HomeMy WebLinkAbout3144 Resolution RESOLUTION NO. 3t 44
A RESOLUTION APPROVING AN IDENTITY THEFT PREVENTION
PROGRAM TO MEET THE REQUIREMENTS OF THE FAIR AND
ACCURATE CREDIT TRANSACTIONS ACT OF 2003
WHEREAS, The Fair and Accurate Credit Transactions Act of 2003, ("Red Flags
Rule")requires certain financial institutions and creditors with "covered accounts" to prepare,
adopt, and implement an identity theft prevention program to identify, detect, respond to and
mitigate patterns,practices or specific activities which could indicate identity theft; and
WHEREAS, the City maintains certain continuing accounts with utility service
customers and for other purposes which involve multiple payments or transactions, and such
accounts are "covered accounts" within the meaning of the Red Flags Rule; and
WHEREAS,to comply with the Red Flags Rule, the City Council is required to approve
the initial Identity Theft Prevention Program; now
THEREFORE, THE CITY COUNCIL OF PASCO, WASHINGTON HEREBY
RESOLVES AS FOLLOWS:
Staff is hereby authorized and directed to implement the accompanying initial Identity Theft
Prevention Program in accordance with, and to comply with,the Fair and Accurate Credit
Transactions Act of 2003.
PASSED by the City Council of the City of Pasco, Washington, this 16th day of March, 2009.
SIGNED in authentication of its passage this 16th day of March, 2009.
�Lu r J
Joy e is , Mayor
ATTEST APPR AS TO FORM:
s�
W ti
City Clerk Leland B. Kerr, City Attorney
CITY OF PASCO
IDENTITY THEFT POLICY
I. BACKGROUND
The risk to the City, its employees and customers from data loss and identity theft is of significant
concern and can be reduced only through the combined efforts of every employee and contractor.
II. PURPOSE
The City adopts this sensitive information policy to help protect employees, customers, contractors
and the municipality from damages related to the loss or misuse of sensitive information.
This policy will:
1. Define sensitive information;
2. Describe the physical security of data when it is printed on paper;
3. Describe the electronic security of data when stored and distributed; and
4. Place the City in compliance with state and federal laws regarding identity theft protection.
This policy enables the City to protect existing customers, reducing risk from identity fraud, and
minimize potential damage to the City from fraudulent new accounts.
The program will help to:
1. Identify risks that signify potentially fraudulent activity within new or existing covered
accounts;
2. Detect risks when they occur in covered accounts;
3. Respond to risks to determine if fraudulent activity has occurred and act if fraud has been
attempted or committed;
4. Update the program periodically, including reviewing the accounts that are covered and the
identity risks that are part of the program.
III DEFINITIONS
Identity Theft means fraud committed or attempted using the identifying information of another
person without authority.
A Covered Account means:
1. An account that a financial institution or creditor offers or maintains, primarily for personal,
family, or household purposes that involves or is designed to permit multiple payments or
transaction. Covered accounts include credit card accounts, utility accounts, checking
accounts and savings accounts, and
2. Any other account that the financial institution or creditor offers or maintains for which there
is a reasonable foreseeable risk to customers of to the safety and soundness of the financial
institutions or creditor from identity theft, including financial, operational, compliance,
reputation or litigation risks.
"Identifying information" is defined under the Rule as "any name or number that may be
used, alone or in conjunction with any other information, to identify a specific person,"
including: name, address, telephone number, social security number, date of birth,
government issued driver's license or identification number, alien registration number,
government passport number, employer or taxpayer identification number,unique
electronic identification number, computer's Internet Protocol address, or routing code.
II IDENTIFICATION OF RED FLAGS.
In order to identify relevant Red Flags, the Utility considers the types of accounts that it
offers and maintains, the methods it provides to open its accounts, the methods it
provides to access its accounts, and its previous experiences with Identity Theft. The
Utility identifies the following red flags, in each of the listed categories:
A. Suspicious Documents
Red Flags
1. Identification document or card that appears to be forged, altered or inauthentic;
2. Identification document or card on which a person's photograph or physical
description is not consistent with the person presenting the document;
3. Other document with information that is not consistent with existing customer
information (such as if a person's signature on a check appears forged); and
4. Application for service that appears to have been altered or forged.
B. Suspicious Personal Identifying Information
Red Flans
1. Identifying information presented that is inconsistent with other information the
customer provides (example: inconsistent birth dates);
2. Identifying information presented that is inconsistent with other sources of
information (for instance, an address not matching an address on a credit report);
3. Identifying information presented that is the same as information shown on other
applications that were found to be fraudulent;
4. Identifying information presented that is consistent with fraudulent activity(such
as an invalid phone number or fictitious billing address);
5. Social security number presented that is the same as one given by another
customer;
6. An address or phone number presented that is the same as that of another person;
7. A person fails to provide complete personal identifying information on an
application when reminded to do so (however, by law social security numbers
must not be required); and
8. A person's identifying information is not consistent with the information that is
on file for the customer.
