A. Detection Of Red Flags: The employees of the city of Carbondale that interact directly with customers on a day to day basis shall have the initial responsibility for monitoring the information and documentation provided by the customer and any third party service provider in connection with the opening of a new account and the modification of or access to existing accounts and the detection of any red flags that might arise. Management shall see to it that all employees who might be called upon to assist customers with the opening of a new account or with modifying or otherwise accessing an existing account are properly trained such that they have a working familiarity with the relevant red flags identified in this program so as to be able to recognize any red flags that might surface in connection with the transaction. An employee who is not sufficiently trained to recognize the red flags identified in this program shall not open a new account for any customer, modify any existing account or otherwise provide any customer with access to information on an existing account without the direct supervision and specific approval of a management employee. Management employees shall be properly trained such that they can recognize the relevant red flags identified in this program and exercise sound judgment in connection with the response to any unresolved red flags that may present themselves in connection with the opening of a new account or with modifying or accessing of an existing account. Management employees shall be responsible for making the final decision on any such unresolved red flags.
The program administrator shall establish from time to time a written program setting forth the manner in which a prospective new customer may apply for service, the information and documentation to be provided by the prospective customer in connection with an application for a new utility service account, the steps to be taken by the employee assisting the customer with the application in verifying the customer's identity and the manner in which the information and documentation provided by the customer shall be maintained. Such program shall be generally consistent with the spirit of the customer identification program rules (31 CFR 103.121) implementing section 326(a) of the USA PATRIOT act but may be detailed as needed. The program administrator shall establish from time to time a written program setting forth the manner in which customers with existing accounts shall establish their identity before being allowed to make modifications to or otherwise gain access to existing accounts.
B. Response To Detected Red Flags: If the responsible employees of the city of Carbondale as set forth in the previous section are unable, after making a good faith effort, to form a reasonable belief that they know the true identity of a customer attempting to open a new account or modify or otherwise access an existing account based on the information and documentation provided by the customer, the municipality shall not open the new account or modify or otherwise provide access to the existing account as the case may be.
The program administrator shall establish from time to time a written program setting forth the steps to be taken in the event of an unresolved red flag situation. Consideration should be given to aggravating factors that may heighten the risk of identity theft, such as a data security incident that results in unauthorized access to a customer's account, or a notice that a customer has provided account information to a fraudulent individual. Appropriate responses to prevent or mitigate identity theft when a red flag is detected include:
1. Monitoring a covered account for evidence of identity theft.
2. Contacting the customer.
3. Changing any passwords, security codes, or other security devices that permit access to a covered account.
4. Reopening a covered account with a new account number.
5. Not opening a new covered account.
6. Closing an existing covered account.
7. Notifying law enforcement.
8. Determining that no response is warranted under the particular circumstances. (Ord. 2009-17)