HomeMy WebLinkAboutDraft Fair and Accurate Credit Transaction Act of 2003 FACTA Red Flags Rules Policy 04-21-2009-4nORANGE COUNTY
BOARD O~ GOMMISSIONERS
ACTION AGENDA ITEM ABSTRACT
Meeting Date: April ~ 1, 2449
Action Agenda
Itenn No. ~' ~~ n
SUBJECT: Fair and Accurate Credit Transactions Act of 2043 "FACTA" Red Fla s Rules
DEPARTMENT: Duman Resources PUBLIC HEARING: YIN} ~ No
ATTAC~HM ~-NT~S~:
Draft Change County Identity Theft
Prevention Program Policy
INFORMATION CONTACT:
Annette Moore, Staff Attorney
245-23 ~ ?'
PtJRPt3SE: To consider adopting an Identity Theft Prevention Program Policy to comply with
the federal Fair and Accurate Credit Transactions Act of 2443 ~"FACTA"} Red Flags Rules.
BAGKGROUND: C)n~ November 9, ZOO?', the federal government published the "Red Flags
Rule," pursuant to the Fair and Accurate Credit Transactions Act of 2443 ~"FACTA"}. Red Flags
are atterns radices or s ecific activities indicatin the. ossible existence of identity theft.
p ~p p g p
Examples of red flags include: suspicious documents, suspicious persona[ identifying
information, unusual .use o or suspicious activity related to an account and notices to customers
of possible identity theft. The Red Flags Rule, while primarily targeted at financial institutions
maintaining large amounts of sensitive consumer information, require both financial institutions
and "other creditors" with covered accounts to develop and implement written "identity theft
prevention programs." The Federal Trade C~on~mission has identified governments as creditors
under the Red Flags Regulations.
An Identity Theft Prevention Program provides methods to detect when accounts are fraudulent;
procedures to prevent establishment of false accounts; procedures to ensure existing accounts
are not being manipulated; and procedures to respond to identity theft. The Red Flags Rule
became effective January 2448. However, compliance by covered entities such as local
governments was expected in November 2445 but extended to May ~ , 2049.
The Red Flags Rule applies to departments within Grange County that are"creditors" and have
"covered accounts." A "creditor" is any entity which regularly extends, renews or continues
credit or arranges for the extension, renewal or continuation of credit. Orange County
Departments allowing clients to receive services and defer payments are "creditors" under the
Rule.
In order to develop an identity Theft Prevention Program the County was required to:
• Assess the existing identity theft risk for new and existing accounts.
~ b C.F.R. ~ 681.2~b)~9}
2
• Case the risk assessment to select measures fired flags} that may be used to detect
attempts to create fraudulent accounts.
® Identify procedures for employees to prevent the establishment of false accounts and
procedures for employees to implement if existing accounts are being manipulated.
® obtain ro ram a royal of the program by the sC~CC or senior designated management
p g pp
by May ~, 2ag9~
• Train appropriate employees on the policies and procedures in the program.
• Provide an annual report to the BGCC or designated senior management. The annual
report should provide any material matters related to the effectiveness of the programs
policies and procedures the oversight and effectiveness of any third party billing and
account establishment entities, a summary of any identity theft incidents and the
response to those incidents, and recommendations for any substantial changes to the
program, ~ any.
In February 24a9, department covered by the Red Flags Rule reviewed their accounts to
determine whether or not they were covered by Red Flags Rule. A task force, made up of
covered de artments, the staff attorney and Information Technology Department, was formed to
P
assess the risk and develop a policy that detected, mitigated and prevented identity theft. The
task force conducted an initial risk assessment of covered accounts and found there was some
risk of identity theft. The task force then identified red flags that could be used to detect
attempts to create fraudulent accounts and identified procedures to prevent and mitigate
incidents of identity theft. The proposed policy also provides for training of staff and an annual
review of the policy by an Identity Theft Prevention Task Force. A draft policy was reviewed by
the County Manager, .the County Attorney and staff covered by the Red Flags Rules. The
attached recommended Identity Theft Prevention Program Policy complies with the Red Flags
Rule.
Some North Carolina Counties have enacted ordinances to comply with the FACTA's Red Flags
Rule. FACTA, and its implementing regulations, are federal not state requirements. Since
Counties in North Carolina have no inherent le islative power and possess only those powers
conferred upon them by the General Assembly, staff ~s recommending the Red Flags Rules be
implemented through an Identity Theft Prevention Program Policy instead of an ordinance.
FINANCIAL IMPACT: There is no current financial impact. However, there may be some
financial impact in the future.
RECt]MMENDATI4]N~S}: The Manager recommends the Saard adopt the Identity Theft
Prevention Program Policy.
