HomeMy WebLinkAboutRes 1680 - Identity Theft Prevention Program ILA,
M' O Zr i
+y 0
�t
s� _1908
C ity
Washington
Resolution No. 6 y o
A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF TUKWILA,
WASHINGTON, APPROVING AND ADOPTING AN IDENTITY THEFT
PREVENTION PROGRAM.
WHEREAS, the City has a water -sewer utility providing water and /or sewer
utility services pursuant to Title 57 RCW, and
WHEREAS, the Fair and Accurate Credit Transactions Act of 2003, Pub L. 108 -159
"Red Flags Rule 16 C.F R. Part 681, requires certain financial institutions and
creditors with "covered accounts" to prepare, adopt, and implement an identity theft
prevention program to identify, detect, respond to and mitigate patterns, practices or
specific activities, which could indicate identity theft; and
WHEREAS, the City maintains certain continuing accounts with utility service
customers and for other purposes, which involve multiple payments or transactions,
and such accounts are "covered accounts" within the meaning of the Red Flags Rule,
and
WHEREAS, to comply with the Red Flags Rule, City staff has prepared an identity
theft prevention program in the form attached hereto as Exhibit A, "Identity Theft
Prevention Program," and Incorporated herein by this reference (the "ITPP" or the
"Program and has recommended the Program now be approved and adopted by the
City Council for implementation,
NOW, THEREFORE, THE CITY COUNCIL OF THE CITY OF TUKWILA,
WASHINGTON, HEREBY RESOLVES AS FOLLOWS
Identity Theft Prevention Program Adopted. The Tukwila Identity Theft
Protection Program, a copy of which is attached hereto as Exhibit A, and by this
reference fully incorporated herein, is hereby approved and adopted, effective the date
set forth below City staff is hereby authorized and directed to implement the Program
in accordance with its terms
PASSED BY THE CITY COUNCIL
F THE CITY OF TUKWIA, WASHINGTON,
at a Special Meeting thereof this -c 3 �G day of M CXr 2009
ATTEST /AUTHENTICATF.D-
C �9 oa Hernandez, Council President
Christy Oglaherty, CMC, Citf Clerk
APPROVED AS TO FORM BY
Piled with the City Clerk. e "q
Passed by the City Council,
Office of ie C'_ orney Resolution Number T1
Attachment: Exhibit A, Identity Theft Prevention Program
W \MSDATA \Resolutions \Red Flags Identity Theft.doc
SH.ksn 3/11/2009 Page 1 of 1
Exhibit A
CITY OF TUKWILA
IDENTITY THEFT PREVENTION PROGRAM
1. PROGRAM ADOPTION The City of Tukwila developed this Identity Theft
Prevention Program "Program pursuant to the Federal Trade Commission's Red
Flags Rule "Rule which implements Sections 114 and 315 of the Fair and
Accurate Credit Transactions Act of 2003 This Program was developed with the
oversight and approval of the City's Finance Director After consideration of the
size and complexity of the City's operations and account systems and the nature and
scope of the City's activities, the City Council determined that this Program was
appropriate for the City, and therefore. approved this Program by the adoption of
Resolution No l6yo on the day of M 2009
2. PROGRAM PURPOSE AND DEFINITIONS
A. Fulfilling Requirements of the Red Flays Rule. Under the Red Flags Rule, every
financial institution and creditor is required to establish an identity theft
prevention program tailored to its size, complexity and the nature of its
operation. The Program must contain reasonable policies and procedures to
1) Identify relevant red flags as defined in the Rule and this Program for new
and existing covered accounts, and incorporate those red flags into the
Program,
2) Detect red flags that have been incorporated into the Program,
3) Respond appropriately to any red flags that are detected to prevent and
mitigate identity theft; and
4) Update the Program periodically to reflect changes in risks to customers or to
the safety and soundness of the City from identity theft.
B Red Flaizs Rule Definitions Used in this Program. For the purposes of this
Program, the following definitions apply
1) Account. "Account" means a continuing relationship established by a person
with a creditor to obtain a product or service for personal, family, household
or business purposes.
2) Covered Account. A "covered account" means.
a) Any account the City offers or maintains primarily for personal, family or
household purposes, that involves multiple payments or transactions, and
W Flags Identity Theft Exhibit A.doe
sx:k-sn 3/11/2009 Page 1 of 7
Exhibit A
b) Any other account the City offers or maintains for which there is a
reasonably foreseeable risk to customers or to the safety and soundness of
the City from identity theft.
