appears.

1. Save and check the breach notice. Keep the letter or email, date received, affected account, data categories, and any response deadline. Verify the company through its official website or your statement, not an unexpected email link.

2. Protect active accounts. Call your bank, card issuer, or other account provider using a trusted phone number if credentials or financial information may be exposed. Change reused passwords and turn on multifactor authentication.

3. Consider a credit freeze or fraud alert. A freeze can help limit new-account fraud. A fraud alert tells prospective creditors to take extra steps before opening credit. According to CFPB identity theft guidance, you can contact any one of the three nationwide credit reporting companies for an initial alert, and it must notify the other two. Use each bureau's instructions for a freeze.

4. Use IdentityTheft.gov when misuse has happened. If someone opened an account, made charges, or used your information, use IdentityTheft.gov for an FTC Identity Theft Report and recovery plan. If the notice only says your information was exposed, don't describe that exposure as completed identity theft.

5. Dispute what you don't recognize. Contact the company tied to the account or charge, then contact any credit reporting company showing inaccurate information. Identify each unfamiliar account, inquiry, charge, or collection, and keep confirmation numbers and copies of your communications.

6. Write to the breached company. Ask what information was involved, when the incident occurred, whether your account was secured, and what protective services or next steps it offers. The company may not reveal every security detail. Save the response you receive.

7. Pick the complaint route that fits the problem. The FTC, CFPB, state regulators, credit reporting companies, and the company itself serve different purposes.

How to file an FTC complaint

The FTC has two tools with different jobs. Use IdentityTheft.gov for identity theft that actually occurred. Use the FTC's ReportFraud.ftc.gov portal for suspected fraud, a scam, or business conduct you believe harmed consumers. If you suspect a covered company ignored warning signs after a breach, report the facts there without presenting the legal violation as settled.

Include:

• the company's name and the product, service, or account involved
• the date of the breach notice and the dates of suspicious activity
• the type of information exposed or misused
• the warning signs you noticed and the company's response
• the steps you took, including calls, disputes, freezes, and account closures

Use plain dates and facts. Don't include passwords, one-time authentication codes, or a full Social Security number in your narrative. Upload identity documents only through an official, secure form when they are specifically requested.

An FTC report isn't a private lawsuit or a guaranteed personal payment. It can help agencies spot patterns, make referrals, and decide where enforcement attention may be useful.

Show the warning signs with a short timeline

A dated sequence gives an agency something concrete to review. Note the warning sign, when the company learned about it, and what happened afterward.

To be honest, the timeline matters more than a legal label. You can adapt this structure:

On [date], I received a notice from [company] stating that [type of information] may have been exposed.

On [date], I saw [unfamiliar account, charge, login, address change, or other warning sign].

I contacted [company] on [date] through [channel]. The response was [brief factual description].

The concern remains [unresolved account, inaccurate credit item, continuing charge, or other harm].

I am asking the agency to review the company's response to these warning signs.

Avoid writing only, "the company violated the Red Flags Rule." Show what happened instead. That makes the complaint easier to assess.

Choose the right escalation path

Turns out, one breach can create separate problems. The right destination changes with the harm.

The CFPB route isn't a replacement for an FTC identity theft report. It may help when a financial company, credit reporting company, or related provider hasn't resolved the underlying account problem.

Common questions

Does every data breach violate the Red Flags Rule?

No. The rule reaches only covered organizations and covered accounts. An evaluation would also consider the company's program, the relevant warning signs, and its response.

Is there a 30-day FTC reporting deadline?

No, not under this rule. Another state or federal rule may impose a deadline based on the business, information involved, and consumers affected.

Can an FTC complaint make a company compensate me?

Not automatically. The FTC complaint system collects information and may support enforcement or referrals; it doesn't guarantee a refund or damages award.

Do I need confirmed identity theft before contacting the breached company?

No. Contact the company after receiving a breach notice or if you have a security concern. Use the identity theft reporting tool when you have evidence that someone misused your information.

Save the breach notice and write down every account, charge, or credit inquiry you don't recognize. If misuse is active, contact the provider, use a freeze or alert, and file the FTC report that matches the facts.