~ See Five C's, inc. v. Pasgarotank, X72 S.E.2~ 737, 740 X2009}
~1ltl.l~ T
Orange County
Identity Theft Prevention Program Policy
Purpose. The purpose of this program is to establish an Identity Theft Prevention
Program ~"the Program'"} designed to detect, prevent, and mitigate identity theft
in connection with opening a covered or existing covered account; responding to
such red Bags pattern, practice, or specific activity that indicates the possible
existence of identity theft in a manner that will prevent identity theft} and to
provide far continued administration of the Program. in compliance with Part X81
of Title ~ of the Code of Federal Regulations implementing Section 114 and 3 S
of the Fair and Accurate Credit Transactions Act ~FACTA} of 2~U3.
II, Adoption. This Policy was developed by the Identity Theft Prevention Program
Committee ~"the Committee"} with oversight by the Grange County Manager and
was approved by the Grange County Board of Commissioners. The Committee,
after conducting a risk assessment and considering the size and complexity of the
County's operations and account systems, and the nature and scope of the
County's activities with respect to identity theft, forwarded this Program to the
County Manager for review. The County Manager determined this Pragrana was
appropriate for Drange County and recommended adoption of this Program to the
Board of County Commissioners. The Board of County Commissioners approved
adoption of this program on April , 2a~9.
III. Program. grange County is establishing an Identity Theft Prevention Program to
detect, prevent, and mitigate identity theft. The Program is tailored to C3range
County's size, complexity and the nature of operations and includes reasonable
policies and procedures to:
A. Identify relevant red flags for covered accounts it offers or maintains and
incorporate those red flags into the program;
B. Detect red flags that have been incorporated into the Program;
C. Respond appropriately to any red flags that are detected to prevent and
mitigate identity theft; and
I]. Ensure the Program is updated periodically to reflect changes in risks to
customers and to the safety and soundness of the creditor from identity theft.
The Program incorporates, as appropriate, existing policies and procedures that control
reasonably foreseeable risks of identity theft.
IV. Definitions. Far u ores of this Policy, the following definitions shall apply
p~
A. "County" means the County of Qrange.
,~
~ other than "county, personal identifying information and identity theft prevention committee", definitions
provided in this section are based on the definitions provided in ~ 6 CSR ~ ~~S 1.Z.
4
B, "Covered Account" means ~i} An account that a financial institution or
creditor offers ar maintains, primarily for personal, family, or household
purposes, that involves or is designed to permit :multiple payments or
transactions, such as a credit card account, mortgage loan, automobile loan,
margin account, cell phone account, covered financial institution or creditor
offers or maintains for which there is a reasonable foreseeable risk to
customers or to the safety and soundness of the financial institution or creditor
from. identity theft, including f nancial, operational, compliance, reputation, ar
litigation risks; and ~ii~ any other account that the f nancial institute or creditor
offers or maintains for which there is a reasonably foreseeable risk to
customers a the safety or soundness of the financial institution or creditor
from identity theft, including financial, operational, compliance, reputation, or
litigation risk. .
C. "Credit" means the right granted by a creditor to a debtor to defer payment of
debt or to incur debts and defer its payment or to purchase property or services
and defer payment therefore.
D. "Creditor" means any person who regularly extends, renews, or continues
credit; any person who regularly arranges for the extension, renewal, or
continuation of credit; or any assignee of an original creditor who participates
in the decision to extend, renew, or continue credit.
E. "Customer" includes a person that has a covered account with a creditor.
F. "identity Theft" means a fraud committed or attempted using identifying
information of another person without authority.
G. "Person" means a natural person, a corporation, government or governmental
subdivision or agency, trust, estate, partnership, cooperative, or association.
H. "Personal identifying information" means any name or number that may be
used, alone, or in conjunction with any other that may be used to identify a
speciftc person, including any name, address, telephone number, social
security number, date of birth, government issued driver's license number or
identification number, alien registration. number, government passport
number, employer or taxpayer identification number, unique electronic
identification number, computer's Internet Protocol ~iP} address, routing
number, credit card account information, debit card information, bank account
information and mother's birth name.
. "Red Flag" means any pattern, practice, or specific activity that indicates the
passible existence of identity theft.
J. "Service Provider" means a person that provides a service directly to Urange
County.
R.. "identity Theft Prevention Committee" shall include one member of each
department with covered accounts as well as the County Attorney or their
designee. The departments with covered accounts and shall be represented on
the Cammitt~ee include the departments of, but are ~.ot limited to: Aging,
Financial Services, Health Department, Solid Waste, Revenue, Emergency
Services, Parks and Recreation, Animal Services and Housing and
Community Development.
