HomeMy WebLinkAboutFS 2009-03-03 Item 2D - Resolution - Identity Theft Prevention Program (Red Flag Rules)
City of Tukwila
Jim Haggerton, Mayor
INFORMATIONAL MEMORANDUM
FROM:
Mayor Haggerton
Finance and Safety Committee
Shawn Hunstock, Finance Director~
TO:
DATE:
February 18, 2009
SUBJECT:
Adoption of Red Flags Rule Program
ISSUE
The Federal Trade Commission issued regulations requiring businesses to adopt identity theft detection
and prevention policies and procedures. The policies and procedures must be in place by May 1, 2009.
BACKGROUND
The Red Flags Rule is a consumer protection law passed by Congress in 2003. The purpose of the Red
Flags Rule is to put in place procedures which will prevent or detect the release of information that
could lead to identity theft. The Rule specifically applies to utility accounts according to the law passed
by Congress.
The identity theft policies and procedures, referred to as a "Program" in the law passed by Congress,
must be approved by the City Council. I am identified as the Program Administrator in the proposed
policies.
DISCUSSION
The Program applies to utility accounts specifically, as well as "any other account the City offers or
maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness
of the City from identity theft." It has not been determined at this time how far reaching the Program
applies, but that will be determined during implementation and training. The issue is most relevant,
however, to utility accounts given the nature of the information the City maintains and how that
information might be used. For instance, changing a name or address on a utility account could help an
individual, using the utility bill, in getting a driver's license or other forms of identification.
As a part of the Program, the City will conduct on-going training for employees on the prevention and
detection of identity theft. We will also be working with third-party service providers, such as credit card
processing companies, to insure they agree to comply with the City's identity theft prevention policies.
RECOMMENDATION
The Council is being asked to consider a resolution adopting an Identity Theft Prevention Program. This
issue will be presented at the March 3, 2009 Finance and Safety Committee Meeting, the March 9,
2009 Committee of the Whole Meeting and the March 23, 2009 Special Meeting. Because the policy
must be approved and implemented, including training, by May 1, 2009, consideration of this issue at
the March 23, 2009 Special Meeting will allow more time for employee training.
ATTACHMENTS
. Draft Resolution adopting the Program.
. Draft copy of Identity Theft Prevention Program.
. Letter from Shelley Kerslake, City Attorney, dated February 18, 2009.
DRAFT
A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF TUKWILA,
WASHINGTON, APPROVING AND ADOPTING AN IDENTITY THEFT
PREVENTION PROGRAM.
WHEREAS, the City has a water-sewer utility providing water and/ or sewer
utility services pursuant to Title 57 ROY; and
YVHEREAS, the Fair and Accurate Credit Transactions Act of 2003, Pub. L. 108-159
("Red Flags Rule"), 16 c.F.R. Part 681, requires certain financial institutions and
creditors with "covered accounts" to prepare, adopt, and implement an identity theft
prevention program to identify, detect, respond to and mitigate patterns, practices or
specific activities, which could indicate identity theft; and
V\1JIEREAS, the City maintains certain continuing accounts with utility service
customers and for other purposes, which involve multiple payments or transactions,
and such accounts are "covered accounts" within the meaning of the Red Flags Rule;
and
V\1JIEREAS, to comply with the Red Flags Rule, City staff has prepared an identity
theft prevention program in the form attached hereto as Exhibit A, "Identity Theft
Prevention Program," and incorporated herein by this reference (the "ITPP" or the
"Program") and have recommended that the Program now be approved and adopted
by the City Council for implementation;
NOW, THEREFORE, THE CITY COUNCIL OF THE CITY OF TUKvVILA,
WASHINGTON, HEREBY RESOLVES AS FOLLOWS:
Identity Theft Prevention Program Adopted. The Tukwila Identity Theft
Protection Program, a copy of which is attached hereto as Exhibit A, and by this
reference fully incorporated herein, is hereby approved and adopted, effective the date
set forth below. City staff is hereby authorized and directed to implement the Program
in accordance with its terms. .
