In the event city personnel detect any identified red flags they shall investigate the situation, as necessary, to determine whether there is a material risk that identity theft has occurred or whether there is a benign explanation for the red flag. The investigation shall be documented in accordance with the city's incident reporting policy. If it appears that identity theft has not occurred, the city may determine that not further action is necessary. If it appears that identity theft has occurred, such personnel shall take one or more of the following steps, depending on the degree of risk posed by the red flag. Steps can include:
(A) Continuing to monitor an account for evidence of identity theft;
(B) Contacting the customer in writing;
(C) Changing any passwords or other security devices that permit access to accounts;
(D) Reopening an account with a new number;
(E) Not opening a new account;
(F) Closing an existing account;
(G) Notifying law enforcement;
(H) Notify the Program Administrator (as defined below) for determination of the appropriate step(s) to take.
(Ord. 2480, passed 9-11-2012)