Loading...
HomeMy WebLinkAboutResolution - 3211 STATE OF CALIFORNIA ) RESOLUTION NO. 3211 COUNTY OF RIVERSIDE)ss CITY OF SAN JACINTO ) A RESOLUTION OF THE CITY OF SAN JACINTO CITY COUNCIL ADOPTING AN IDENTITY THEFT PREVENTION PROGRAM WHEREAS, the Fair and Accurate Credit Transaction Act of 2003 ("FACTA"), section 114, as implemented by the Red Flag Rules, 16 C.F.R. § 681.2, issued by the Federal Trade Commission along with other federal agencies, requires creditors of customer accounts to implement an Identity Theft Prevention Program; and WHEREAS, the City of San Jacinto is a creditor because it provides services to customers prior to receipt of payment through customer accounts, including utility service accounts, which are maintained primarily for personal, family or household purposes and involve multiple payments or transactions, and for which there is a reasonably foreseeable risk of identity theft; and WHEREAS, the City of San Jacinto is therefore required to implement an Identity Theft Prevention Program; and WHEREAS, the purpose of the Identify Theft Prevention Program is to detect, prevent and mitigate identity theft in connection with all customer accounts, taking into consideration the level of risk for identity theft given the City of San Jacinto's scope of services provided and the types of accounts; and WHEREAS, the Identify Theft Prevention Program is created to identify patterns, practices and specific activities that indicate the possible existence of identity theft, referred to as "Red Flags," and sets forth the procedures for detecting Red Flags and responding to Red Flags when discovered; and WHEREAS, the City of San Jacinto desires to adopt and implement an Identity Theft Protection Program as required under Federal Law; NOW, THEREFORE, BE IT RESOLVED by the City of San Jacinto as follows: Section 1.Adoption of Identity Theft Prevention Program. The City of San Jacinto hereby adopts the "Identity Theft Prevention Program" attached hereto as Exhibit "A". Section 2.Designation of Authority. The City Council of the City of San Jacinto authorizes the City Manager or his/her designee to act on the City of San Jacinto's behalf to oversee the implementation and administration of the Identity Theft Prevention Program in accordance with Federal Law. Section 3.Amending the Identity Theft Prevention Program. The Identity Theft Prevention Program may be amended from time to time by resolution of the City of San Jacinto. Page 1 of 2 Section 4.Effective Date. This Resolution shall be effective as of November 1, 2008. APPROVED, PASSED, and ADOPTED by the City Council of the City of San Jacinto at a regular meeting held on the 23rd day of October, 2008. Ayes: Carlson, Mansperger, Potts, Stubblefield Nays: None Abstain: None Absent: Ayres `\\,itltilill( {, c i r y'�� �;' City of San Jacinto � `tip o rd . By Chris Carlson, Vice Mayor >,. �n J. Q, ATTEST: orothy L. ouinard, City Clerk APPROVED AS TO FORM: Jeffrey . Ballinger, City Attorney Best, Best & Krieger, LLP Page 2 of 2 EXHIBIT "A" CITY OF SAN JACINTO IDENTITY THEFT PREVENTION PROGRAM I. PURPOSE The Fair and Accurate Credit Transaction Act of 2003 ("FACTA"), section 114, as implemented by the Red Flag Rules, 16 C.F.R. § 681.2, issued by the Federal Trade Commission along with other federal agencies requires creditors of customer accounts to implement an Identity Theft Prevention Program. Pursuant to the regulations, the City of San Jacinto is a creditor because it provides services to customers prior to receipt of payment through customer accounts, including utility service accounts, which are maintained primarily for personal, family or household purposes and involve multiple payments or transactions, and for which there is a reasonably foreseeable risk of identity theft. Therefore, the City of San Jacinto is required to implement an Identity Theft Prevention Program. The purpose of this Identify Theft Prevention Program ("Program") is to detect, prevent and mitigate identity theft in connection with all customer accounts, taking into consideration the level of risk for identity theft given the City of San Jacinto's scope of services provided and the types of accounts. This Program is created to identify patterns, practices and specific activities that indicate the possible existence of identity theft, hereinafter referred to as "Red Flags." The Program sets forth the procedures for detecting Red Flags and responding to Red Flags when discovered. 11. DEFINITIONS "Red Flag" shall mean a pattern, practice or specific activity that indicates the possible existence of identity theft as defined in the Red Flag Rules, and as specifically enumerated in Section V. 16 C.F.R. § 681.2. "Identity theft" shall mean a fraud committed or attempted using the personal identifying information of another person without his/her authority. 