Loading...
HomeMy WebLinkAboutORDINANCE - 3204 - 4/28/2009 - IDENTITY THEFT PREVENTION PROGRAMORDINANCE NO. 3204 AN ORDINANCE ADOPTING THE IDENTITY THEFT PREVENTION PROGRAM WHEREAS, the Federal Fair and Accurate Credit Transactions Act of 2003 (FACT Act), which was signed into law on December 4, 2003, required the Federal Trade Commission (FTC) and a number of federal banking agencies to issue joint rules and guidelines regarding the detection, prevention, and mitigation of identity theft by financial institutions and other creditors; and WHEREAS, the Federal Trade Commission issued its final rules and guidelines implementing the pertinent portions of the FACT Act in late 2007 with an effective date of January 1, 2008 and a mandatory compliance date of May 1, 2009; and WHEREAS, the FTC rules require utilities and all other creditors to develop and implement a written Identity Theft Prevention Program that is designed to detect, prevent and mitigate identity theft in connection with the opening of a covered account or any existing covered account, and the rules require the Program to include reasonable policies and procedures designed to accomplish the following: • Identify relevant Red Flags for new and existing covered accounts • Establish a process to detect Red Flags • Respond appropriately to Red Flags detected. • Ensure the Program is updated periodically to reflect changes in risk WHEREAS, the Village of Elk Grove Village is subject to FTC rules referenced above because it owns and operates municipal utilities for the provision of water and waste water services and bills its customers in arrears for such services; and WHEREAS, the Board of Trustees of the Village of Elk Grove Village, having considered its existing practices and past experiences regarding the opening of or access to utility accounts in light of the requirements of the FTC rules, has determined that the Identity Theft Prevention Program that is attached hereto and incorporated herein by this reference is appropriate and should be adopted and approved. NOW, THEREFORE, BE IT ORDAINED by the Mayor and Board of Trustees of the Village of Elk Grove Village, Counties of Cook and DuPage, Illinois as follows: Section 1: The findings and determinations set forth in the preamble to this Ordinance are hereby made findings and determinations of the Board of Trustees of the Village of Elk Grove Village and incorporated into the text of this Ordinance by this reference. Section 2: The Identity Theft Prevention Program attached to this Ordinance is hereby adopted and approved by the Board of Trustees of the Village of Elk Grove Village. Section 3: The Identity Theft Prevention Program shall be implemented and administered by the Director of Finance as the Program Administrator. Section 4: Changes to the Identity Theft Prevention Program of a day-to-day operational character and decisions relating to the interpretation and implementation of the Program may be made by the Program Administrator or his/her designated agent. Section 5: This Ordinance shall be in full force and effect from and after its passage. VOTE: AYES: 6 NAYS: 0 ABSENT: 0 PASSED this 28t11 day of April 2009. APPROVED this 28th day of April 2009. APPROVED: Mayor Craia B. Johnson Village of Elk Grove Village ATTEST: Ann I. Walsh, Village Clerk Red Flag Ordinance VILLAGE OF ELK GROVE VILLAGE IDENTITY THEFT PREVENTION PROGRAM I. PROGRAM ADOPTION The Village of Elk Grove Village ("Village") developed this Identity Theft Prevention Program ("Program") pursuant to the Federal Trade Commission's Red Flags Rule ("Rule"), which implements Section 114 of the Fair and Accurate Credit Transactions Act of 2003. After consideration of the size and complexity of the Village's operations and account systems, and the nature and scope of the Village's activities, the Program was presented and approved by the Village Board on April 28, 2009. II. PROGRAM PURPOSE AND DEFINITIONS A. Fulfilling requirements of the Red Flags Rule The purpose of the Identity Theft Prevention Program is to protect the Village's utility customers from identity theft. The Program is intended to establish reasonable policies and procedures to facilitate the detection, prevention and mitigation of identity theft in connection with the opening of new and existing accounts. The following elements are required for an acceptable identity theft prevention program: • Identify relevant Red Flags for new and existing covered accounts • Establish a process to detect Red Flags • Respond appropriately to Red Flags detected • Ensure the Program is updated periodically to reflect changes in risk B. Red Flags Rule definitions used in this Program The following definitions apply under the Red Flags Rule: Identity The - fraud committed using the identifying information of another person without authority. Red Flag - a pattern, practice, or specific activity that indicates the possible existence of identity theft. Creditor - includes finance companies, automobile dealers, mortgage brokers, utility companies, and telecommunications companies. Also, non-profit and government entities that defer payment for goods or services are to be considered creditors. Covered Account - any account the Village offers or maintains primarily for personal, family or household purposes that involves multiple payments or transactions. Identifying information - any name or number that may be used, alone or in conjunction with any other information, to identify a specific person, including name, address, telephone number, social security number, date of birth, government issued driver's license or identification number, alien registration number, government passport number, employer or taxpayer