[Ord. No. 1073-08 § 1, 10-15-2008]
A.
The City of Gallatin (the "Utility") has
developed this Identity Theft Prevention Program ("Program") pursuant
to the Federal Trade Commission's ("FTC") Red Flags Rule, which implements
Section 114 of the Fair and Accurate Credit Transactions Act of 2003,
pursuant to 16 CFR 681.2. This Program is designed to detect, prevent
and mitigate identity theft in connection with the opening and maintenance
of certain utility accounts. For purposes of this Program, "identity
theft" is considered to be "fraud committed using the identifying
information of another person." The accounts addressed by the Program,
(the "accounts"), are defined as:
1.
A continuing relationship the Utility
has with an individual through an account the Utility offers or maintains
primarily for personal, family or household purposes, that involves
multiple payments or transactions; and
2.
Any other account the Utility offers
or maintains for which there is a reasonably foreseeable risk to customers
or to the safety and soundness of the Utility from identity theft.
B.
This Program was developed with oversight
and approval of the Board of Aldermen. After consideration of the
size and complexity of the Utility's operations and account systems
and the nature and scope of the Utility's activities, the Board of
Aldermen determined that this Program was appropriate for the City
of Gallatin and therefore approved this Program on October 15, 2008.
[Ord. No. 1073-08 § 1, 10-15-2008]
A.
A "red flag" is a pattern, practice, or
specific activity that indicates the possible existence of identity
theft. In order to identify relevant red flags, the Utility considered
risk factors such as the types of accounts that it offers and maintains,
the methods it provides to open its accounts, the methods it provides
to access its accounts, and its previous experiences with identity
theft. The Utility identified the following red flags in each of the
listed categories:
1.
Notifications And Warnings From Consumer
Reporting Agencies. Possible red flags for this category include:
a.
A fraud or activity alert is included
with a consumer report;
b.
Receiving a report or notice from
a consumer reporting agency of a credit freeze;
c.
Receiving a report of fraud with
a consumer report; and
d.
Receiving indication from a consumer
report of activity that is inconsistent with a customer's usual pattern
or activity.
2.
Suspicious Documents. Possible red
flags for this category include:
a.
Receiving documents that are provided
for identification that appear to be forged or altered;
b.
Receiving documentation on which
a person's photograph or physical description is not consistent with
the person presenting the documentation;
c.
Receiving other documentation with
information that is not consistent with existing customer information
(such as if a person's signature on a check appears forged); and
d.
Receiving an application for service
that appears to have been altered or forged.
3.
Suspicious Personal Identifying Information.
Possible red flags for this category include:
b.
A person's identifying information
is inconsistent with other information the customer provides (such
as inconsistent SSNs or birth dates);
c.
A person's identifying information
is the same as shown on other applications found to be fraudulent;
d.
A person's identifying information
is consistent with fraudulent activity (such as an invalid phone number
or fictitious billing address);
e.
A person's SSN is the same as another
customer's SSN;
f.
A person's address or phone number
is the same as that of another person;
g.
A person fails to provide complete
personal identifying information on an application when reminded to
do so; and
h.
A person's identifying information
is not consistent with the information that is on file for the customer.
4.
Unusual Use Of Or Suspicious Activity
Related To An Account. Possible red flags for the category include:
a.
A change of address for an account
followed by a request to change the account holder's name or add other
parties;
b.
A new account is used in a manner
consistent with fraud (such as the customer failing to make the first
payment, or making the initial payment and no other payments);
c.
An account being used in a way that
is not consistent with prior use (such as late or no payments when
the account has been timely in the past);
d.
Mail sent to the account holder is
repeatedly returned as undeliverable;
e.
The Utility receives notice that
a customer is not receiving his/her paper statements; and
f.
The Utility receives notice that
an account has unauthorized activity.
[Ord. No. 1073-08 § 1, 10-15-2008]
A.
In order to detect any of the red flags
identified above with the opening of a new account, Utility personnel
will take the following steps to obtain and verify the identity of
the person opening the account:
1.
Steps can include:
a.
Requiring certain identifying information,
such as name, date of birth, residential or business address, principal
place of business for an entity, SSN, driver's license or other identification;
b.
Verifying the customer's identity,
such as by copying and reviewing a driver's license or other identification
card;
c.
Reviewing documentation showing the
existence of a business entity; and
d.
Independently contacting the customer.
[Ord. No. 1073-08 § 1, 10-15-2008]
A.
In the event Utility personnel detect any
identified red flags, such personnel shall take one (1) or more of
the following steps, depending on the degree of risk posed by the
red flag:
1.
Steps can include:
a.
Continuing to monitor an account
for evidence of identity theft;
b.
Contacting the customer;
c.
Changing any passwords or other security
devices that permit access to accounts;
d.
Reopening an account with a new number;
e.
Not opening a new account;
f.
Closing an existing account;
g.
Notifying law enforcement;
h.
Determining that no response is warranted
under the particular circumstances; or
i.
Notifying the Program Administrator
(as defined below) for determination of the appropriate step(s) to
take.
B.
In order to further prevent the likelihood
of identity theft occurring with respect to Utility accounts, the
Utility will take the following steps with respect to its internal
operating procedures:
1.
These steps are not outlined in the
FTC's Red Flags Rule, but possible steps may include:
a.
Providing a secure website or clear
notice that a website is not secure;
b.
Ensuring complete and secure destruction
of paper documents and computer files containing customer information,
including documentation of such destruction;
c.
Ensuring that office computers are
password protected and that computer screens lock after a set period
of time;
d.
Requiring only the last four (4)
digits of SSNs on customer applications;
e.
Limiting access to accounts to only
employees that require access;
f.
Prohibiting account information to
be written on sticky pads or note pads;
g.
Ensuring that computer screens are
only visible to the employee accessing the account; and
h.
Requiring customers to authenticate
addresses and personal information, rather than account representatives
asking if the information is correct.
[Ord. No. 1073-08 § 1, 10-15-2008]
This Program will be periodically
reviewed and updated to reflect changes in risks to customers and
the soundness of the Utility from identity theft. At least once per
year, the Program Administrator will consider the Utility's experiences
with identity theft situations, changes in identity theft methods,
changes in identity theft detection and prevention methods, changes
in types of accounts the Utility maintains and changes in the Utility's
business arrangements with other entities. After considering these
factors, the Program Administrator will determine whether changes
to the Program, including the listing of red flags, are warranted.
If warranted, the Program Administrator will present the Board of
Aldermen with his or her recommended changes and the Board will make
a determination of whether to accept, modify or reject those changes
to the Program.
[Ord. No. 1073-08 § 1, 10-15-2008]
A.
Oversight. The Utility's Program will be
overseen by a Program Administrator. The Program Administrator shall
be the City Administrator. The Program Administrator will be responsible
for the Program's administration, for ensuring appropriate training
of Utility staff on the Program, for reviewing any staff reports regarding
the detection of red flags and the steps for preventing and mitigating
identity theft, determining which steps of prevention and mitigation
should be taken in particular circumstances, reviewing and, if necessary,
approving changes to the Program.
B.
Staff Training And Reports. Utility staff
responsible for implementing the Program shall be trained either by
or under the direction of the Program Administrator in the detection
of red flags and the responsive steps to be taken when a red flag
is detected. Such training will be sufficient to effectively implement
the Program.