PASSED BY THE CITY COUNCIL OF THE CITY OF TUKWILA, WASHINGTON,
at a Special Meeting thereof this day of .2009.
ATTEST / AUTHEl\TTJ:CATED:
Joan Hernandez, Council President
Christy O'Flaherty, CMC, City Clerk
APPROVED AS TO FORM BY:
Filed with the City Clerk:
Passed by the City Council:
Resolution Number:
Office of the City Attorney
Attachment: Exhibit A, Identity Theft Prevention Program
C\Documents and Settings\All Users\Desktop\Kelly\MSDATA \Resolutions\Red Flags Identity Theft-doc
SKksn 2/25/20':)9
Page 1 of 1
Exhibit A
CITY OF TUKWILA
IDENTITY THEFT PREVENTION PROGRAM
1. PROGRAM ADOPTION. The City of Tukwila developed this Identity Theft
Prevention Program ("Program") pursuant to the Federal Trade Commission's Red
Flags Rule ("Rule"), which implements Sections 114 and 315 of the Fair and
Accurate Credit Transactions Act of 2003. This Program was developed with the
oversight and approval of the City's Finance Director. After consideration of the
size and complexity of the City's operations and account systems and the nature and
scope of the City's activities, the City Council determined that this Program was
appropriate for the City, and therefore approved this Program by the adoption of
Resolution No. on the day of ,2009.
2. PROGRAM PURPOSE AND DEFINITIONS
A. Fulfilling Requirements of the Red Flags Rule. Under the Red Flags Rule, every
financial institution and creditor is required to establish an identity theft
prevention program tailored to its size, complexity and the nature of its
operation. The Program must contain reasonable policies and procedures to:
1) Identify relevant red flags as defined in the Rule and this Program for new
and existing covered accounts, and incorporate those red flags into the
Program;
2) Detect red flags that have been incorporated into the Program;
3) Respond appropriately to any red flags that are detected to prevent and
mitigate identity theft; and
4) Update the Program periodically to reflect changes in risks to customers or to
the safety and soundness of the City from identity theft.
B. Red Flags Rule Definitions Used in this Program. For the purposes of this
Program, the following definitions apply:
1) Account. "Account" means a continuing relationship established by a person
with a creditor to obtain a product or service for personal, family, household
or business purposes.
2) Covered Account. A" covered account" means:
a) Any account the City offers or maintains primarily for personal, family or
household purposes, that involves multiple payments or transactions; and
C:\Documents and Settings\A1l Users\Desk:top\Kelly\MSDAT A \Resolutions\Red Flags Identity Theft Exhibit Adoc
SH:ksn 2/2512009
Page 1 of7
b) Any other account the City offers or maintains for \vhich there is a
reasonably foreseeable risk to customers or to the safety and soundness of
the City from identity theft.
3) Creditor. "Creditor" has the same meaning as defined in Section 701 of the
Equal Credit Opportunity Act, 15 U.s.e. 1691a, and includes a person or
entity that arranges for the extension, renewal or continuation of credit,
including the City.
4) Customer. A "customer" means a person or business entity that has a
covered account with the City.
5) Financial Institution. "Financial institution" means a state or national bank, a
state or federal savings and loan association, a mutual savings bank, a state or
federal credit union, or any other entity that holds a "transaction account"
belonging to a customer.
6) Identifying Information. "Identifying information" means any name or
number that may be used, alone or in conjunction with any other information,
to identify a specific person, including name, address, telephone number,
social security number, date of birth, government passport number, employer
or taxpayer identification number or unique electronic identification number.
7) Identity Theft. "Identity theft" means fraud committed using the identifying
information of another person.
8) Red Flag. A" red flag" means a pattern, practice, or specific activity that
indicates the possible existence of identity theft.
9) Service Provider. "Service provider" means a person or business entity that
provides a service directly to the City relating to or in connection with a
covered account.
