AgdaPkt 2009-09-14 - Laserfiche WebLink

Browse Search

REPORT 6.38 age 1 To the Honorable Mayor and City Council From the eit Mana er September 14, 2009 SUBJECT Federal Trade Commission's Red Flag Rules RECOMMENDATION. Approve by resolution a policy to implement the Red Flag Rules (Rules), a recently required mandate to assist in the prevention of identity theft. BACKGROUND The Federal Trade Commission's (FTC) Rules are federal regulations enacted as part of the Fair and Accurate Credit Transactions Act (FACT) of 2003 which require financial institutions and creditors with covered accounts to design and implement a written identity theft prevention program by August 1, 2009. The Rules define identity theft as fraud committed using the identifying information of another person and a red flag as a pattern, practice, or specific activity that indicates the possible existence of identity theft. The policies and procedures of the program must include the following four basic elements: (1) identify relevant warning signs, including patterns, practices, or specific activities, that are indicative of identity theft. I.e. "red flags;" (2) detect the red flags that have been incorporated into the program; (3) provide for appropriate responses to such red flags in order to prevent or mitigate identity theft with respect to the covered account; and (4) detail a plan to periodically update the program. The FTC has issued guidelines to assist creditors in designing their programs and which identify possible red flags. These red flags fall into five categories: (1) alerts, notifications, or warnings from a consumer reporting agency; (2) suspicious documents; (3) suspicious personal identification information, such as a suspicious address; (4) unusual or suspicious activity relating to a covered account; and (5) notices from consumers, victims of identity theft, law enforcement, or other businesses regarding possible identity theft in connection with covered accounts. The Rules also require the City Council or senior employees to manage the program and provide for appropriate staff training and oversight of the program. The Rules are designed to be flexible so entities and creditors may tailor their programs in accordance with the size, complexity, and nature of their operations. With respect to cities, it appears that the Rules apply to cities in cases where local government entities are "creditors" with "covered accounts." The FTC considers a government entity to be a creditor where it defers payment for goods or services by its customers, the most common example being public utilities. A "covered accounr is defined as (1) an account that is used primarily for family, personal, or household purposes and involves or is designed for multiple payments or transactions, such as credit card accounts, utility accounts, and checking or savings accounts; or (2) any other account that involves a foreseeable risk of identity theft. On August 12, 2009, staff presented the Identity Theft Prevention Program to the City Council Utilities Committee for their feedback and direction. The Utilities Committee