HomeMy WebLinkAboutResolution 3729-04-2009A Resolution
NO 3729-04-2009
A RESOLUTION ESTABLISHING AND IMPLEMENTING AN IDENTITY THEFT
PREVENTION PROGRAM
WHEREAS, the Federal Trade Commission adopted rules pertaining to an Identity Theft Prevention
pursuant to the Red Flags Rule and which implements Section 114 of the Fair and Accurate Credit
Transactions Act of 2003 which requires that creditors adopt an Identity Theft Prevention Program on or
before November 1 2008 and
WHEREAS, the Federal Trade Commission issued an extension for creditors to establish and
implement an Identity Theft Prevention Program to the date of May 1 2009
WHEREAS, under the Red Flags Rule a creditor is defined to include a City that owns and provides
utility services and/or accepts payments for municipal utility services, and
WHEREAS, the City is a water and wastewater utilrty and
WHEREAS, the City is also considered a creditor under the Red Flags Rule when it defers payment for
goods or services, and
WHEREAS, it has been determined that the City is a creditor under the Red Flags Rule and is therefore
mandated to develop and implement an Identity Theft Prevention Program, and
WHEREAS, the City Manager has developed such an Identity Theft Prevention Program attached
hereto and incorporated herein as Exhibit A ("Program ') and recommends that the City Council adopt
such Program, and
WHEREAS the City Council finds that the Program fulfills, complies and implements the Red Flags
Rule and other requirements as mandated by the Federal Trade Commission, and
WHEREAS the City Council finds that rt is m the public interest to approve the Program.
ORT WORT
?<
RESOLUTION NO 3729 04 2009
NOW, THEREFORE, BE IT RESOLVED BY THE CITY COUNCIL OF THE
CITY OF FORT WORTH, TEXAS
Section 1
That the City Council hereby adopts the Identity Theft Prevention Program attached hereto as Exhibit
A as official City policy to fulfill the requirements of the Federal Trade Commission s Red Flags
Rule.
Section 2
That the Crty Council authorizes the Program to take effect on May 1 2009 and authorizes the City
Manager to update the Program as deemed necessary and pursuant to the procedures adopted herein.
Section 3
That the City Manager shall appoint a Program Administer to ensure that the policies and procedures of
the Program are implemented and updated m compliance with the Federal Trade Commission s Red
Flags Rule.
Adopted this 28th day of April 2009
A
Mike
. ~,~,
AT;TE SST ~ ~ `~:
f
~" ,,,~.-~ ~ rt ^.a
`Y. -., ` ~ n -~
... 1, ~
A ,f_
Marty-~endrix,,,CIT~'~°SECRETA Y
t ~ ~ ~~
~,r f *x,~~,,.
x"'/ •v~~
oRrWo>t~r
R
APPFiOVE!~
CITY CO~I~C
APR 2 8 2009
~,d
City Secretary of the
City of Fort VF-orth,'Texas
RESOLUTION NO 3729-04-2009
The City of Fort Worth
Identity Theft Prevention Program
Effective beginning May 1, 2009
RESOLUTION NO 3729-Q4-2009
I. PROGRAM ADOPTION
The City of Fort Worth Water developed this Identity Theft Prevention Program
("Program') pursuant to the Federal Trade Commission's Red Flags Rule ("Rule"), which
implements Section 114 of the Fair and Accurate Credit Transactions Act of 2003 16 C F R. ~
681.2 This Program was developed with oversight of the City Managers Office and the
approval of the Fort Worth Crty Council. After consideration of the size and complexity of the
City's operations and account systems, and the nature and scope of the City's actrvities, the Fort
Worth City Council determined that this Program was appropriate and therefore approved this
Program on
II. PROGRAM PURPOSE AND DEFINITIONS.
A. Purpose• Establishment of an Identity Theft Prevention Program
The purpose of this document is to establish an `Identity Theft Prevention Program for the City
of Fort Worth, which shall
1 Identify relevant Red Flags for new and existing covered accounts and incorporate those
Red Flags into the Program,
2 Detect Red Flags that have been incorporated into the Program,
3 Respond appropriately to any Red Flags that are detected to prevent and mitigate Identity
Theft; and
4 Ensure the Program is updated periodically to reflect changes in risks to
customerslaccount holders or to the safety and soundness of the City from Identity Theft.
The program shall be administered m accordance with Part 681 of Title 16 of the Code of
Federal Regulations implementing Sections 114 and 315 of the Fair and Accurate Credit
Transactions Act (FACTA) of 2003
B. Red Flags Rule definitions used in the City's Identity Theft Prevention Program
The Red Flags Rule (the `Rule") defines Identity Theft as `fraud committed using the identifying
information of another person" and a Red Flag as a pattern, practice, or specific activity that
indicates the possible existence of Identity Theft.
Under the Rule, the City is a creditor m carrying out some its roles and functions, such as but not
limited to the City acting as the Water Utility therefore making the City subject to the Rule
requirements.
Other definitions from the Rule which are incorporated m this Program mclude•
City• The City of Fort Worth, Texas.