identification number, unique electronic identification number, computer's Internet Protocol address, or routing code. III. IDENTIFICATION OF RED FLAGS In order to identify relevant Red Flags, the Village considers the types of accounts that it offers and maintains, the methods it provides to open its accounts, the methods it provides to access its accounts, and its previous experiences with identity theft. The Village identifies the following red flags, in each of the listed categories: A. Notifications and Warnings from Credit Reporting Agencies Notice from a credit agency of a credit freeze on a customer Notice from a credit agency of an active duty or fraud alert on a customer B. Suspicious Documents • Identification Documents or Application appears to have been altered or forged • The photo id or physical description does not match the person • Other documents with information that are not consistent with existing customer information C. Suspicious Personal Identifying Information • Identifying information is inconsistent with other information provided by the customer • Identifying information presented is associated with fraudulent activity • The applicant fails to provide all the required identifying information requested • Identifying information is inconsistent with current utility account records • Customer can not provide account security password, if required D. Suspicious Account Activity or Unusual Use of Account • Change of address for an account followed by a request to change the account holder's name • Deposit or initial payment is made but no payments are made thereafter • An existing account with a stable history shows irregularities • Mail sent to the account holder is returned as undeliverable • Multiple inquiries into an existing account E. Alerts from Others • Notice to the Village from a customer, identity theft victim, law enforcement or other person that a utility account has been opened fraudulently 2 IV. DETECTING RED FLAGS A. New Accounts In order to detect any of the identified Red Flags associated with the opening of a new account, Village personnel will take the following steps to obtain and verify the identity of the person opening the account: • If a request to open an account is received by phone or fax, an application requiring a signature will be mailed to the applicant. • If a request to open an account is received at the front counter, an application requiring a signature will be requested to be completed. • Review the information on the application with other documentation provided (real estate transfer declaration, water billing sewer affidavit, etc.) B. Existing Accounts In order to detect any of the Red Flags identified herein for an existing account, Village personnel will take the following -steps to monitor transactions: • Verify the identification of customers if they request information in person or by telephone, facsimile or email. Access to information contained in existing accounts will be limited to the account holder. • Verify the validity of requests to change billing addresses. • Verify changes in banking information received for billing and payment purposes. V. PREVENTING AND MITIGATING IDENTITY THEFT In the event Village personnel detect any identified Red Flags, such personnel shall take one or more of the following steps, depending on the degree of risk posed by the Red Flag: • Continue to monitor an account for evidence of Identity Theft • Contact the customer or property owner • Change password that permits access to the account • Not open a new account • Close an existing account • Notify the Program Administrator or Supervisor • Notify law enforcement • Determine that no response is warranted under the particular circumstances In order to further prevent the likelihood of identity theft occurring with respect to Village accounts, the Village will take the following steps with respect to its internal operating procedures to protect customer information: 3 • Ensure complete and secure destruction of paper documents and computer files containing customer information • Ensure that office computers are password protected • Ensure computer virus protection is up to date • Require and maintain only customer information that is absolutely necessary VI. PROGRAM ADMINISTRATION A. Oversight The initial adoption and approval of the Identity Theft Prevention Program shall be by Ordinance of the Village Board. Thereafter, the Director of Finance shall be the Program Administrator. The Director of Finance or his/her designated agent may make changes to the Program of a day- to-day operational character and decisions relating to the interpretation and implementation of the Program. B. Service Provider Arrangements In the event the Village engages a service provider to perform an activity in connection with one or more accounts, the Village will require the service provider to perform its activity in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft and report any Red Flags to the Program Administrator C. Specific Program Elements and Confidentiality For the effectiveness of the Program, the Red Flag Rule envisions a degree of confidentiality regarding the Village's specific practices relating to identity theft detection, prevention and mitigation. Therefore, under this Program, knowledge of such specific practices is to be limited to those employees who need to know them for purposes of preventing identity theft. Because this Program is to be adopted by a public body and thus publicly available, it would be counterproductive to list these specific practices here. Therefore, only the Program's general Red Flag detection, implementation and prevention practices are listed in this document. 2