16 C.F.R. 603.2 (a). "Customer account" shall mean a utility service account or other account provided by the City of San Jacinto that constitutes a "covered account" under the Red Flag Rules. "Personal identifying information" shall mean information that may be used to identify a specific person, including, but not limited to, a social security number, date of birth, government issued driver's license or identification number, government passport number, unique biometric data such as fingerprints or physical appearance, any unique electronic identification number, telephone number or address. III. DESIGNATION OF AUTHORITY The City Council of the City of San Jacinto designates the authority to develop, oversee, implement and administer the Program to the City Manager or his/her designee. As part of the City Manager/designee's oversight responsibilities for the Program, the City Manager/designee is required to review and approve all material changes to the Program as necessary to address changing identity theft risks. The City Manager/designee is also responsible for reviewing reports prepared by the City of San Jacinto's staff regarding the City of San Jacinto's compliance with FACTA and the Red Flag Rules requiring the implementation of an Identity Theft Prevention Program. IV. COMPLIANCE REPORTS TO BE PREPARED BY CITY OF SAN JACINTO STAFF The City Manager/designee will designate City of San Jacinto staff involved with the implementation of the Program to prepare reports regarding the City of San Jacinto's compliance with FACTA and the Red Flag Rules requiring the implementation of an Identity Theft Prevention Program. The reports should address material matters related to the Program, such as the following: (a) The effectiveness of the City of San Jacinto's policies and procedures to address the risk of identity theft in connection with opening customer accounts, as well as with existing accounts. This includes identifying any issues related to identifying, detecting and responding to Red Flags; (b) Third-party service provider arrangements; (c) Significant incidents of identity theft or Red Flag detection, and the City of San Jacinto's responses to those incidents; (d) Recommendations for material changes to the program to ensure that customer accounts are adequately protected from the risk of identity theft. The reports should be prepared at least annually for review by the City Manager/designee. V. RED FLAGS IDENTIFIED BY THE CITY OF SAN JACINTO In identifying the Red Flags applicable to the City of San Jacinto's customer accounts, the City of San Jacinto considered the following risk factors: (a) The types of accounts the City of San Jacinto maintains; (b) The methods the City of San Jacinto provides to open customer accounts; (c) The methods the City of San Jacinto provides to access to customers' accounts; (d) The City of San Jacinto's previous experiences with identity theft in connection with the customer accounts. The Red Flags identified in this Program have been incorporated from sources, which include supervisory guidance, past incidents of identity theft, and changes in methods of identity theft risk. The City of San Jacinto's Identified Red Flags are as Follows: Alerts, notifications or other warnings received from consumer reporting agencies or service providers providing fraud protection services: • Fraud or active duty alerts from consumer reports. • Notice of a credit freeze from a consumer reporting agency in response to request for a consumer report. • Notice of address discrepancy provided by a consumer reporting agency. • A consumer report indicates a pattern of activity that is inconsistent with the history or usual pattern of activity of a customer or applicant. • Recent significant increase in the volume of inquiries of the customer's credit. • Unusual number of recently established credit relationships. • A material change in the use of credit, especially in regards to credit relationships recently established. • A customer had an account with the City of San Jacinto or any other creditor that was closed for cause or identified for abuse of account privileges. Suspicious Documents: • Documents used for identification purposes appear to have been altered or forged. • The photograph or physical description on the identification documents does not match the appearance of the person presenting the identification. • Other information in identification documents does not match the information provided by the individual presenting the identification documents. • Other information in the identification documents does not match the information on file with the City of San Jacinto. • The application to open the account appears to have been forged, altered, or gives the appearance of having been destroyed and reassembled. Suspicious Personal Identifying Information: • Personal information provided is inconsistent with information provided by an external source, for example where the address provided does not match the address contained in a consumer report. • Personal identifying information is inconsistent with other personal identifying information provided by the customer; such as a date of birth and the social security number range that do not correlate. • Personal identifying information provided is associated with known fraudulent activity, as indicated by internal or third- party sources, such as the address or phone number on an application was previously provided on another fraudulent application. • Personal identifying information is of a type commonly associated with fraudulent activity, as indicated by internal or third-parry sources, such as a fictitious address, or an invalid phone number. • The social security number provided is the same as the social security number of another applicant attempting to open an account or an existing customer. • The address or telephone number provided is the same as