Draft
Identity Theft Prevention Program Policy
Page Z of 8
S
V. Identif cation of Red Flags. In order to identify relevant Red Flags, the County
considers the types of accounts that it offers and maintains, the methods it
rovides to o en its accounts, the methods it provides to access its accounts, and
p p
its previous experiences with Identity Theft. All County employees responsible
for or involved in the process of opening a covered account, restoring a covered
account or acce ting payment for a covered account shall check for red flags as
p
indicators of possible identity theft and such red flags include, but are not limited
to:
A. Notifications and warnings from Credit Reporting Agencies Red Flags
Report of fraud accompanying a credit report;
2. Notice or report from a credit agency of a credit freeze on a customer or
applicant;
3. Notice or report from a credit agency of an active duty alert far an
applicant; and
4. Indication from a credit report of activity that is inconsistent with a
customer's usual pattern ar activity.
S. Checks returned marked "Refer to Nlaker."
B. Suspicious Documents Red Flags
1, Identification document or card that appears to be forged, altered or
inauthentic;
2. Identification document or card on which a person's photograph or
physical description is not consistent with the person presenting the
document;
3 . Other document with information that is not consistent with existing
customer information such as if a person's signature an a check appears
forged}; and
4. Application for service that appears to have been altered or forged.
C. Suspicious Personal Identifying Information Red Flags
1. Identifying information presented that is inconsistent with other
infornaatian the customer provides example: inconsistent birth dates};
Z. Identifying information presented that is inconsistent with other sources
of information afar instance, an address not matching an address on a
credit report};
3. Identifying information presented that is the same as information shown
on other applications that were found to be fraudulent;
4. Identifying inforncaation presented that is consistent with fraudulent
activity such as an invalid phone number or fictitious billing address};
5: Social security number presented that is the same as one given by
another customer;
Draft
Identity Thef Prevention Program Policy
Page3of8
6. An address ar phone number presented that is the same as that of another
person;
7. A person fails to provide complete personal identifying information an
an application when reminded to do so however, by law social security
numbers :may be required}; and
S. A person's identifying information is not consistent with the information
that is on file for the customer.
D. Suspicious Account Activity or Unusual Use of Account Red Flags
~ . Change of address for an account followed by a request to change the
account holder's name;
2. Payments stop on an otherwise consistently up-to-date account;
3. Account used in a way that is not consistent with prior use example:
very high activity};
4. Nail sent to the account holder is repeatedly returned as undeliverable;
5. Notice to the County that a customer is not receiving mail sent by the
County;
6. Notice to the County an account has unauthorized activity;
7. Breach in the County's computer system security; and
S. Unauthorized access to or use of customer account information.
9. Two or mare returned checks received within a 30 day period from the
same customer.
~. Alerts from ethers Red Flags
1. Notice to the County from a customer, identity theft victim, law
enforcement or other person that it has opened or is maintaining a
fraudulent account for a person engaged in identity Theft.
~I. ~ Detection of Red Flags:
A. New Accounts: n order to detect any of the Red Flags identified above
associated with the opening of a new aceoun~, County personnel wi11 take the
following steps to obtain and verify the identity of the person opening the
account:
1. As a precondition to opening a covered account in the County, each
applicant shall provide certain personal identifying information such as
name, date of birth, residential or business address,' principal place of
business for an entity, driver's license or other identification;
2. County Staff shall verify the customer's identity for instance, review a
driver's license or other identification card} or review documentation
showing the existence of a business entity;
3. Fach account shall be assigned an account number or customer
identification number ~CIN} which shall be unique to that account. The
Draft
Identity 'heft Prevention Progran7 Policy
Page4of8
~1
County may utilize computer software to randomly generate assigned
CINs or to encrypt account numbers and CINs.
B. existing Accounts. In order to detect any of the Red Flags identified above for an
ex~stxng account, County personnel will take the following steps to monitor
transactions with an account:
1. Verify the identification of customers if they request information din
person, via telephone, via facsimile, via email};
2. Verify the validity of requests to change billing addresses; and
3. Verify changes in banking information given for billing and payment
purposes.
4. In the event that credit card payments are made over the Internet or
processed through a third party service provider, such third party service
provider shall certify that its Identity Theft Prevention Policy is adequate
and is incompliance with FACIA and it's implementing Regulations.
5. All credit card payments made aver the telephone or the County's
website sha11 be entered directly into the customer's account information
in the computer database.
6. Account statements and receipts for covered accounts shall include only
the last four digits of the credit or debit card or the bank account used for
payment of the covered account.
7. when receiving credit card payments over the telephone get the 3 or 4
digit card certification code from. the customer.
VII. Preventing and Mitigating Identity Theft. In the event County personnel detect
any identified Red Flags, such personnel must notify the Department Director, or
their designee. The Department Director or their designee shall take one or more
of the following steps, depending on the degree of risk posed by the Red Flag:
A. Prevent and Mitigate
1. Continue to monitor an account for evidence of Identity Theft;
2. Contact the customer;
3. Change any passwords or other security devices that permit access to
accounts;
4. Not open a new account;
5. Close an existing account;
~. Reopen an account with a new number;
7. Notify law enforcement, in the event someone other than the customer has
accessed the customer's account causing additional charges to accrue or
accessing personal identifying information; or
S. Determine that no response is warranted under the particular
circumstances.