3. IDENTIFICATION OF RED FLAGS. In order to identify relevant red flags, the
City shall review and consider the types of covered accounts that it offers and
maintains, the methods it provides to open covered accounts, the methods it
provides to access its covered accounts, and its previous experiences with identity
theft. The City identifies the following red flags, in each of the listed categories:
A. Notification and Warnings from Credit Reporting Agencies - Red Flags.
1) Report of fraud accompanying a credit report;
2) Notice or report from a credit agency of a credit freeze on a customer or
applicant;
C:\Documents and SettingsWI Users\DeskLop\KeIly\..MSDATA\Resolutions\Red Flags Identity Theft Exhibit Adoc
SH:ksn 2/2512009
Page 2 of7
3) Notice or report from a credit agency of an active duty alert for an applicant;
and
4) Indication from a credit report of activity that IS inconsistent with a
customer's usual pattern or activity.
B. Suspicious Documents - Red Flags.
1) Identification document or card that appears to be forged, altered or
inauthentic;
2) Identification document or card on which a person's photograph or physical
description is not consistent with the person presenting the document;
3) Other document with information that is not consistent with existing
customer information (such as a person's signature on a check appears
forged); and
4) Application for service that appears to have been altered or forged.
C. Suspicious Personal Identifying Information -Red Flags.
1) Identifying information presented that is inconsistent with other information
the customer provides (such as inconsistent birth dates);
2) Identifying information presented that is inconsistent with other sources of
information (for instance, an address not matching an address on a driver's
license);
3) Identifying information presented that is the same as information shoV\Tfi on
other applications that were found to be fraudulent;
4) Identifying information presented that is consistent with fraudulent activity
(such as an invalid phone number or fictitious billing address);
5) Social security number presented that is the same as one given by another
customer;
6) An address or phone number presented that is the same as that of another
person;
7) Failing to provide complete personal identifying information on an
application when reminded to do so (however, by law social security
numbers must not be required); and
8) Identifying information which is not consistent with the information that is
on file for the customer.
C:\Documents and SettingsWI Users\Desk'1op\Kelly",-MSDATA\Resolutions\Red Flags Identity Theft Exhibit Adoc
SH:ksn 2/2512009
Page 3 of7
D. Suspicious Account Activity or Unusual Use of Account - Red Flags.
1) Change of address for an account followed by a request to change the account
holder's name;
2) Payments stop on an otherwise consistently up-to-date account;
3) Account used in a way that is not consistent with prior use (such as very high
activity);
4) Mail sent to the account holder is repeatedly returned as undeliverable;
5) Notice to the City that a customer is not receiving mail sent by the City;
6) Notice to the City that an account has unauthorized activity;
7) Breach in the City's computer system security; and
8) Unauthorized access to or use of customer account information.
E. Alerts from Others - Red Flag.
9) Notice to the City from a customer, a victim of identity theft, a law
enforcement authority or other person that it has opened or is maintaining a
fraudulent account for a person engaged in identity theft.
4. DETECTING RED FLAGS
A. New Accounts. In order to detect any of the red flags identified above associated
with the opening of a new account, City personnel will take the following steps
to obtain and verify the identity of the person opening the account:
1) Require certain identifying information such as name, date of birth,
residential or business address, principal place of business for an entity,
driver's license or other identification;
2) Verify the customer's identity (for instance, review a driver's license or other
identification card);
3) Review documentation showing the existence of a business entity; and
4) Independently contact the customer.
B. Existing Accounts. In order to detect any of the red flags identified above for an
existing account, City personnel will take the following steps to monitor
transactions with an account:
1) Verify the identification of customers if they request information (in person,
via telephone, via facsimile, via email);
C:\Documents and SettingsWI Users\Desk."1op\Kelly\t\'1SDA T A\Resolutions\Red Rags Identity Theft Exhibit Adoc
SH:ksn 2/25/2009
Page 4 of7
2) Verify the validity of requests to change billing addresses; and
3) Verify changes in banking information given for billing and payment
purposes.
5. PREVENTING AND MITIGATING IDENTITY THEFT. In the event City
personnel detect any identified red flags, such personnel shall take one or more of
the following steps, depending on the degree of risk posed by the red flag:
A. Prevent and Mitigate Identity Theft.
1) Monitor a covered account for evidence of identity theft;
2) Contact the customer with the covered account;
3) Change any passwords or other security codes and devices that permit access
to a covered account;
4) Not open a new covered account;
5) Close an existing covered account;
6) Re-open a covered account with a new number;
7) Not attempt to collect payment on a covered account;
8) Notify the Finance Director for determination of the appropriate step(s) to
take;
9) Notify law enforcement; or
10) Determine that no response is warranted under the particular circumstances.