other individuals attempting to open an account or existing customers. • The individual opening the account cannot provide all of the required personal identifying information for an application. • Personal identifying information is inconsistent with the information provided by the customer on file with the City of San Jacinto. • Where challenge questions are used by the City of San Jacinto to verify the identity of an individual, the individual claiming to be the customer cannot answer challenge questions correctly. Unusual Use of or Other Suspicious Activity Related to a Customer Account: • Shortly after receiving a notice of change of address for the account, the City of San Jacinto receives a request to add another name to the account. • A new account is used in a manner commonly associated with known patterns of fraud, such as a first payment is made, and then no subsequent payments are made. • An account is used in a manner inconsistent with the established pattern of activity for the account, such as a nonpayment where there was never been a late or missed payment. • An inactive account becomes active. • Mail sent to the customer is returned repeatedly. • The City of San Jacinto is notified that a customer is not receiving his/her paper account statements. • The City of San Jacinto is notified of unauthorized transactions on a customer's account. Notice of Possible Identity Theft: • The City of San Jacinto is notified by a customer of possible identity theft in connection with his/her account. • The City of San Jacinto is notified by a victim of identity theft of possible identity theft in connection with a customer account. • The City of San Jacinto is notified by law enforcement of possible identity theft in connection with a customer account. • The City of San Jacinto is notified by others of possible identity theft in connection with a customer account. VI. PROCEDURES FOR DETECTING RED FLAGS The following procedures are being implemented by the City of San Jacinto to detect the Red Flags identified with opening of accounts and existing accounts identified above: (a) Obtain personal identifying information of an individual to verify his/her identity prior to opening an account. (b) Authenticate the identity of customers when they are requesting information about their accounts. (c) Authenticate the identity of customers when they are requesting to make any changes to their accounts. (d) Verify the validity of all billing address change requests. (e) Conduct a credit check when opening a new account. (f) Monitor transactions. (g) Verify all requests to change banking information used for payment purposes. Members of the City of San Jacinto's staff will be assigned and trained to detect Red Flags. In addition, the City of San Jacinto may employ the services of a third party service provider and/or utilize computer software programs to assist in detecting Red Flags. VII. ADDRESS DISCREPANCIES IN CONSUMER REPORTS Title 15 of the Code of Federal Regulations, section 1681 c, requires consumer reporting agencies to notify a requestor in writing, such as the City of San Jacinto, where the address provided by the City of San Jacinto for a consumer substantially differs from the address the consumer reporting agency has on file for that consumer. Upon receipt of a notice of an address discrepancy for a consumer, the Red Flag Rules, 16 C.F.R. § 681.1, require the City of San Jacinto to verify the identity of the consumer for whom the consumer report was obtained in order to form a reasonable belief that the City of San Jacinto knows the identity of the consumer through one or more of the following methods: (a) Verify the information in the consumer report with the consumer. (b) Verify the consumer's address through the records of applications, address change notifications, and other account records for the consumer maintained by the City of San Jacinto, or retained CIP documentation (c) Verify the consumer's address through information from third- parties. (d) Use any other reasonable means. Newly Established Accounts For newly established accounts for which a notice of address discrepancy was received, the City of San Jacinto must provide to the consumer reporting agency that furnished the notice of address discrepancy the address that the City of San Jacinto has reasonably confirmed to be accurate under the following circumstances: (a) The City of San Jacinto can form a reasonable belief that the consumer report relates to the consumer for whom the report was requested; (b) The City of San Jacinto establishes a continuing relationship with the consumer; and (c) The City of San Jacinto regularly in the ordinary course of business provides information to the consumer reporting agency from which the notice of address discrepancy was obtained. The consumer's address can be confirmed through the following methods: (a) Verify the information in the consumer report with the consumer. (b) Verify the consumer's address through the records of applications, address change notifications, and other account records for the consumer maintained by the City of San Jacinto. (c) Verify the consumer's address through information from third- parties. (d) Use any other reasonable means. The City of San Jacinto must provide the consumer reporting agency the address that the City of San Jacinto has reasonably confirmed to be