3) Creditor "Creditor' has the same meaning as defined in Section 701 of the
Equal Credit Opportunity Act, 15 U.S C. 1691a, and includes a person or
entity that arranges for the extension, renewal or continuation of credit,
including the City
4) Customer A "customer" means a person or business entity that has a
covered account with the City
5) Financial Institution. "Financial institution" means a state or national bank, a
state or federal savings and loan association, a mutual savings bank, a state or
federal credit union, or any other entity that holds a "transaction account"
belonging to a customer
6) Identifvimy Information. "Identifying information" means any name or
number that may be used, alone or in conjunction with any other information,
to identify a specific person, including name, address, telephone number,
social security number, date of birth, government passport number, employer
or taxpayer identification number or unique electronic identification number
7) Identity Theft. "Identity theft" means fraud committed using the identifying
information of another person.
S) Red Flay. A "red flag" means a pattern, practice, or specific activity that
indicates the possible existence of identity theft.
9) Service Provider "Service provider" means a person or business entity that
provides a service directly to the City relating to or in connection with a
covered account.
3. IDENTIFICATION OF RED FLAGS. In order to identify relevant red flags, the
City shall review and consider the types of covered accounts that it offers and
maintains, the methods it provides to open covered accounts, the methods it
provides to access its covered accounts, and its previous experiences with identity
theft. The City identifies the following red flags, in each of the listed categories
A. Notification and Warnings from Credit Renortin-2 Agencies Red Flaiys.
1) Report of fraud accompanying a credit report;
2) Notice or report from a credit agency of a credit freeze on a customer or
applicant;
W \MSDATA \Resolutions\Red Flags Identity Theft Exhibit A.doc
SH:ksn 3/11/2009 Page 2 of 7
Exhibit A
3) Notice or report from a credit agency of an active duty alert for an applicant;
and
4) Indication from a credit report of activity that is inconsistent with a
customer's usual pattern or activity
B Suspicious Documents Red Fla;?s.
1) Identification document or card that appears to be forged, altered or
inauthentic,
2) Identification document or card on which a person's photograph or physical
description is not consistent with the person presenting the document;
3) Other document with information that is not consistent with existing
customer information (such as a person's signature on a check appears
forged), and
4) Application for service that appears to have been altered or forged.
C. Suspicious Personal IdentifvinR Information -Red Flays.
1) Identifying information presented that is inconsistent with other information
the customer provides (such as inconsistent birth dates),
2) Identifying information presented that is inconsistent with other sources of
information (for instance, an address not matching an address on a driver's
license),
3) Identifying information presented that is the same as information shown on
other applications that were found to be fraudulent;
4) Identifying information presented that is consistent with fraudulent activity
(such as an invalid phone number or fictitious billing address),
5) Social security number presented that is the same as one given by another
customer;
6) An address or phone number presented that is the same as that of another
person,
7) Failing to provide complete personal identifying information on an
application when reminded to do so (however, by law social security
numbers must not be required), and
8) Identifying information which is not consistent with the information that is
on file for the customer
WAMSDATA \Resolutions\Red Flags Identity Theft Exhibit A.doe
SH:ksn 3/11/2009 Page 3 of 7
Exhibit A
D Suspicious Account Activity or Unusual Use of Account Red Fla's.
1) Change of address for an account followed by a request to change the account
holder's name,
2) Payments stop on an otherwise consistently up -to -date account;
3) Account used in a way that is not consistent with prior use (such as very high
activity),
4) Mail sent to the account holder is repeatedly returned as undeliverable,
5) Notice to the City that a customer is not receiving mail sent by the City;
6) Notice to the City that an account has unauthorized activity,
7) Breach in the City's computer system security; and
8) Unauthorized access to or use of customer account information.
E. Alerts from Others Red Flay.
9) Notice to the City from a customer, a victim of identity theft, a law
enforcement authority or other person that it has opened or is maintaining a
fraudulent account for a person engaged in identity theft.
4. DETECTING RED FLAGS
A. New Accounts In order to detect any of the red flags identified above associated
with the opening of a new account, City personnel will take the following steps
to obtain and verify the identity of the person opening the account:
1) Require certain identifying information such as name, date of birth,
residential or business address, principal place of business for an entity,
driver's license or other identification,
2) Verify the customer's identity (for instance, review a driver's license or other
identification card),
3) Review documentation showing the existence of a business entity, and
4) Independently contact the customer
B Existing Accounts. In order to detect any of the red flags identified above for an
existing account, City personnel will take the following steps to monitor
transactions with an account:
1) Verify the identification of customers if they request information (in person,
via telephone, via facsimile, via email),
W \MSDATA\Resolutions\Red Flags Identity Theft Exhibit A.doc
SH.ksn 3/11/2009 Page 4 of 7
Exhibit A
2) Verify the validity of requests to change billing addresses, and
3) Verify changes in banking information given for billing and payment
purposes.