B. Protect Customer Identifying Information. In order to further prevent the
likelihood of identity theft occurring with respect to City accounts, the City shall
take the following steps with respect to its internal operating procedures to
protect customer identifying information:
1) Secure the City website but provide clear notice that the website is not secure;
2) Undertake complete and secure destruction of paper documents and
computer files containing customer information;
3) Make office computers password protected and provide that computer
screens lock after a set period of time;
4) Keep offices clear of papers containing customer identifying information;
5) Request only the last 4 digits of social security numbers (if any);
C:\Documents and SettingsV\.l1 Users\Desl'1op\Kelly'-MSDA T A\Resolutions\Red Flags Identity Theft Exhibit A.doc
SH:ksn 2/25/2009
Page 5 of7
6) Maintain computer virus protection up to date; and
7) Require and keep only the kinds of customer information that are necessary
for City purposes.
6. PROGRAM ADMINISTRATION
A. Oversight.
1) The Finance Director or other designated city employee at the level of senior
management shall be responsible for developing, implementing, and
updating the Program.
2) The Finance Director shall also be responsible for the Program
administration, for appropriate training of City staff on the Program, for
reviewing the annual staff report required under the Program, as well as any
other staff reports regarding the detection of red flags and the steps for
preventing and mitigating identity theft, determining which steps of
prevention and mitigation should be taken in particular circumstances, and
considering periodic changes to the Program.
B. Staff Training and Reports. City staff responsible for implementing the Program
shall be trained either by or under the direction of the Finance Director in the
detection of red flags, and the responsive steps to be taken when a red flag is
detected. Additionally, a compliance report shall be provided annually to the
Finance Director. The annual compliance report shall, at a minimum, address
the following:
1) The effectiveness of the City's policies and procedures in addressing the risk
of identity theft in connection with the opening of covered accounts and with
respect to existing covered accounts;
2) Service provider arrangements;
3) Significant incidents involving identity theft and the City's response; and
4) Recommendations for material changes to the Program.
C. Service Provider Arrangements. In the event the City engages a service provider
to perform an activity in connection with one or more covered accounts, the City
shall take the following steps to require that the service provider performs its
activity in accordance with reasonable policies and procedures designed to
detect, prevent, and mitigate the risk of identity theft.
1) Require, by contract, that service providers acknowledge receipt and review
of the Program and agree to perform their activities with respect to City
covered accounts in compliance with the terms and conditions of the Program
C:\Documents and Settings\A1I Users\Desliop\Kelly\.MSDATA\Resolutions\Red Flags Identity Theft Exhibit Adoc
SH:ksn 2/25/2009
Page 6 of7
and with all instructions and directives issued by the Finance Director
relative to the Program; or
2) Require, by contract, that service providers acknowledge receipt and review
of the Program and agree to perform their activities with respect to City
covered accounts in compliance with the terms and conditions of the service
provider's identity theft prevention program and will take appropriate action
to prevent and mitigate identity theft; and that the service providers agree to
report promptly to the City in writing if the service provider in connection
with a City covered account detects an incident of actual or attempted
identity theft or is unable to resolve one or more red flags that the service
provider detects in connection with a covered account.
D. Customer Identifying Information and Public Disclosure. The identifying
information of City customers with covered accounts shall be kept confidential
and shall be exempt from public disclosure to the maximum extent authorized
by law, including RCW 42.56.230(4). The City Council also finds and determines
that public disclosure of the City's specific practices to identify, detect, prevent,
and mitigate identity theft may compromise the effectiveness of such practices
and hereby direct that, under the Program, knowledge of such specific practices
shall be limited to the Finance Director and those City employees and service
providers who need to be aware of such practices for the purpose of preventing
identity theft.