accurate as part of the information the City of San Jacinto regularly furnishes for the reporting period in which the City of San Jacinto establishes a relationship with the consumer. Red Flags A notice of address discrepancy constitutes a Red Flag, and the City of San Jacinto will take the necessary action to respond appropriately. VIII. PROCEDURES FOR RESPONDING TO RED FLAGS In order to prevent and mitigate identity theft, and after taking into consideration the risks of identity theft applicable to the customer accounts, the City of San Jacinto implements the following procedures to respond to all Red Flags that are discovered. One or more of these procedures will be used each time a Red Flag is detected: (a) Monitor accounts for evidence of identity theft. (b) Contact the Customer. (c) Change or add a password, security code or other device that provides access to the account. (d) Reopen an account with a new account number. (e) Close an existing account. (f) Not open a new account. (g) Not selling an account to a debt collector. (h) Not attempting to collect on an account. (i) Notify law enforcement. (j) Determine that no response is warranted given the particular circumstances. (k) Ask the customer to appear in person with government issued identification. (1) Require a deposit to be paid before providing service. (m) Do not provide account information to anyone other than the account holder, or other individual authorized by the account holder. (n) Update all account information. (o) Deactivate payment method, such as a credit card registered for online payment. (p) Connect or disconnect service. (q) Initiate an investigation. In addition to any of the actions above, the Finance Director will be notified of any Red Flags discovered. IX. TRAINING OF STAFF City of San Jacinto staff that will be directly involved with opening customers' account or servicing customer accounts in a manner that would place them in a position to detect Red Flags, or allow them access to customers' private information shall be trained to detect Red Flags and appropriately respond when Red Flags are discovered. The City of San Jacinto's staff participation is crucial to the effective implementation of this Program. The City Manager/designee will oversee all staff training to ensure that training is adequate to ensure effective implementation of the Program. X. OVERSIGHT OF THIRD-PARTY SERVICE PROVIDER INVOLVED WITH CUSTOMER ACCOUNTS If, the City of San Jacinto employs a third-party service provider to perform any activity in connection with a customer account, the City Manager/designee is responsible for ensuring that the activity is conducted in compliance with reasonable polices and procedures to detect, prevent and mitigate the risk of identity theft. This may be achieved by requiring that a third-party service provider has policies and procedures to detect the Red Flags identified by the City of San Jacinto, and also requiring the third-party service provider to review the City of San Jacinto's Program and agree to report any Red Flags to the City Manager/designee. XI. USE OF A THIRD PARTY SERVICE PROVIDER TO ASSIST IN THE IMPLEMENTATION OF THE PROGRAM The City of San Jacinto may hire a third-party service provider in order to implement this Program. The third-party service provider may provide services such as the implementation and administration of computer software programs that detect Red Flags. If a third-party service provider is used to assist in the detection of Red Flags, the third-party service provider is required to immediately notify the City Manager/designee if any Red Flags are discovered. The City Manager/desingee is responsible for overseeing any third-party service provider in an appropriate and effective manner. The City Manager/designee's oversight shall include periodic meetings and/or receipt and review of periodic reports from the third-party service provider regarding what services are being provided, any Red Flags that have been detected, and any possible modifications to the services provided to increase the effectiveness. XII. PERIODIC IDENTIFICATION OF CUSTOMER ACCOUNTS The City Manager/designee will periodically review the types of accounts it maintains for customers to determine which are "covered accounts" under the Red Flag Rules, and therefore are subject to this Program. XIII. PERIODIC UPDATE OF THE PROGRAM This Program shall be updated periodically to ensure that the identified Red Flags, the procedures to detect Red Flags, and the responses to the Red Flags when discovered adequately protect customers from identity theft. The updating of the Program should take into consideration any changes in the customers' level of risk of identity theft by looking at the following factors: (a) The City of San Jacinto's recent experiences with identity theft in connection with the customer accounts. (b) Changes in methods of identity theft. (c) Changes in methods of detecting, preventing and mitigating identity theft. (d) Changes in the types of customer accounts offered. (e) Changes in arrangements with any third-party service providers involved in the implementation of the Program. City of San Jacinto staff or the City Manager/designee may recommend modifications to the Program. However, any modification to the Program may not be implemented unless first approved by the City Council by Resolution.