5 PREVENTING AND MITIGATING IDENTITY THEFT In the event City
personnel detect any identified red flags, such personnel shall take one or more of
the following steps, depending on the degree of risk posed by the red flag-
A. Prevent and Mitigate Identitv Theft.
1) Monitor a covered account for evidence of identity theft;
2) Contact the customer with the covered account;
3) Change any passwords or other security codes and devices that permit access
to a covered account;
4) Not open a new covered account;
5) Close an existing covered account;
6) Re -open a covered account with a new number;
7) Not attempt to collect payment on a covered account;
8) Notify the Finance Director for determination of the appropriate step(s) to
take,
9) Notify law enforcement; or
10) Determine that no response is warranted under the particular circumstances.
B Protect Customer Identifvin-Y Information. In order to further prevent the
likelihood of identity theft occurring with respect to City accounts, the City shall
take the following steps with respect to its internal operating procedures to
protect customer identifying information.
1) Secure the City website but provide clear notice that the websrte is not secure,
2) Undertake complete and secure destruction of paper documents and
computer files containing customer information,
3) Make office computers password protected and provide that computer
screens lock after a set period of time,
4) Keep offices clear of papers containing customer identifying information,
5) Request only the last 4 digits of social security numbers (if any),
W \MSDATA\Resolutions \Red Flags Identity Theft Exhibit A.doc
SH.ksn 3/11/2009 Page 5 of 7
Exhibit A
6) Maintain computer virus protection up to date, and
7) Require and keep only the kinds of customer information that are necessary
for City purposes
6. PROGRAM ADMINISTRATION
A. Oversight.
1) The Finance Director or other designated city employee at the level of senior
management shall be responsible for developing, implementing, and
updating the Program.
2) The Finance Director shall also be responsible for the Program
administration, for appropriate training of City staff on the Program, for
reviewing the annual staff report required under the Program, as well as any
other staff reports regarding the detection of red flags and the steps for
preventing and mitigating identity theft, determining which steps of
prevention and mitigation should be taken in particular circumstances, and
considering periodic changes to the Program.
B Staff Training and Reports. City staff responsible for implementing the Program
shall be trained either by or under the direction of the Finance Director in the
detection of red flags, and the responsive steps to be taken when a red flag is
detected. Additionally, a compliance report shall be provided annually to the
Finance Director The annual compliance report shall, at a minimum, address
the following:
1) The effectiveness of the City's policies and procedures in addressing the risk
of identity theft in connection with the opening of covered accounts and with
respect to existing covered accounts,
2) Service provider arrangements,
3) Significant incidents involving identity theft and the City's response, and
4) Recommendations for material changes to the Program.
C. Service Provider Arrangements. In the event the City engages a service provider
to perform an activity in connection with one or more covered accounts, the City
shall take the following steps to require that the service provider performs its
activity in accordance with reasonable policies and procedures designed to
detect, prevent, and mitigate the risk of identity theft.
1) Require, by contract, that service providers acknowledge receipt and review
of the Program and agree to perform their activities with respect to City
covered accounts in compliance with the terms and conditions of the Program
WAMSDATA\Resolutions\Red Flags Identity Theft Exhibit A.doc
SH:ksn 3/11/2009 Page 6 of 7
Exhibit A
and with all instructions and directives issued by the Finance Director
relative to the Program, or
2) Require, by contract, that service providers acknowledge receipt and review
of the Program and agree to perform their activities with respect to City
covered accounts in compliance with the terms and conditions of the service
provider's identity theft prevention program and will take appropriate action
to prevent and mitigate identity theft; and that the service providers agree to
report promptly to the City in writing if the service provider in connection
with a City covered account detects an incident of actual or attempted
identity theft or is unable to resolve one or more red flags that the service
provider detects in connection with a covered account.
D Customer IdentifvinLY Information and Public Disclosure. The identifying
information of City customers with covered accounts shall be kept confidential
and shall be exempt from public disclosure to the maximum extent authorized
by law, including RCW 42.56.230(4) The City Council also finds and determines
that public disclosure of the City's specific practices to identify, detect, prevent,
and mitigate identity theft may compromise the effectiveness of such practices
and hereby direct that, under the Program, knowledge of such specific practices
shall be limited to the Finance Director and those City employees and service
providers who need to be aware of such practices for the purpose of preventing
identity theft.
7 PROGRAM UPDATES The Program will be periodically reviewed and updated to
reflect changes in risks to customers and to the safety and soundness of the City
from identity theft. The Finance Director shall, at least annually, review the annual
compliance report and consider the City's experiences with identity theft, changes in
identity theft methods, changes in identity theft detection and prevention methods,
changes in types of accounts the City maintains and changes in the City's business
arrangements with other entities and service providers. After considering these
factors, the Finance Director shall determine whether changes to the Program,
including the listing of red flags, are warranted. If warranted, the Finance Director
shall present the recommended changes to the City Council for review and
approval.
W\MSDATA\Resolutions \Red Flags Identity Theft Exhibit A.doc
SH:ksn 3/11/2009 Page 7 of 7