(A) Fulfilling requirements of the Red Flags Rules. Under the Red Flags Rules, every financial institution and creditor is required to establish an identity theft prevention program tailored to its size, complexity, and the nature of its operation. Each program must contain reasonable policies and procedures to:
(1) Identity relevant red flags for new and existing covered accounts and incorporate those red flags into the program;
(2) Detect red flags that have been incorporated into the program;
(3) Respond appropriately to any red flags that are detected to prevent and mitigate identity theft; and
(4) Ensure the program is updated periodically to reflect changes in risks to customers or to the safety and soundness of the creditor from identity theft.
(B) Red Flags Rules definitions used in this program.
(1) The Red Flags Rules define IDENTITY THEFT as fraud committed using the identifying information of another person and a RED FLAG as a pattern, practice, or specific activity that indicates the possible existence of identity theft.
(2) The Red Flags Rules define CREDITORS to include finance companies, automobile dealers, mortgage brokers, utility companies, and telecommunications companies. Where non-profit and government entities defer payment for goods or services, they, too, are to be considered creditors.
(3) The village’s billing accounts maintained for the delivery of services, including water and any other utility services, are covered by the Rules. According to the Red Flag Rules, a COVERED ACCOUNT is:
(a) Any account the village offers or maintains primarily for personal, family, or household purposes, that involves multiple payments or transactions; and
(b) Any other account the village offers or maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness of the village from identity theft, including small business and sole proprietorship accounts.
(4) IDENTITY INFORMATION is defined under the Rule as any name or number that may be used, alone or in conjunction with any other information, to identify a specific person, including: name, address, telephone number, Social Security number, date of birth, government issued driver’s license or identification number, alien registration number, government passport number, employer or taxpayer identification number, unique electronic identification number, computer’s internet protocol address, or routing code.
(Res. 09-R-1, passed 4-21-2009)