Under a new Federal regulation, by November 1, 2008, banks, credit unions, mortgage lenders, auto dealers, credit card lenders, payday lenders, landlords, utility companies, phone companies, and any business that extends credit, must perform a risk assessment to identify "red flag" weaknesses in their systems and procedures that could lead to identity theft. The companies should then take steps to develop a written Identity Theft Prevention Program.