2009_Resolutions - Laserfiche WebLink

Home Browse Search

IDENTITY THEFT POLICY Section 1. PURPOSE • A. The Federal Trade Commission ("FTC') has instituted a rule that goes into effect May 1, 2009 ("Rule'), whereby all creditors, as defined in the Rule, must implement a written identity theft prevention program to detect, prevent, and mitigate identity theft in connection with the opening of an account or any existing account. The City of Charlottesville, Utility Billing Office (Utility) is a creditor for purposes of the Rule. B. The Utility shall take certain steps to comply with the Rule of the program as hereinafter defined, which shall then constitute the Utility's Identity Theft Policy ("Policy"). Also contained in this Policy are the Utility's procedures for compliance with the Virginia breach of personal information notification statute. C. The purpose of the Policy is to identify and mitigate instances of identity theft, by detecting "Red Flags." Red Flags include, but are not limited to, the following: 1) Alerts or notifications from consumer reporting agencies 2) Presentation of suspicious documents, such as identification documents that have been forged or altered 3) Presentation of suspicious personal identifying information, such as a suspicious address change or social security number 4) Unusual account activity 5) Notices from customers, victims of identity theft, law enforcement, or other persons regarding identity theft in connection with covered accounts held by the creditor. Section 2. NEW CUSTOMER ACCOUNTS A. Whenever any new customer applies to the Utility for water, sewer, and/or gas service, the Utility shall require the applicant to submit certain information, including but not limited to, the applicant's name, the • address for which service is requested, and the applicant's social security number. B. Upon the securing of this information, the Utility shall run a check on these three (3) information fields against the Utility's current database in order to see if any of the fields are duplicates. C. In the event that any duplicate names, addresses, or social security numbers show up on the City's current database, the Utility shall identify the duplicates as "Red Flags" and shall then use due diligence in order to determine whether any identity theft is being attempted or has occurred. D. Such due diligence shall include an attempt to verify the validity of any new customer information that is submitted and that has been identified as a Red Flag, as well an attempt to verify the validity of the information on the existing database that comprises the Red Flag. If, in the Utility's opinion, invalid information has been submitted or exists on the system, the Utility shall notify the customer(s) in question. As appropriate, the Utility may also take other steps including the following: 1. Monitoring of the new and existing accounts. 2. Reopening accounts with new account numbers. 3. Not opening the new account. 4. Closing the existing account. 5. Not attempting to collect on accounts or not selling accounts to debt collectors. 6. Notifying law enforcement officials. 7. Making a determination that no response is warranted under the particular circumstances. Section 3. EXISTING CUSTOMER ACCOUNTS • A. The Utility shall regularly monitor existing customer accounts, authenticating customers where necessary, monitoring transactions and any suspicious account activity, and verifying the validity of any change of