Identity Theft Prevention Program

Slide Note
Embed
Share

Ensure staff understand their responsibility to protect sensitive information and know the steps to prevent, detect, and respond to identity theft. This training is required as part of the Montana Tech Identity Theft Prevention Program.


Uploaded on Dec 21, 2023 | 1 Views


Download Presentation

Please find below an Image/Link to download the presentation.

The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.

E N D

Presentation Transcript


  1. Identity Theft Prevention Program Red Flags Rules Fighting Fraud at Montana Tech

  2. Training Objective: Ensure staff understand their responsibility to protect sensitive information, and know the steps to prevent, detect and respond to identity theft. This training is required as part of the Montana Tech Identity Theft Prevention Program. 2

  3. Agenda Background Why me? What information are we talking about? Preventing Identity Theft How do I secure sensitive information to make sure this doesn t happen? Detecting Identity Theft What is a Red Flag, and how do I know one when I see one? Responding to Identity Theft I found a Red Flag now what do I do? For more information Where can I learn more? Montana Tech - Identity Theft Prevention Program 3

  4. Background Failure to protect sensitive data can lead to identity theft or other harm to consumers and also can harm Montana Tech, not just financially but also in loss of public trust. The amount of data captured and stored by businesses doubles every 12-18 months. Information Week $221 billion a year is lost by businesses worldwide due to identity theft. The Aberdeen Group As many as 10 million Americans a year are victims of identity theft. Identity Theft Resource Center, The Aftermath Study Montana Tech - Identity Theft Prevention Program 4

  5. Background The Gramm-Leach-Bliley Act s Safeguards Rule requires financial institutions to provide reasonable safeguards for customer data. Under the Act, financial institution includes any entity that allows deferred payment for services (for example, attending class before tuition and fees are paid in full). In other words This includes all affiliated campuses of The University of Montana, their contractors and sub-contractors. Montana Tech - Identity Theft Prevention Program

  6. Background Existing laws require us to: Implement measures that are reasonable and appropriate under the circumstances to protect sensitive consumer information, and Notify affected customers if there's a data breach. Examples of protected sensitive information include social security number, account information and information derived from credit reports. Fair and Accurate Credit Transaction Act (FACT) Federal Educational Right to Privacy Act (FERPA) Federal Trade Commission Act Health Insurance Portability and Accountability Act (HIPAA) Gramm-Leach-Bliley Act Drivers Privacy Protection Act (DPPA) State Laws 6 FTC Disposal Rule Fair Credit Reporting Act Montana Tech - Identity Theft Prevention Program

  7. What is Personally Identifiable Information? Information that can be used alone, or in conjunction with other information, to identify a specific person. Some examples: Name Address Social security number Birth date Drivers license number Other identification number (799) Passport number Montana Tech - Identity Theft Prevention Program 7

  8. Are you keeping information secure? Safeguarding sensitive information on your computers and in your files is YOUR RESPONSIBILITY, and is critical in preventing identity theft. A sound information security plan is built on five principles: Take stock know what you have Scale down keep only what you need Lock it protect the information in your care Pitch it properly dispose of what you don t need Plan ahead know how to respond to incidents Montana Tech - Identity Theft Prevention Program 8

  9. Take Stock Check files and computers for what information you have and where it is stored. Don t forget portable devices and offsite locations, including employees home computers. For example, an employee emails to a personal account, or copies to USB storage, sensitive information for use while working from home. Trace the flow of information from data entry, receipt/filing to disposal. At every stage, determine who has access and who should have access. Montana Tech - Identity Theft Prevention Program 9

  10. Scale Down Collect only what you need, and keep it only for the time you need it. Be cautious of what you store on devices connected to the internet! For receipts you give to customers, eliminate sensitive or personally identifying information (for example, 799 number or credit card number). Do not collect social security numbers out of habit or convenience. Only collect them when needed (for example, payroll reporting to IRS). Montana Tech - Identity Theft Prevention Program 10

