(A) Identification Of Relevant Red Flags: The municipality has considered the guidelines and the illustrative examples of possible red flags from the FTC's identity theft rules and has reviewed the municipality's past history with instances of identity theft, if any. The municipality hereby determines that, given the relative size of the municipality and the limited nature and scope of the covered account services that the municipality provides to its citizens, the following are the relevant red flags for purposes of this chapter:
1. Alerts, Notifications, Or Other Warnings Received From Consumer Reporting Agencies Or Service Providers:
(a) A consumer reporting agency alerts the village of a credit freeze, address disparity, or that an account has been noted to have abusive or fraudulent activity.
2. The Presentation Of Suspicious Documents:
(a) Documents provided for identification of the applicant or customer do not appear to be genuine and unaltered.
(b) The photograph or physical description on the identification provided is not consistent with the appearance of the applicant or customer.
(c) Information given to open or transfer the account is not consistent with the readily accessible identification information that is on file with the municipality with respect to the applicant or customer.
3. The Presentation Of Suspicious Personal Identifying Information, Such As A Suspicious Address Change:
(a) Personal identifying information provided is of a type associated with fraudulent activity. For example: 1) the address provided is fictitious, a mailbox drop, or a prison; or 2) the phone number provided is invalid or is associated with a pager or answering service.
(b) Personal identifying information provided is associated with known fraudulent activity.
(c) Personal identifying information provided is inconsistent with utility records.
(d) The customer fails to provide all needed personal identifying information upon request.
4. The Unusual Use Of, Or Other Suspicious Activity Related To, A Covered Account:
(a) The utility is notified of unauthorized charges or transactions in connection with a customer's account.
(b) Customer notifies utility that they are not receiving their bill.
(c) Mail sent to a customer is repeatedly returned.
(d) Payments are made in a manner associated with fraud. For example, a deposit or initial payment is made and no payments are made thereafter.
5. Notice Of Possible Identity Theft:
(a) The municipality is notified by a customer, a law enforcement official or other persons that a fraudulent account has been opened for a person engaged in identity theft.
(B) Detection Of Red Flags: The employees of the municipality that interact directly with customers on a day to day basis shall have the initial responsibility for monitoring the information and documentation provided by the customer and any third party service provider in connection with the opening of new accounts and the modification of or access to existing accounts, and the detection of any red flags that might arise. Management shall see to it that all employees who might be called upon to assist a customer with the opening of a new account or with modifying or otherwise accessing an existing account are properly trained such that they have a working familiarity with the relevant red flags identified in this section so as to be able to recognize any red flags that might surface in connection with the transaction.
An employee who is not sufficiently trained to recognize the red flags identified in this section shall not open a new account for any customer, modify any existing account or otherwise provide any customer with access to information in an existing account without the direct supervision and specific approval of a management employee. Management employees shall be properly trained such that they can recognize the relevant red flags identified in this section and exercise sound judgment in connection with the response to any unresolved red flags that may present themselves in connection with the opening of a new account or with modifying or accessing of an existing account. Management employees shall be responsible for making the final decision on any such unresolved red flags.
The program administrator shall, from time to time, establish or modify written policies setting forth the manner in which a prospective new customer may apply for utility service from the municipality, the information and documentation to be provided by the prospective customer in connection with an application for a new utility service account, the steps to be taken by the employee assisting the customer with the application in verifying the customer's identity and the manner in which the information and documentation provided by the customer and any third party service provider shall be maintained. Such policy shall be generally consistent with the spirit of the customer identification program rules (31 CFR 103.121) implementing section 326(a) of the USA PATRIOT act but need not be as detailed. The program administrator shall establish from time to time a written policy setting forth the manner in which customers with existing accounts shall establish their identity before being allowed to make modifications to or otherwise gain access to existing accounts.
(C) Response To Detected Red Flags: If the responsible employees of the municipality as set forth in the previous subsection are unable, after making a good faith effort, to form a reasonable belief that they know the true identity of a customer attempting to open a new account or to modify or otherwise access an existing account based on the information and documentation provided by the customer and any third party service provider, the municipality shall not open the new account or modify or otherwise provide access to the existing account as the case may be. Opening new accounts or the modification or access to existing accounts will be on a nondiscriminatory basis based on the village's policies.
Appropriate responses to prevent or mitigate identity theft when a red flag is detected include:
1. Monitoring a covered account for evidence of identity theft.
2. Contacting the customer.
3. Changing any passwords, security codes, or other security devices that permit access to a covered account.
4. Reopening a covered account with a new account number.
5. Not opening a new covered account.
6. Closing an existing covered account.
7. Not attempting to collect on a covered account or not selling a covered account to a debt collector.
8. Notifying law enforcement.
9. Determining that no response is warranted under the particular circumstances.
The program administrator shall, from time to time, review the program and incorporate additional guidance to address new or unresolved red flag situations. The program administrator shall give consideration to aggravating factors that may heighten the risk of identity theft, such as a data security incident that results in unauthorized access to a customer's account, or a notice that a customer has provided account information to a fraudulent individual or website. (Ord. 2008-23, 12-4-2008)