Is this the same as phishing awareness?
Not exactly. Phishing is one type of risk; Red Flags is a broader program focused on identity theft in accounts with deferred payment/credit characteristics.
What’s a “covered account”?
An account primarily for personal/household purposes involving multiple payments or deferment (e.g., tuition plans), or any account with a reasonably foreseeable risk of identity theft.
I’m not in Student Financial Services—does this apply to me?
If your process includes deferred billing/receivables or you can change identity data (addresses, refund destinations) tied to such accounts, the program likely applies.
Should I tell the student/customer I flagged their account?
Not until instructed by the Program Owner/response lead. Premature notice can hinder investigation.
I think a vendor missed something—what now?
Escalate via the incident path; the Program Owner will coordinate with Procurement/Vendor Risk to review controls.