  11. Lock It Lock offices, desks, store rooms and file drawers, and train employees to keep them that way. Limit access to databases, computer files and storage areas with sensitive files to only those people required to use that information as part of their job duties. Don t store sensitive information on a workstation or mobile device. Secure data that is shipped or stored offsite. Montana Tech - Identity Theft Prevention Program 11

  12. Pitch It Shred paper records you don t need. Make sure you ve met any applicable retention requirements! State Records Retention Schedules Use disk wiping utility programs on computers and portable storage devices before disposing of them. MUS Board of Regents Policy 1308 (Disposal of Computer Storage Devices) Montana Tech - Identity Theft Prevention Program 12

  13. Plan Ahead Put together a What if? plan to detect and respond to a security incident. Designate a senior staff member to coordinate your response. Investigate right away and know how to preserve evidence, such as computer logs and files, and original documents. Take steps to close off vulnerabilities, for example disconnect compromised computers from the Internet. Inform the Identity Theft Program Administrator for your campus and Public Safety or law enforcement. Montana Tech - Identity Theft Prevention Program 13

  14. Training and Oversight Train your employees! Oversee contractors and service providers Use good hiring practices (check references, and consider background checks in security-sensitive positions) Build information security training into orientation. Montana Tech - Identity Theft Prevention Program 14

  15. What is a Red Flag? A pattern, practice, or specific activity that indicates the possible existence of Identity Theft In other words A Red Flag helps us detect Identity Theft. A Red Flag is a warning that something may be wrong. It can be something one says, does, or gives you that makes you suspect he or she is not who they claim to be. It can be something that happens on an account that is unusual or suspicious. Montana Tech - Identity Theft Prevention Program 15

  16. Five Categories of Red Flags An alert, notification or warning from a consumer reporting agency Suspicious documents Suspicious personally identifying information Unusual use of, or suspicious activity related to, a covered account Notification by a victim of identity theft, a law enforcement authority, or other person, that the account is being used for identity theft Montana Tech - Identity Theft Prevention Program 16

  17. What are covered accounts? Any account that the University offers or maintains that is designed to permit multiple payments or transactions. Other types of accounts if there is a reasonably foreseeable risk of fraud or identity theft risk to customers or The University. Student Accounts Payroll Accounts Student Loans & Financial Aid Campus ID Cards! (Digger Card) Montana Tech - Identity Theft Prevention Program 17

  18. Hmm Suspicious Documents Documents that appear to be altered or forged. A photo ID that does not reasonably resemble the person presenting it. Information on an ID that does not agree with other information being provided, for example different names or birth dates, or signatures that are not reasonably alike. Information that does not agree with data already on file. Montana Tech - Identity Theft Prevention Program 18

  19. Suspicious Personally Identifying Information PII provided: - Is not consistent when compared with external sources - Is not consistent with other PII provided by the customer - Is associated with known fraudulent activity - Is a type commonly associated with fraudulent activity - Is not consistent with other PII on file with the University The social security number provided is the same as that submitted by someone else The address or telephone number provided is the same as an unusually large number of other people The person attempting to open a new account fails to provide all required PII on request Montana Tech - Identity Theft Prevention Program 19

  20. Examples of Unusual Use or Suspicious Activity Shortly following the notice of a change of address, the University receives a request for a new card or additional authorized users of an account The covered account is used in a manner that is not consistent with established patterns of activity Mail is repeatedly returned as undeliverable though transactions continue to be conducted on the account An account that has been inactive for a relatively long period of time is used The University is notified that the account holder is no longer receiving paper account statements The University is notified of unauthorized changes or transactions in connection with a covered account. Montana Tech - Identity Theft Prevention Program 20

  21. University Experience and Guidance Follow your department s procedures for verifying the identity of your customer. Offices and departments should also incorporate identity theft experience of the University, office or school into their procedures, such as: Actual past incidents of identity theft Additional methods the University has identified that reflect changes in identity theft risks Updates to the Identity Theft Prevention Program Ask your Identity Theft Prevention Program Administrator for help in making sure your procedures are sufficient. Montana Tech - Identity Theft Prevention Program 21

