The URL can be used to link to this page

Home My WebLink About#17 Identitiy Theft Prevention Policy Agenda Item # 17 "' TRUCKEE Public Utility District WORKSHOP To: Board of Directors From: Rosanna Matlock Date: November 04, 2009 Subject: Review of Identity Theft Prevention Policy 1. WHY THIS MATTER IS BEFORE THE BOARD On October 1, 2008, the Board passed a Resolution to adopt an Identity Theft Prevention Policy. This policy, and the Fair and Accurate Credit Transaction Act (FACT Act) requires an annual review. 2. HISTORY The FACT Act was enacted in early 2008, requiring utilities to adopt an Identity Theft Prevention Policy. The purpose of the FACT Act was to detect, prevent and mitigate identity theft. The FACT Act requirements are referred to as "Red Flag Rules" which are defined as "A pattern, practice or specific activity that indicates the possible existence of identity theft." Identity theft is defined as "The illegal use of someone else's personal information (such as a social security number) in order to obtain money or credit." 3. NEW INFORMATION In November 2008, the District implemented the policy by: • modifying service applications; • placing placards at customer service to explain identity validation requirements; • requiring Photo ID to open new accounts, modify existing customer information or obtain personal information regarding accounts for walk-ins; and • requiring identifying information from customers using phone, fax or e-mail. In April 2009, TDPUD contracted with the OnLine Utility Exchange to provide identity validations using customer social security numbers. In July 2009, letters were sent to all realtors and property managers explaining identity validation requirements. Leases are frequently submitted by phone, mail or fax, applications now require a social security number for validation. If the customer applies in person at the TDPUD office, they must present a valid photo ID. The Privacy Committee consists of Rosana Matlock, Privacy Officer, Mark Schlesinger, Tami McCollum, Sara Owens, Mary Chapman and Nancy Waters. The committee put together the Red Flag Response Procedures manual, discussed the role of the OnLine Utility Exchange, and discussed any problems that the customer service group may have encountered. Over 400 validations have been processed through the OnLine Utility Exchange. Photo ID's have been validated from every walk-in customer to open an account, modify an existing account, or obtain personal information regarding an account. Some of the Red Flags we have encountered are: • Match to Other Name - Customer has used another name in the past. A valid photo ID clears up the name situation in most cases. • No Record Found - Some applicants have not established credit, so their SSN shows no record. The customer comes into the office with a valid photo ID. • Security Alert - Some customers have a self imposed alert on their accounts to prevent credit fraud. • No Valid ID - Some customers come into the office without any form of photo ID. In these cases, we require that the account be put in the name of someone who can provide valid photo ID • Birth Date Mismatch - The customer must provide a second photo ID with matching birth date. The Annual Report for Truckee Donner PUD Identification Theft Prevention Policy is included as Attachment 1. 4. FISCAL IMPACT The 2010 - 2011 budgets include funding for processing validation/credit checks through OnLine Utility Exchange. 5. RECOMMENDATION Receive this report and provide input. Mary Chapma Michael D. Holley TAdministrative Services Manager General Manager Attachment 1 Annual Report—Truckee Donner PUD Identification Theft Prevention Policy History: June 2008—Fair and Accurate Credit Transaction Act(FACT Act) required adoption of an Identity Theft Prevention Policy by all utilities that offer credit to their customers. Adoption was to take place no later than October 1, 2008. Implementation of this policy was to take place effective November 1, 2008. October 1, 2008—Resolution No. 2008—31 TDPUD Board adopted its ID Theft Prevention Policy and appointed a Privacy Committee and a Privacy Officer November 1, 2008—ID Theft Prevention Policy was implemented New Information: 2008: October -The Privacy Committee performed a needs assessment and developed a Red Flag Alert Response Procedures manual November— o Employees trained and policy was implemented o Service applications modified to include identity validation requirements o Placards placed at the front counter explaining identity validation requirements o Letter sent to Truckee Community Foundation asking their assistance in explaining identity validation requirements o Photo ID required at the counter in order to open new accounts, modify existing customer information or to obtain personal information regarding accounts o Identifying information required from customers using phone,fax or e-mail 2009: April 2009—Contracted with Online Utility Exchange to provide identity validations using customer social security numbers April 28, 2009—First ID validation run using Online Utility Exchange July 2009- Letters were sent to all realtors and property managers explaining identity validation requirements. All ski lease applications are required to include a social security number for validation or the customer must present valid photo ID, in person, at the TDPUD office Privacy Committee Meetings(since adoption of ID Theft Prevention Policy): Privacy Committee Members: Rosana Matlock—Privacy Officer, Mark Schlesinger,Tami McCollum,Sara Owens, Mary Chapman and Nancy Waters October 8, 2008— Conducted needs assessment—determined changes required to implement ID Theft Prevention Policy Discuss procedures Attachment 1 October 30, 2008— Reviewed Red Flag Alert Response Procedures manual Reviewed changes to service application Reviewed letter to realtors/property managers Reviewed placard for front counter February 11, 2009— Discussed problems encountered by CSRs Discussed Online Utility Exchange Discussed types of ID allowable Discussed where we need improvements to our procedures Discussed status of TDPUD ID Theft Policy compared to other utilities May 14, 2009— Discussed implementing Online Utility Exchange October 6, 2009— Discussed how Online Utility Exchange is working Discussed possible changes to Title S Reviewed draft annual report Red Flags Encountered: Match to Other Name—Customer has used another name in the past, such as a maiden name. Also found when name is keyed as a shortened version of the actual name (i.e.:Jeff/Jeffrey). A valid photo ID will clear up the name situation in most cases. No Record Found—Some applicants have not established credit, so their SSN shows no record. In these instances,we will have the customer come into the office with a valid photo ID for validation. Security Alert—Some customers have a self imposed alert on their accounts to prevent credit fraud. This freeze does not prevent ID validation. No Valid ID—Some customers come into the office without any form of photo ID. In these cases, we require that the account be put in the name of someone who can provide valid photo ID. Each of these cases has been a wife applying for service. When we explained the need for ID,the husband came in with valid ID. Birth date Mismatch—In one instance, we had a Hispanic man apply for service. The birth date on his application did not match the birth date on his Alien Work Card. After several minutes of conversation through an interpreter,the man was able to provide a second photo ID with matching birth date. We found that the wife had entered the birth date incorrectly on the application. To date, we have run over 400 validations through Online Utility Exchange. Many of these were run to determine if a deposit was required. This is an additional service provided by Online Utility Exchange. All applicants that come into the office are required to provide valid photo ID. Applicants via phone, e- mail and fax are validated through the Online Utility Exchange.