Draft
identity The, ft PreventiaM Program Policy
Page S of 8
E~
B. Protect customer identifying information. n order to further prevent the
likelihood of identity theft occurring with respect to customer accounts,
the County will take the following steps with respect to its internal
operating procedures to protect customer identifying information:
. l~nsure that its website is secure or provide clear notice that the website is
not secure;
2. Access to customer accounts shall be password protected and shall be
limited to authorized county personnel;
3. Passwords} shall be changed on a regular basis using the County's
network Password Policy ~IT.NP.o2} in effect at the time of the detection
of the red flag;
4. Ensure complete and secure destruction of paper documents and computer
files containing customer inforrraation;
S. insure that office computers are password protected and that computer
screens lock after a set period of time;
6. R.eep offices clear of papers containing customer information;
7. Request only the last 4 digits of social security numbers cif any};
S. P,nsure computer virus protection is up to date; and
9. Require and keep only the kinds of customer information that are
necessary for County purposes;
o. Any unauthorized access ~o or other breach of customer accounts is to be
re orted immediatel to the County Manager and any password involved
p Y
changed immediately; and
1 .Personal identifying information included in customer accounts is
considered confidential; any requests or demands out of the ordinary
course of business for such information by someone other than the
customer shall be immediately forwarded to the Department Director and
the County Attorney.
VIII. Updating the Program. The County Manager shall annually review and, as
deemed necessary by the County Manager, direct the Identity Theft Prevention
Committee update the Identity Theft Prevention Prograrn along with any relevant red
flags in order to reflect changes in risks to customers or to the safety and soundness of the
County and its covered accounts from identity theft. In updating the Identity Theft
Prevention Program, the Committee shall consider the following factors and exercise its
discretion in amending the program:
A. The County's experience with identity theft;
~, Updates in methods of identity theft;
C. Updates in customary methods used to detect, prevent, and mitigate
identity theft;
D, updates in the types of accounts that the County offers or maintains;
E. updates in service provider arrangements.
.Draft
Identity Theft Prevention Prog~•am Policy
Page ~ of ~
I~. Administration of Program
A. oversight. The identity Theft Prevention Program Committee is responsible
for oversight of the program and program implementation. The Committee is
responsible for reviewing red flags rules compliance reports prepared by
Departments, addressing changing identity theft risks and identifying new or
discontinued covered accounts within the County. Recommendation far
material changes to the program shall be forwarded to the County N~anager
for consideration. The Committee shall report to the County Manager at least
annually, on compliance with the red flag requirements. The County Manager
will then provide a report to the Board of County Commissioners and present
to the board any changes to the policy. The report will address material
matters related to the program and evaluate issues such as:
~ , The effectiveness of the policies and procedures of the County in
addressing the risk of identity theft in connection with the opening of
covered accounts and with respect to existing covered accounts;
2. 'Service provider arrangements;
3. Significant incidents involving identity theft and management's response;
and
4. Recommendation far material changes to the Program.
B. Staff Training and Reports. County staff responsible for implementing the
Program shall be trained either by ar under the direction of the identity Theft
Prevention Program Committee in the detection of Red Flags, and the
responsive steps to be taken when a Red Flag is detected. initial training will
be mandated for all employees who are responsibble for opening new covered
account, restoring an existing covered account or accepting payment for a
covered account with respect to the implementation and requirements of the
identity Theft Prevention Program. The Committee will exercise its
discretion in determining the amount ~ and the substance of the training
necessary; however, periodic updates will be conducted as material program
changes occur.
C. Service Provider Arrangements. In the event the County engages a service
provider to perform an activity in connection with one or mare accounts, the
County will tape the following steps to ensure the service provider performs
its activity in accordance with reasonable policies and procedures designed to
detect, prevent, and mitigate the risk of identity Theft.
1. Require, by contract, that service providers have such policies and
procedures in place; and
Z. Require, by contract, that service providers review the County's Program
and report any Red Flags to the Committee.
Draft
Identity 'heft PreveMtion Program Polzc~
Page 7 of 8
io
D. Specific Program ~len~ents and Confidentiality. ~'or the effectiveness of
Identity Theft prevention Programs, the Iced Flag Mule envisions a degree of
confidentiality regarding the County's specific practices relating to Identity Theft
detection, prevention and mitigation. Therefore, under this Program, knowledge
of some of the specific practices are limited to the Identity Theft Committee and
those employees who need to know them for purposes of preventing Identity
Theft. Therefore, only the Program's general red flag detection, implementation
and prevention practices are listed in this document.
Draft
Identity "heft Prevention Program Policy
Page 8 of 8