2
RESOLUTION NO 3729-04-2009
Covered Account: Under the Rule, a covered account" is
1 Any account the City offers or maintains primarily for personal, family or household
purposes, that involves multiple payments or transactions, and
2. Any other account the City offers or mamtams for which there is a reasonably foreseeable
risk to customers/account holders or to the safety and soundness of the City from Identity
Theft.
Creditors The Rule defines creditors `to include finance companies, automobile dealers, mortgage
brokers, utility companies, and telecommunications companies. When the City defers payment for
goods or services rt is considered a creditor then as well.
Identifying Information is defined under the Rule as any name or number that may be used, alone
or m con~uncfion with any other information, to identify a specific person, including: name,
address, telephone number social security number date of birth, government issued driver's license
or identification number alien registration number government passport number employer or
taxpayer identification number unique electronic identification number a computer's Internet
Protocol address, or routing code.
Program. The Identity Theft Prevention Program.
Program Administrator The City Manager or his designee shall be the Program Administrator
III. IDENTIFICATION OF RED FLAGS.
In order to identify relevant Red Flags, the City considers the types of accounts that it
offers and mamtams, the methods it provides to open its accounts, the methods it provides to
access its accounts, and its previous experiences with Identity Theft. The following are the
general Red Flags which the City has identified to date.
A. Suspicious Documents
Red Flays
1 Identification document or card that appears to be forged, altered or inauthentic;
2. Identification document or card on which a person s photograph or physical description is
not consistent with the person presenting the document;
3 Other document with information that is not consistent with existing customer/account
holder's information (such as a forged signature on a check) and
4 Application for service that appears to have been altered or forged.
3
RESOLUTION NO 3729-04-2009
B. Suspicious Personal Identifying Information
Red Flags
1 Identifying information presented that is inconsistent with other mformarion the
customer/account holder provides (example inconsistent birth dates, lack of correlation
between Social Security number range and date of birth)
2 Identifying information presented that is the same as information shown on other
accounts that were found to be fraudulent;
3 Identifyng information presented that is consistent with fraudulent activity (such as an
invalid phone number or fictitious billing address)
4 A Social Security number presented that is the same as one given by another
customer/account holder
5 An address or phone number presented that is the same as that of another person,
b A person fails to provide complete personal idenhfymg information upon opening an
account when requested to do sa (recognizing that by law social security numbers must
not be required) and
7 A person s identifying information is not consistent with the information that is on file
for the person.
C. Suspicious Account Activity or Unusual Use of Account
Red Flags
1 Payments stop on an otherwise consistently up-to-date account;
2 Account used in a way that is not consistent with prior use (example very high activity),
3 Mail sent to the account holder is repeatedly returned as undeliverable;
4 Notice to the Crty that a person is not receiving mail sent by the City
5 Notice to the Crty that an account has unauthorized activity
6 Breach m the City's computer system security and
7 Unauthorized access to or use of a person s account information.
D Alerts from Others
Red Flag
1 Notice to the City from a customer Identity Theft victim, law enforcement or other
person that a fraudulent account has been open or is maintained by a person engaged m
Identity Theft.
E Notifications and Warnings From Consumer Credit Reporting Agencies
Red Flags
1 Report of fraud accompanying a consumer credit report;
4
RESOLUTION NO 3729-04-2009
2 Notice or report from a consumer credit agency of a credit freeze on a customer or applicant;
3 Notice or report from a consumer credit agency of an active duty alert for an applicant; and
4 Indication from a consumer credit report of activity that is inconsistent with a customer's
usual pattern or activity including but not limited to
o Recent and significant increase m volume of inquiries
o Unusual number of recent credit applications
o A material change m use of credit
o Accounts closed for cause or abuse
IV DETECTING RED FLAGS.
A. New Accounts
In order to detect any of the Red Flags identified above associated with the opening of a
new account, the Crty will take the following steps to obtain and verify the identity of the person
opening the account:
Detect
1 Require presentation of identif}nng information such as name, date of birth, residential or
business address, principal place of business for an entity driver's license, state or
military issued identification, business tax identification number
2 When circumstances warrant, verify the customer's identity due to but not limited to
theft related field activities, outstanding balance due on prior account(s),
suspiciouslaltered documents,
3 Review documentation showing the existence of a business entity proof of residential
ownership or a valid rentalllease agreement; and
4 Contact the customer/applicant when needed.
B. Existing Accounts
In order to detect any of the Red Flags identified above for an existing account, the City
will take the following steps to monitor transactions of an account:
Detect
1 Authenticate a person s identification if they request information when contact is made•
a. m person or by telephone by verifying information on the City's master account
file(s), such as driver's license number date of birth, phone numbers, etc.
b by facsimile or by email by placing an outbound call verifying information on the
customer master file such as drivers license number date of birth, phone numbers,
etc
2. Confirm the validity of requests to change billing addresses when contact is made'
a. m person or by telephone by verifying information on the City's master account
file(s), such as driver's license number date of birth, phone numbers, etc.
5
RESOLUTION NO 3729-04-2009
b by facsimile or by email by placing an outbound call verifying information on the
customer master file such as drivers license number date of birth, phone numbers,
etc.