7. PROGRAM UPDATES. The Program will be periodically reviewed and updated to
reflect changes in risks to customers and to the safety and soundness of the City
from identity theft. The Finance Director shall, at least annually, review the annual
compliance report and consider the City's experiences with identity theft, changes in
identity theft methods, changes in identity theft detection and prevention methods,
changes in types of accounts the City maintains and changes in the City's business
arrangements with other entities and service providers. After considering these -
factors, the Finance Director shall determine whether changes to the Program,
including the listing of red flags, are warranted. If warranted, the Finance Director
shall present the recommended changes to the City Council for review and
approval.
C:\Documents and Settings\/\JI Users\Desklop\Kelly\J\1SDAT A\Resolutions\Red Flags Identity Theft Exhibit Adoc
SH:ksn 2/25/2009
Page 7 of7
KENYON DISEND, PLLC
THE MWY7CIPAL LA VI FIRM
11 FRONT STREET SOUTH
ISSAQUAH, IV ASHINGTON 98027-3820
WW,V .KE1'<"'YONDISEND .COM
(425) 392-7090 . (206) 628-9059
FAX (425) 392-7071
.MICHAEL R. KENYON
BRUCE L. DISEND
SHELLEY M. KERSLo\.KE
MARGARET J. KING
KARl L. SA1'\'D
NOEL R. TREAT
RENEE G. IV ALLS
AMY J 0 PEARSALL
SANDRA S.lVIEADOWCROFT
CHRIS D. BACHA
BOB C. STERBANK
TD:
Mayor Jim Haggerton and Members of the City Council
Rhonda Berry, City Administrator
FROM:
Shelley M. Kerslake, City Attorney
Shawn Hunstock, Finance Director
DATE:
February 18,2009
RE:
Overview of Requirements of FTC Red Flags Rule
I. BACKGROUND
In 2003, Congress passed the Fair and Accurate Credit Transaction Act ("FACTA")
(Public Law 108-159). To implement the identity theft provisions of FACTA, the Federal Trade
Commission ("FTC") was charged with promulgating rules that require the adoption of certain
identity theft prevention programs. The FTC adopted these rules, kno\vn as the "Red Flags
Rule," on November 7, 2007. The Red Flags Rule requires fmancial institutions and creditors
that hold consumer accounts to develop and implement a written Identity Theft Prevention
Program by May 1, 2009. City utilities are one of the entities that must comply with this
requirement. 1 Because the deadline for adopting a 'Nritten Identity Theft Prevention Program
("Program") is approaching, the purpose of this memorandum is to outline the Program
requirements and identify some issues for consideration during the course of adoption.
The FTC Red Flags Rule ("Rule"), and its appendix, also provide specific suggestions
and examples of red flags and suggested responses that a city may use to create its Program. A
draft Ordinance with an attached Program that incorporates the Rule's suggestions is provided
with this memorandum. A copy of the relevant Rule is also provided.
II. REQUIREMENTS
To comply with the new Rule, Tukwila must develop and implement a written Program
that is appropriate for the size and complexity of the City, and which is "designed to detect,
prevent and mitigate identity theft in connection with the opening of a covered account or any
existing covered account.,,2 Under the Rule, a "covered account" is:
I The Red Flags Rule and Address Discrepancy Rules apply to "fmancial institutions" and "creditors" with "covered
accounts." A "creditor" is defined as any entity that regularly extends, renews, or continues credit and specifically
includes utility companies. 16 C.F.R. ~ 681.2(b)(3)(ii).
216 C.F.R. ~ 681.2(d).
C:\DOCUJI,1E-1 \kathyp\LOCALS-IiT empIXPgrpwise\Tuk - Memo - Red Flag Rules _ 2.doc/KIS/02118/09
SERVING VVASHINGTON CUIES SINCE 1993
Any account a city or utility offers or maintains primarily for personal, family or
household purposes, that involves multiple payments or transactions; and
Any other account a city or utility offers or maintains for which there is a reasonably
foreseeable risk to customers or to the safety and soundness of the city or utility of
identity theft. 3
Accordingly, the first step in preparing the City's Program is to identify all City accounts that
constitute a "covered account."
