Loading...
HomeMy WebLinkAboutRESOLUTION NO. 2008-51 - ADOPTING IDENTITY THEFT PREVENTION PROGRAM RESOLUTION NO. 2008-5I RESOLUTION ADOPTING IDENTITY THEFTPREVENTION PROGRAM WHEREAS, The Red Flag Rule requires any entity where there is a risk of identity theft to develop and implement an Identity Theft Prevention Program. The Program must include reasonable policies and procedures for detecting, preventing, and mitigating identity theft. The rude was issued by the Federal 'Trade Commission with a compliance date of November 1, 2008, and includes all U.S. utilities. WHEREAS, All utilities are required to comply with this regulation. NOW, THEREFORE„ BE IT FURTHER RESOLVED, By the City Council of the City of Fairfax, Iowa, that the Mayor and City Cleric are hereby authorized and directed to execute said Resolution. Passed and approved this 141h day of October, 2008. AYES: Beer, Frieden, Magers,Rabe, Wainwright NAYS: None ABSENT: None Bill Voss, Mayor ATTEST: Vickie Kindl, City Clerk CITY OF FAIRFAX WATER DEPARTMENT Identity Theft Prevention Program Effective as of October 14, 2008 I. INTRODUCTION The City of Fairfax Water Department ("the Utility") developed this Identity Theft Prevention Program ("Program") pursuant to the Federal Trade Commission's ("FTC") Red Flag Rule, which implements Section 114 of the Fair and Accurate Credit Transaction Act of 2003. 16 C.F.R. § 681.2. This Program is designed to detect, prevent, and mitigate Identity Theft in connection with the opening and maintenance of certain utility accounts. For purposes of this Program, "Identity Theft" is considered to be "fraud committed using the identifying information of another person." The accounts addressed by the Program ("the Accounts") are defined as: 1. An account the Utility offers or maintains primarily for personal, family, or household purposes, that involves multiple payments or transactions; and 2. Any other account the Utility offers or maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness of the Utility from Identity Theft. This Program was developed with oversight and approval of the Fairfax City Council. After consideration of the size and complexity of the Utility's operations and Account systems, and the nature and scope of the Utility's activities, the City Council determined that this Program was appropriate for the City of Fairfax Water Department, and therefore approved this Program on October 14, 2008. II. IDENTIFICATION OF RED FLAGS A "Red Flag" is a pattern, practice, or specific activity that indicates the possible existence of Identity Theft. In order to identify relevant Red Flags, the Utility considered the types of Accounts that it offers and maintains, the methods it provides to open its Accounts, the methods it proves to access its Accounts, and its previous experiences with Identity Theft. The Utility identifies the following Red Flags, in each of the listed categories: A. Suspicious Documents 1. Receiving documents that are provided for identification that appear to be forged or altered. 2. Receiving documentation on which a person's photograph or physical description is not consistent with the person presenting the documentation. 3. Receiving other documentation with information that is not consistent with existing customer information. 4. Receiving an application for service that appears to have been altered or forged. B. Suspicious Personal Identifying Information 1. A person's identifying information is inconsistent with other sources of information. 2. A person's identifying information is inconsistent with other information provided by the customer. 3. A person's identifying information is the same as shown on other applications found to be fraudulent. 4. A person's identifying information is consistent with fraudulent activity. 5. A person's address or phone number is the same as that of another person. 6. A person fails to provide complete personal identifying information on an application when reminded to do so. 7. A person's identifying information is not consistent with the information that is on file for the customer. C. Unusual Use Of or Suspicious Activity Related to an Account 1. A change of address for an Account followed by a request to change the Account holder's name. 2. An account being used in a way that is not consistent with prior use. 3. Mail sent to the Account holder is repeatedly returned as undeliverable. 4. The Utility receives notice that a customer is not receiving his paper statements. 5. The Utility receives notice that an Account has unauthorized activity. D. Notice Regarding Possible Identity Theft 1. The Utility receives notice from a customer, an identity theft victim, law enforcement, or any other person that it has opened or is maintaining a fraudulent Account for a person engaged in Identity Theft. III. DETECTION OF RED FLAGS In order to detect any of the Red Flags identified above with the opening of a new Account, Utility personnel will take the following steps to obtain and verify the identity of the person opening the Account: 1. Requiring certain identifying information such as name, address, driver's license, or other identification. 2. Independently contacting the customer. In order to detect an of the Red Flags identified above for an existing Account, Utility personnel will take the following steps to monitor transactions with an Account: 1. Verifying the identification of customers if they request information. 2. Verifying the validity of requests to change billing addresses. IV. PREVENTING AND MITIGATING IDENTITY THEFT In the event Utility personnel detect any identi8fied Red Flags, such personnel shall take one or more of the following steps, depending on the degree of risk posed by the Red Flag: 1. Continuing to monitor an Account for evidence of Identity Theft. 2. Contacting the customer. 3. Changing any passwords or other security devices that permit access to Accounts. 4. Reopening an Account with a new number. 5. Not opening a new Account. 6. Closing an existing Account. 7. Notifying law enforcement. 8. Determining that no response is warranted under the particular circumstances. 9. Notifying the Program Administrator (as defined below) for determination of the appropriate step(s) to take. In order to further prevent the likelihood of Identity Theft occurring with respect to Utility Accounts, the Utility will take the following steps with respect to its internal operating procedures: 1. Ensuring complete and secure destruction of paper documents and computer files containing customer information. 2. Ensuring that office computers are password protected and that computer screens lock after a set period of time. V. UPDATING THE PROGRAM AND THE RED FLAGS The Program will be periodically reviewed and updated to reflect changes in risks to customers and the soundness of the Utility from Identity Theft. At least every year, the Program Administrator will consider the Utility's experiences with Identity Theft situation, changes in Identity Theft methods, changes in Identity Theft detection and prevention methods, changes in types of Accounts the Utility maintains, and changes in the Utility's business arrangements with other entities. After considering these factors, the Program Administrator will determine whether changes to the Program, including listing of Red Flags, are warranted. If warranted, the Program Administrator will present the City Council with her or her recommended changes and City Council will make a determination of whether to accept, modify, or reject those changes to the Program. VI. PROGRAM ADMINISTRATION The Utility's Program will be overseen by a Program Administrator. The Program Administrator shall be the City Clerk. The Program Administrator will be responsible for the Program's administration, for ensuring appropriate training of Utility staff on the Program, for reviewing any staff reports regarding the detection of Red Flags and the steps for preventing and mitigating Identity Theft, determining which steps of prevention and mitigation should be taken in particular circumstances, reviewing and, if necessary, approving changes to the Program.