  22. When should I look for Red Flags? Student Enrollment Offices (new accounts) Require certain identifying information such as name, date of birth, academic records, home address or other identification. Verify the student s identity when you issue the student ID card (with drivers license or other government-issued photo identification) Ask your supervisor for information on the specific documents that are (and are not!) acceptable to verify identity. Montana Tech - Identity Theft Prevention Program 22

  23. When should I look for Red Flags? For Existing Accounts Verify the identification of students if they request any information about their records or account , regardless of whether the request is in person, by phone, by fax or by email. Verify the validity of any request to change billing address, and provide the student a reasonable means of promptly reporting incorrect billing address changes. Verify any request to change banking information given for billing and payment purposes. Montana Tech - Identity Theft Prevention Program 23

  24. What do I do if I suspect identity theft? 1. 2. Notify your supervisor. Investigate to the extent needed to determine if identity theft is likely or a data breach has occurred. Assess whether a response is needed and take immediate action if necessary. Notify your Identity Theft Prevention Program Administrator and Public Safety or local law enforcement (if applicable), and plan your response. 3. 4. Montana Tech - Identity Theft Prevention Program 24

  25. Actions to Consider (depending on circumstances): Cancel the suspected fraudulent transaction if possible Contact the person who owns the account (for example, the student) Change any passwords or security codes/devices that permit access to the account Monitor activity on the account Place a hold on the account Montana Tech - Identity Theft Prevention Program 25

  26. Actions to Consider (depending on circumstances): Close the account Reopen the account with a new account number Refuse to open a new account Refuse payments on an account Other actions based on advice from - Identity Theft Prevention Program Administrator for your campus - Public Safety or local law enforcement - IT Security Officer - Internal Audit Montana Tech - Identity Theft Prevention Program 26

  27. For More Information Policies and Procedures MUS Board of Regents Policy 960.1 (Identity Theft Prevention Program) MUS Board of Regents Policy 1300.1 Montana Tech Policy Montana Tech Identity Theft Prevention Program (Information Security) Other Resources for Businesses (to help us protect our customers) Federal Trade Commission Fighting Fraud with the Red Flags Rule: A How-To Guide for Business Fighting Back Against Identity Theft Information Compromise and the Risk of Identity Theft: Guidance for your Business US Department of the Treasury, President s Task Force on Identity Theft, Combating Identity Theft: A Strategic Plan Department of Defense, Personally Identifiable Information Training Montana Tech - Identity Theft Prevention Program 27

  28. For More Information (cont.) Other Resources for Consumers (to help you protect yourself!) Federal Trade Commission, Avoid Identity Theft video Federal Trade Commission, Take Charge: Fighting Back Against Identity Theft OnGuard OnLine, ID Theft Face Off online game/quiz National Consumers League Montana Tech - Identity Theft Prevention Program 28

  29. Questions/Comments? Identity Theft Prevention Program Administrator Marlene McMillan (Montana Tech), 496-4252 Mark Pullium (UM, 406-243-5757 IT Security Officer Mike Kukay (Montana Tech), 496-4673 Montana Tech - Identity Theft Prevention Program 29

  30. Quiz 1.The University is not a financial institution as defined by the Federal Identity theft Laws? a)True b)False 2. Which of the following are considered personally identifiable information? a) name b) social security number c)Passport number d)Bank account numbers e)Address f)All of the above 3.It s OK to keep social security numbers of former employee s as long as they are on my computer and we don t use them regularly? a)True b)False 4.When my office computer is replaced, my department should make sure all files are removed and a special utility program is used to erase the hard drive? a)True b)False

  31. Quiz 5.Which of the following is not a Red Flag? a)A notification for a credit bureau b)A photo ID that looks nothing like the person presenting it c)A name on a birth certificate that is spelled differently than the name on the person s driver s license. d)A phone call from someone claiming their identity was stolen e)None of the above 6.I can provide information on a student s account without verifying identity only if the student requests the information in person? a)True b)False 7.If I think I found a Red Flag, the first thing I should do is? a)Call the police b)Close the account c)Tell my supervisor d)Add one to the tally on the department s official Red Flag tote board 8.Identity theft prevention is my responsibility? a)True b)False

Related