Red Flag Identity Theft Prevention Policy

Red Flag Identity Theft Prevention Policy

Sponsor:	Office of Administration
Contact:	Vice President for Administration or Assistant Vice President for Administration
Category:	Information Security and Technology
Number:	1000.006
Effective Date:	09/01/2009
Implementation History:
Keywords:	Red Flag Rules
Background Information:

Purpose

To develop and identify campus identity theft prevention programs.

Definitions

Account: A relationship established with an institution by a student, employee, or other person to obtain educational, medical, or financial services.

Covered Account: An account that permits multiple transactions or poses a reasonably foreseeable risk of being used to promote an identity theft.

Responsible Staff: Personnel, based on title, who regularly work with Covered Accounts and are responsible for performing the day-to-day application of the Program to a specific Covered Account by detecting and responding to Red Flags.

Red Flag: A pattern, practice, or specific activity that indicates the possible existence of identity theft.

Response: Action taken by Responsible Staff member(s) upon the detection of any Red Flag to prevent and mitigate identity theft.

Service Provider: A contractor to the University engaged to perform an activity in connection with a Covered Account.

Identity Theft: A fraud committed or attempted using the identifying information of another person without authority.

Statements

The Federal Trade Commission (FTC), under the authority granted by the Fair and Accurate Credit Transaction Act of 2003 (FACTA), has issued a Red Flags Rule (16 CFR 681.2) requiring that financial institutions and creditors develop Identity Theft Prevention Programs aimed at recognizing and preventing activity related to identity theft. SUNY campuses and health care facilities come within the definition of creditors and, therefore, must develop Identity Theft Prevention Programs as necessary.

Each Identity Theft Prevention Program must include written policies and procedures for: (1) identifying "covered accounts"; (2) identifying relevant patterns, practices, and forms of activity within those accounts that are “red flags” signaling possible identity theft; (3) detecting red flags; (4) responding appropriately to any red flags that are detected in order to prevent and mitigate identity theft; and, (5) administering the program in a manner that ensures proper staff training, implementation, oversight, and updating.

Under FACTA, the FTC may impose civil penalties on institutions that fail to comply with the Red Flags Rule.

This Identity Theft Prevention Program ("Program") was developed pursuant to a SUNY policy adopted by the Board of Trustees on May 12, 2009 in order to comply with the Federal Trade Commission's Red Flags Rule (16 CFR 681.2). The purpose of this Program is to prevent frauds committed by the misuse of identifying information (i.e. identity theft). The Program aims to accomplish this goal by identifying accounts maintained by the University which may be susceptible to fraud (hereinafter "Covered Accounts"), identifying possible indications of identity theft activity associated with those accounts (hereinafter "Red Flags"), devising methods to detect such activity, and responding appropriately when such activity is detected.

Program Administration and Oversight

The President has designated the Vice President for Administration as Program Administrator to oversee administration of this Program. The Program Administrator may designate additional staff of the University to undertake responsibility for training personnel, monitoring service providers, and updating the Program, all under the supervision of the Program Administrator.

The Program Administrator or designees shall identify and train responsible staff, as necessary, to effectively implement and apply the Program. All University personnel are expected to assist the Program Administrator in implementing and maintaining the Program.

The Program Administrator or designees shall review service provider agreements and monitor service providers, where applicable, to ensure that such providers have adequate identity theft prevention programs in place. When the Program Administrator determines that a service provider is not adequately guarding against threats of identity theft, he/she shall have the authority to take necessary corrective action, including termination of the service provider's relationship with the University.

Prior to the beginning of each academic year, the Program Administrator shall evaluate the Program to determine whether it is functioning adequately. This evaluation shall include: a case-by-case assessment of incidents of identity theft or attempted identity theft that occurred during the previous academic year; interviews with Responsible Staff; and a survey of all accounts maintained by the University to identify any additional Covered Accounts. In response to this annual evaluation, the Program Administrator shall recommend amendments to this Program for approval by the President.

The Program Administrator shall maintain records relevant to the Program, including: the Written Program; documentation on training; documentation on instances of identity theft and attempted identity theft; contracts with service providers that perform activities related to Covered Accounts; and updates to the Written Program. From time to time, the University Vice President for Administration, or other designated internal control officer, may perform audits to determine if various segments of the University are in compliance with the Program.

Covered Accounts; Responsible Staff; Red Flags; Responses:

Covered Account	Student Accounts
Responsible Staff	Director of Student Accounts

Red Flag 1:	Suspicious ID presented by a student who is trying to access or alters account
Response:	Deny access to account until the student's identity has been established through acceptable means.
Red Flag 2:	A change of address request occurs under suspicious circumstances.
Response:	Ask student to verify address and any suspicious usage activity.
Red Flag 3:	Suspicious or no ID presented by a student who is trying to pick up a student refund check.
Response:	Do not release refund check until the student's identity has been established through acceptable means.
Red Flag 4:	A student calls and asks what the credit card number is that will be refunded (if they withdraw, for example).
Response:	Do not give credit card numbers out over the phone.
Red Flag 5:	Student calls and requests that a refund check be sent to an alternate address that is not on file.
Response:	Develop a "secret question" for each student that assists in identifying a student.
Red Flag 6:	Requests from a third party by telephone for information about a student account.
Response:	Must have authorization on file (or be part of an agreement on a third party voucher).

Covered Account	Financial Aid Accounts
Responsible Staff	Financial Aid Advisors

Red Flag 1:	Department of Education selects student's FAFSA for verification .
Response:	Collect supplemental information from student and resolve any conflict between FAFSA and supplemental information provided by student.
Red Flag 2:	Student submits multiple FAFSAs containing conflicting information.
Response:	Contact student to resolve conflict and verify information.
Red Flag 3:	Requests from a third party by telephone for information about a student account.
Response:	Must have authorization on file (or be part of an agreement on a third party voucher).

Covered Account	Email Accounts
Responsible Staff	Information Security Specialists

Red Flag:	Notification from student that email has been accessed without authorization. verification.
Response:	Freeze account; secure account; issue new account if necessary.

Covered Account	Datatel Account
Responsible Staff	Information Security Specialists

Red Flag:	Multiple failed login attempts.
Response:	Freeze account and/or reset password

Covered Account	Foundation Loans
Responsible Staff	Financial Aid Advisors

Red Flag:	Inaccurate information on request.
Response:	Deny loan request until verified with student

Covered Account	Accounts Recieveable
Responsible Staff	Director of Business Affairs

Red Flag:	Requests from a third party by telephone for information about a student account.
Response:	Must have authorization on file (or be part of an agreement on a third party voucher).

Applicable Legislation and Regulations

Related References, Policies, Procedures, Forms and Appendices