043-09 - Resolution - Identity Theft Prevention ProgramIntroduced by:
Requested by:
Drafted by:
Introduced:
Adopted:
RESOLUTION NO. 043-09
City Treasurer
City Treasurer
City Treasurer
April28, 2009
April28, 2009
A RESOLUTION OF THE CITY OF PORT ORCHARD,
WASHINGTON AUTHORIZING THE MAYOR TO EXECUTE
FOR IDENTITY THEFT PREVENTION PROGRAM-RED FLAG
RULE
WHEREAS, the Fair and Accurate Credit Transactions Act of 2003, Pub. L. 108-159 ("Red
Flags Rule") requires certain financial institutions and creditors with "covered accounts' to prepare,
adopt and implement an identity theft prevention program to identify, detect, respond to and
mitigate patterns, practices or specific activities which could indicate identity theft; and
WHEREAS, the City of Port Orchard operates water, sewer and storm drainage utilities and
maintains certain continuing accounts with utility service customers and such accounts are "covered
accounts' within the meaning of the Red Flags Rule; and
WHEREAS, the Port Orchard Municipal Court maintains continuing accounts which
involve multiple payments or transactions and such accounts are "covered accounts" within the
meaning of the Red Flags Rule; and
WHEREAS, in order to comply with the Red Flags Rule, City staff have prepared an Identity
Theft Prevention Program to aid in the detection, prevention and mitigation of identity theft in
connection with the opening of a covered account or an existing covered account; now therefore,
THE CITY COUNCIL OF THE CITY OF PORT ORCHARD DOES HEREBY
RESOLVE THE FOLLOWING:
THAT: The Identity Theft Prevention Program attached as Exhibit A is
hereby approved and adopted by the City Council of the City of Port
Orchard and City staff are directed to implement the Program in
accordance with its terms.
PASSED by the City Council of the City of Port Orchard, APPROVED by the Mayor and
attested by the Clerk in authentication of such passage this 28th day of Ap~ r!
/ :J
IDENTITY THEFT PREVENTION PROGRAM
I. PROGRAM ADOPTION
The City of Port Orchard has developed this Identity Theft Prevention Program
("Program") pursuant to the Federal Trade Commission's Red Flags Rule ("Rule"),
which implements Sections 114 and 315 of the Fair and Accurate Credit Transactions
Act of 2003. This Program was developed with the oversight and approval of the City
Council and the City Treasurer. After consideration of the size and complexity of the
City's operations and account systems, and the nature and scope of the City's activities,
the City Council determined that this Program was appropriate for the City, and
therefore approved this Program by the adoption of Resolution No. 043-09 on the 28th
day of April, 2009.
II. PROGRAM PURPOSE AND DEFINITIONS
A. Fulfilling requirements of the Red Flags Rule
Under the Red Flags Rule, every financial institution and creditor is required to
establish an Identity Theft Prevention Program tailored to its size, complexity and the
nature of its operation. The Program must contain reasonable policies and procedures
to:
I. Identify relevant Red Flags as defined in the Rule and this Program for new
and existing covered accounts and incorporate those Red Flags into the
Program;
2. Detect Red Flags that have been incorporated into the Program;
3. Respond appropriately to any Red Flags that are detected to prevent and
mitigate identity theft; and
4. Update the Program periodically to reflect changes in risks to customers or to
the safety and soundness of the City from identity theft.
B. Red Flags Rule definitions used in this Program
For the purposes of this Program, the following definitions apply:
I. Account. "Account" means a continuing relationship established by a person
with a creditor to obtain a product or service for personal, family, household
or business purposes.
2. Covered Account. A "covered account" means:
a. Any account the City of Port Orchard offers or maintains primarily for
personal, family or household purposes, that involves multiple payments
or transactions; and
b. Any other account the City of Port Orchard offers or maintains for which
there is a reasonably foreseeable risk to customers or to the safety and
soundness of the City of Port Orchard from identity theft.
City of Port Orchard Page I of6
Identity Theft Prevention Program
3. Creditor. "Creditor" has the same meaning as defined in Section 702 of the
Equal Credit Opportunity Act, 15 U.S.C. 169la, and includes a person or
entity that arranges for the extension, renewal or continuation of credit,
including the City of Port Orchard.
4. Customer. A "customer" means a person or business entity that has a covered
account with the City of Port Orchard.