3 Validate changes m banking information given for billing and payment purposes when
contact is made
a. in person or by telephone by venfymg information on the customer master file
such as driver's license number date of birth, phone numbers, etc
b by facsimile or by email by placing an outbound call verifying information on the
customer master file such as dnvers license number date of birth, phone numbers,
etc.
V PREVENTING AND MITIGATING IDENTITY THEFT.
In the event the City detects any identified Red Flags, the appropriate City staff shall take
one or more of the following steps, depending on the degree of risk posed by the Red Flag:
Prevent and Mitigate
1 Continue to review an account for evidence of Identity Theft;
2 Contact the customer
3 Change any passwords or permissions to security devices that permit access to accounts,
4 Not open a new account;
5 Terminate an existing account;
6 Notify the Program Administrator for determination of the appropriate step(s) to take;
7 Notify law enforcement; or
8 Determine that no response is warranted under the particular circumstances.
Protect customer identifyins information
In order to further prevent the likelihood of Identity Theft occumng with respect to City
accounts, the City will take the following steps as part of its internal operating procedures to
protect customer/account holder's identifying information.
1 Ensure that its websrte is secure or provide clear notice that the website is not secure,
2 Ensure that the Interactive Voice Recognition (IVR) device is a secure method for
customers to retrieve account information from or submit information to for payment;
3 Ensure complete and secure destruction of paper documents and computer files
containing customer information as provided for by applicable laws,
4 Ensure that office computers are password protected and that computer screens lock after
a set period of time;
5 Require City staff to protect customer information through appropriate measures,
6 Request only the last 4 digits of social security numbers (if any), unless otherwise
required by applicable law•
7 Adhere to the City's Administrative Regulation D-5 Information Technology Security
6
RESOLUTION NO 3729-04-2009
8 Ensure the City's computer virus protection is up to date;
9 Ensure that computers are backed up properly and any backup information is secure;
10 Keep offices clear of papers containing customer information,
11 Require and keep only those kinds of personal information necessary and
12 Ensure the City adheres to all applicable Federal, State and local rules, regulations,
policies, ordinances and laws with regard to data retention including but not limited to the
following data types, name, address, telephone number social security number date of
birth, government issued driver's license or identification number alien registration
number government passport number employer or taxpayer identification number
unique electronic identification number computer's Internet Protocol address or banking
routing code.
VI. PROGRAM UPDATES
This Program shall be periodically reviewed and updated to reflect changes in risks to the
City's customers/account holders for Identity Theft. At the beginning of the fiscal year the
Program Administrator will consider the City's experience with Identity Theft, changes m
Identity Theft methods, changes in Identity Theft detection and prevention methods, changes in
types of accounts the City maintains and changes m the City's business arrangements with other
entities and consult with law enforcement authorities. After considering these factors, the
Program Administrator will determine whether changes to the Program, including the listing of
Red Flags, are warranted. If warranted, the Program Administrator will present the Fort Worth
City Council with recommended changes and the Fort Worth City Council will make a
determination of whether to accept, modify or reject those changes to the Program.
VII. PROGRAM ADMINISTRATION
A. Oversight
An Identity Theft Committee as appointed by the Program Administer shall be
responsible for developing, implementing and updating this Program. The Committee shall be
headed by the Program Administrator The Program Administrator will be responsible for the
Program administration, for ensuring appropriate training of City staff on the Program, for
reviewing any staff reports regarding the detection of Red Flags and the steps for preventing and
mitigating Identity Theft, determining which steps of prevention and mitigation should be taken
m particular circumstances and considering periodic changes to the Program.
B. Staff Training and Reports
City staff responsible for implementing the Program shall be trained in the detection of
Red Flags, and the responsive steps to be taken when a Red Flag is detected, either by or under
the direction of the Program Administrator Staff shall be updated with the any Program changes
at least annually The Program Administer shall require that each City department submit
regular reports documenting any concerns, recommendations, Identity Theft incidents and
comments on the effectiveness of the Program.
7
RESOLUTION NO 3729-04-2009
C. Service Provider Arrangements
In the event the City engages a service provider to perform an activity in connection with
one or more of its covered accounts, the City will take the following steps to ensure the service
provider performs its activity m accordance with these reasonable policies and procedures
designed to detect, prevent, and mitigate the nsk of Identity Theft and.
1 Require, by contract, that service provider have such policies and procedures in place to
prevent and mitigate Identity Theft; and
2 Require, by contract, that service provider review the City's Program and report any Red
Flags to the Program Administrator
D Specific Program Elements and Confidentiality
For the effectiveness of Identity Theft Prevention Program, the Rule demands a degree of
confidentiality regarding the City's specific practices relating to Identity Theft detection,
prevention and mitigation. Therefore, under this Program, knowledge of such specific practices
shall be limited to the Identity Theft Committee and those employees who need to know the
practices for purposes of preventing Identity Theft. Because this Program is adopted by the Fort
Worth City Council and thus publicly available, it would be counterproductive to list these
specific practices here. Therefore, only the Program s general Red Flag detection,
implementation and prevention practices are listed m this document.
8