2
C. Suspicious Account Activity or Unusual Use of Account
Red Flags
1. Change of address for an account followed by a request to change the account
holder's name;
2. Payments stop on an otherwise consistently up-to-date account;
3. Account used in a way that is not consistent with prior use (example: very high
activity);
4. Mail sent to the account holder is repeatedly returned as undeliverable;
5. Notice to the Utility that a customer is not receiving mail sent by the Utility;
6. Notice to the Utility that an account has unauthorized activity;
7. Breach in the Utility's computer system security; and
8. Unauthorized access to or use of customer account information.
D. Alerts from Others
Red Flay
1. Notice to the Utility from a customer, identity theft victim, law enforcement or
other person that it has opened or is maintaining a fraudulent account for a person
engaged in Identity Theft.
III DETECTING RED FLAGS.
A. New Accounts
In order to detect any of the Red Flags identified above associated with the opening of a
new account, Utility personnel will take the following steps to obtain and verify the
identity of the person opening the account:
Detect
1. Require certain identifying information such as name, date of birth, residential or
business address, principal place of business for an entity, driver's license or other
identification;
2. Verify the customer's identity(for instance,review a driver's license or other
identification card);
3. Review documentation showing the existence of a business entity; and
4. independently contact the customer.
B. Existing Accounts
In order to detect any of the Red Flags identified above for an existing account, Utility
personnel will take the following steps to monitor transactions with an account:
3
Detect
I. Verify the identification of customers if they request information (in person, via
telephone, via facsimile, via email);
2. Verify the validity of requests to change billing addresses; and
3. Verify changes in banking information given for billing and payment purposes.
IV PREVENTING AND MITIGATING IDENTITY THEFT
In the event Utility personnel detect any identified Red Flags, such personnel shall take
one or more of the following steps, depending on the degree of risk posed by the Red
Flag:
A. Prevent and Mitigate
1. Continue to monitor an account for evidence of Identity Theft;
2. Contact the customer;
3. Change any passwords or other security devices that permit access to accounts;
4. Not open a new account;
5. Close an existing account;
6. Reopen an account with a new number;
7. Notify the Program Administrator for determination of the appropriate step(s) to
take;
8. Notify law enforcement; or
9. Determine that no response is warranted under the particular circumstances.
B. Protect customer identifying information
In order to further prevent the likelihood of Identity Theft occurring with respect to
Utility accounts, the Utility will take the following steps with respect to its internal
operating procedures to protect customer identifying information:
1. Ensure that its website is secure or provide clear notice that the website is not
secure;
2. Ensure complete and secure destruction of paper documents and computer files
containing customer information;
3. Ensure that office computers are password protected and that computer screens
lock after a set period of time;
4. Keep offices clear of papers containing customer information;
5. Request only the last 4 digits of social security numbers (if any);
6. Ensure computer virus protection is up to date; and
7. Require and keep only the kinds of customer information that are necessary for
utility purposes.
4
V PROGRAM UPDATES
The Financial Services Manager will serve as the Program Administrator. The Program
Administrator will periodically review and update this Program to reflect changes in risks
to customers and the soundness of the Utility from Identity Theft. In doing so, the
Program Administrator will consider the Utility's experiences with Identity Theft
situations, changes in Identity Theft methods, changes in Identity Theft detection and
prevention methods, and changes in the Utility's business arrangements with other
entities. After considering these factors, the Program Administrator will determine
whether changes to the Program, including the listing of Red Flags, are warranted. If
warranted, the Program Administrator will update the Program.
VI. PROGRAM ADMINISTRATION.
A. Oversight
Responsibility for developing, implementing and updating this Program lies with the
Identity Theft Committee for the City. The Committee is headed by the Program
Administrator. The Utility Billing/Customer Service Manager shall also serve as a
member of the committee. The Program Administrator may appoint other City staff to
the committee as necessary. The Program Administrator will be responsible for the
Program's administration, ensuring the appropriate training of staff, reviewing any staff
reports regarding the detection of Red Flags and the steps for preventing and mitigating
Identity Theft, determining which steps of prevention and mitigation should be taken in
particular circumstances and considering and making periodic changes to the Program.
B. Staff Training and Reports
Personnel responsible for implementing the Program shall be trained either by or under
the direction of the Program Administrator in the detection of Red Flags, and the
responsive steps to be taken when a Red Flag is detected. Staff should prepare a report at
least annually for the Program Administrator, including an evaluation of the effectiveness of
the Program with respect to opening accounts, existing covered accounts, service provider
arrangements, significant incidents involving identity theft and responses, and
recommendations for changes to the Program.
C. Service Provider Arrangements
In the event the City engages a service provider to perform an activity in connection with
one or more accounts, the City will take the following steps to ensure the service provider
performs its activity in accordance with reasonable policies and procedures designed to
detect,prevent, and mitigate the risk of Identity Theft.
1. Require,by contract, that service providers have such policies and procedures in
place; and
2. Require,by contract, that service providers review the City's Program and report any
Red Flags to City staff.
5