5. Financial Institution. "Financial Institution" means a state or national bank, a
state or federal savings and loan association, a mutual savings bank, a state or
federal credit union, or any other entity that holds a "transaction account"
belonging to a customer.
6. Identifying Information. "Identifying information" means any name or
number that may be used, alone or in conjunction with any other information,
to identify a specific person, including name, address, telephone number,
date of birth, government issued driver's license or identification number,
alien registration number, government passport number, employer or taxpayer
identification number or unique electronic identification number.
7. Identity Theft. "Identity Theft" means fraud committed using the identifying
information of another person.
8. Program Administrator. The Program Administrator will be the City
Treasurer.
9. Red Flag. A "Red Flag" means a pattern, practice, or specific activity that
indicates the possible existence of identity theft.
IO.Service Provider. "Service Provider" means a person or business entity that
provides a service directly to the City of Port Orchard relating to or
connection with a covered account.
III. IDENTIFICATION OF RED FLAGS.
In order to identify relevant Red Flags, the City of Port Orchard shall review and
consider the types of covered accounts that it offers and maintains, the methods it
provides to open covered accounts, the methods it provides to access its covered
accounts, and its previous experiences with identity theft. The City of Port Orchard
identifies the following Red Flags, in each of the listed categories:
A. Suspicious Documents
Red Flags
I. Identification document or card that appears to be forged, altered or
inauthentic;
2. Identification document or card on which a person's photograph or physical
description is not consistent with the person presenting the document;
City of Port Orchard Page 2 of6
Identity Theft Prevention Program
3. Other documents with information that is not consistent with existing
customer information (such as a person's signature on a check appears
forged); and
4. Application for service that appears to have been altered or forged.
B. Suspicious Personal Identifying Information
Red Flags
I. Identifying information presented that is inconsistent with other information
the customer provides (such as inconsistent birth dates);
2. Identifying information presented that is inconsistent with other sources of
information (for instance, an address not matching an address on a driver's
license);
3. Identifying information presented that is the same as information shown on
other applications that were found to be fraudulent;
4. Identifying information presented that is consistent with fraudulent activity
(such as an invalid phone number or fictitious billing address);
5. An address or phone number presented that is the same as that of another
person;
6. Failing to provide complete personal identifying information on an
application when reminded to do so; and
7. Identifying information which is not consistent with the information that is on
file for the customer.
C. Suspicious Account Activity or Unusual Use of Account
Red Flags
1. Change of address for an account followed by a request to change the account
holder's name;
2. Payments stop on an otherwise consistently up-to-date account;
3. Account used in a way that is not consistent with prior use (such as very high
activity);
4. Mail sent to the account holder is repeatedly returned as undeliverable;
5. Notice to the City of Port Orchard that a customer is not receiving mail sent
by the City of Port Orchard;
6. Notice to the City of Port Orchard that an account has unauthorized activity;
7. Breach in the City of Port Orchard's computer system security; and
8. Unauthorized access to or use of customer account information.
D. Alerts from Others
Red Flag
I. Notice to the City of Port Orchard from a customer, a victim of identity theft,
a law enforcement authority or other person that it has opened or is
maintaining a fraudulent account for a person engaged in identity theft.
City of Port Orchard Page 3 of6
Identity Theft Prevention Program
IV. DETECTING RED FLAGS.
A. New Accounts
In order to detect any of the Red Flags identified above associated with the
opening of a new account, City of Port Orchard personnel will take the following steps
to obtain and verify the identity of the person opening the account:
Detect Red Flags
I. Require certain identifying information such as name, date of birth,
residential or business address, principal place of business for an entity,
driver's license or other identification;
2. Verify the customer's identity (for instance, review a driver's license or other
identification card);
3. Review documentation showing the existence of a business entity; and
4. Independently contact the customer.
B. Existing Accounts
In order to detect any of the Red Flags identified above for an existing account,
City of Port Orchard personnel will take the following steps to monitor transactions
with an account:
Detect Red Flags
I. Verify the identification of customers if they request information (in person,
via telephone, via facsimile, via email); and
2. Verify the validity of requests to change billing addresses.
V. PREVENTING AND MITIGATING IDENTITY THEFT
In the event City of Port Orchard personnel detect any identified Red Flags, such
personnel shall take one or more of the following steps, depending on the degree of risk
posed by the Red Flag:
Prevent and Mitigate Identity Theft
I. Monitor a covered account for evidence of identity theft;
2. Contact the customer with the covered account;
3. Change any passwords or other security codes and devices that permit access
to a covered account;
4. Not open a new covered account;
5. Close an existing covered account;
6. Reopen a covered account with a new number;
7. Notify the Program Administrator for determination of the appropriate step(s)
to take;
8. Notify law enforcement; or
City of Port Orchard Page 4 of6
Identity Theft Prevention Program
9. Determine that no response is warranted under the particular circumstances.
Protect Customer Identifying Information
In order to further prevent the likelihood of identity theft occurring with respect
to City of Port Orchard accounts, the City of Port Orchard shall take the following steps
with respect to its internal operating procedures to protect customer identifying
information:
I. Secure the City of Port Orchard website but provide clear notice that the
website is not secure;
2. Undertake complete and secure destruction of paper documents and computer
files containing customer information;
3. Make office computers password protected and provide that computer screens
lock after a set period of time;
4. Keep offices clear of papers containing customer identifying information;
5. Maintain computer virus protection up to date; and
6. Require and keep only the kinds of customer information that are necessary
for City of Port Orchard purposes.
VI. PROGRAM UPDATES
The Program will be periodically reviewed and updated to reflect changes in
risks to customers and to the safety and soundness of the City of Port Orchard from
identity theft. The Program Administrator shall at least annually consider the City of
Port Orchard's experiences with identity theft, changes in identity theft methods,
changes in identity theft detection and prevention methods, changes in types of accounts
the City of Port Orchard maintains and changes in the City of Port Orchard's business
arrangements with other entities and service providers. After considering these factors,
the Program Administrator shall determine whether changes to the Program, including
the listing of Red Flags, are warranted. If warranted, the Program Administrator shall
present recommended changes to the City Council for review and consideration.
VII. PROGRAM ADMINISTRATION.
A. Oversight
The City Treasurer shall be responsible for developing, implementing and
updating the Program.
The City Treasurer shall be responsible for the Program administration, for
appropriate training of City of Port Orchard staff on the Program, for reviewing any
staff reports regarding the detection of Red Flags and the steps for preventing and
mitigating identity theft, determining which steps of prevention and mitigation should
be taken in particular circumstances and considering periodic changes to the Program.
B. Staff Training and Reports
City of Port Orchard staff responsible for implementing the Program shall be
trained either by or under the direction of the Program Administrator in the detection of
Red Flags, and the responsive steps to be taken when a Red Flag is detected.
City of Port Orchard Page 5 of6
Identity Theft Prevention Program
C. Service Provider Arrangements
In the event the City of Port Orchard engages a service provider to perform an
activity in connection with one or more covered accounts, the City of Port Orchard shall
take the following steps to require that the service provider performs its activity in
accordance with reasonable policies and procedures designed to detect, prevent, and
mitigate the risk of identity theft.
I. Require, by contract, that service providers acknowledge receipt and review of
the Program and agree to perform its activities with respect to City of Port
Orchard covered accounts in compliance with the terms and conditions of the
Program and with all instructions and directives issued by the Program
Administrator relative to the Program; or
2. Require, by contract, that service providers acknowledge receipt and review of
the Program and agree to perform its activities with respect to City of Port
Orchard covered accounts in compliance with the terms and conditions of the
service provider's identity theft prevention program and will take appropriate
action to prevent and mitigate identity theft; and that the service providers agree
to report promptly to the City of Port Orchard in writing if the service provider in
connection with a City of Port Orchard covered account detects an incident of
actual or attempted identity theft or is unable to resolve one or more Red Flags
that the service provider detects in connection with a covered account.
D. Customer Identifying Information and Public Disclosure
The identifying information of City of Port Orchard customers with covered
accounts shall be kept confidential and shall be exempt from public disclosure to the
maximum extent authorized by law, including RCW 42.56.230(4). The City Council
also finds and determines that public disclosure of the City of Port Orchard's specific
practices to identity, detect, prevent and mitigate identify theft may compromise the
effectiveness of such practices and hereby directs that, under the Program, knowledge of
such specific practices shall be limited to the Program Administrator, and those City of
Port Orchard employees and service providers who need to be aware of such practices
for the purpose of preventing identity theft.
City of Port Orchard Page 6 of6
Identity Theft Prevention Program