Second, the Program must include reasonable policies and procedures for detecting,
preventing, and mitigating identity theft. To accomplish this, the Program must include
procedures to focus on "red flags" that, with further analysis, would suggest that identity theft
might be occurring. Red flags are defmed as patterns, practices, or specific activities that
indicate the possible existence of identity theft.4 The Rule identifies five general categories of
red flags and suggested responses. The general red flag categories are:
1. The receipt of warnings from consumer reporting agencies;
2. Providing suspicious documents to a city;
3. Providing suspicious personal identifying information;
4. The unusual use of an account; and
5. Notices from customers, victims, or law enforcement of identity theft in connection
with a covered account.
While the FTC's Red Flags Rule provides a helpful template of categories and suggested
responses to incorporate into a required Program, each city must determine the specific aspects
to include or expand upon in its Program after a review of its specific situation. 5 This suggests
that each city should consider which particular actions or circumstances concerning its "covered
accounts" might indicate identity theft, and consider including those actions or circumstances as
a defmed "red flag."
Third, the Program must include procedures to accomplish the following:
1. Identify relevant red flags for covered accounts and incorporate those red flags into
the Program;
2. Detect red flags that have been incorporated into the Program;
3. Respond appropriately to any red flags that are detected to prevent and mitigate
identity theft; and
4. Ensure the Program is updated periodically, to reflect changes in risks to customers or
to the safety and soundness of the creditor from identity theft.
3 16 C.F.R. S 681.2(3).
4 16 C.F.R. S 681.2(b)(9).
5 This issue is discussed in more detail under Section III of this memorandum.
-2-
C\DOCUME- J\kathyp\LOCALS-l \Temp\XPgrpwise\Tuk - Memo - Red Flag Rules_2.doc/KIS/02i18/09
In addition to the foregoing, a Program must include certain administrative procedures.
An initial written Program must receive approval from the City Councilor the utility's board of
directors or an appropriate committee of the board.6 The Council, board, or committee must also
continue with oversight, development, implementation, and administration of the Program or
assign such duties to an employee at the senior management level. 7 Third, as part of this
implementation and oversight, staff must receive proper training concerning implementation of
the Program. 8 Finally, staff must prepare a staff report so that the program administrator or
Council can evaluate the effectiveness of the Program with respect to open and existing
accounts, service provider arrangements, significant incidents and responses, and
recommendations for change. 9
III. COMPLIANCE
'While all cities \vith utilities must comply with the Rules by adopting a Program, the
extent of the Program v,Till depend on the size and practices of the utility. Because large cities
and utilities will have different issues than small cities and utilities, there is no one-size-fits-all
solution. Additionally, wI-tile the Rule requires the adoption of a Progralll, it also discusses the
need for assessment and application of policies addressing the unique requirements of the
regulated entity. For example, if a city does not use or receive credit reports as part of its utility
billing services, then it will not need to include in its category of red flags a procedure for
addressing alerts, notifications, or other warnings received from consumer reporting agencies.
The process of creating the policies adopted in the City's Program is therefore as
important as complying with the rules adopted by the Program. A Program with procedures and
policies that do not apply to the City's circumstances will likely pose a bigger problem than
adopting a solid Program that meets that City's needs a fev.,T weeks beyond the November 1,2008
deadline. 'While the FTC has the authority to enforce the Red Flags Rule and assess penalties not
to exceed $2,500 per violation for a failure to adopt a policy, a statement from the Minnesota
Municipalities Utilities Association's website explains that the FTC will not be checking
individual utilities to see if the deadline is met. Accordingly, having a \vell thought-out program
that is applicable to Tukwila's specific needs is preferable to adopting a cookie cutter policy or
plan.
616 C.F.R. & 681.2(e)(1).
716 C.F.R. & 681.2(e)(2).
816 C.F.R. & 681.2(e)(3)-(4).
9 Appendix A to Part 681 A(VI)(b)(1).
-3-
C:\DOCUlvIE-l ikathyp\LOCALS-IiTemplXPgrpwise\Tuk - Memo - Red Flag Rules_2.docIKISf021l8f09