Compliance with Federal Trade Commission’s “Red Flag Rule”

1. Compliance with Federal Trade Commission’s “Red Flag Rule”

2. Identify Theft is one of the fastest growing areas of white collar crime • U.S. Congress passed Fair and Accurate Credit Transactions of 2003 (FACT Act) • Act charged Federal Trade Commission (FTC) to address identity theft • FTC issued “Red Flags Rules” Background

3. Red Flags Rules requires “financial institutions” and “creditors” that hold “covered accounts” to develop and implement “an identity theft prevention program” Primarily designed for banks and financial institutions

4. We meet the criteria because of loan programs, installment payment plans, use of credit reports. For example: • Federal Perkins Loans • University Loans • Bursar’s Office Installment Payment Plans • Lehigh credit and/or background checks Why Lehigh?

5. University systems maintain and communicate confidential personal information, consider for example: • W-2’s • 1098-T’s • Loan Notes • Offer Letters Why Lehigh?

6. Board of Trustees has approved Lehigh’s Identity Theft Prevention Program • Oversight by Peggy Plympton • Training appropriate University staff is part of the program • New hires will be trained in coordination with Banner training Implementation of the Program

7. What’s a common method used to gain information about someone in order to “steal” their identity? What’s a thief’s common strategy to delay someone from discovering their identity has already been stolen? Questions to Consider:

8. Answer: Change their address

9. You have access to change addresses in BANNER using one of the following forms: 1. SPAIDEN 2. PPAIDEN 3. FOAIDEN 4. APAIDEN Why are you being trained?

10. Lehigh is already “ahead of the curve” The University has already established policies and procedures that include very good controls to safeguard identity and financial information

11. To raise your level of awareness • To help you maximize the effectiveness of your department’s policies and procedures • To make sure your day-to-day practices = your policies and procedures • To know what to do if you encounter a red flag Purpose of the training

12. Debit and credit card issuers must develop policies and procedures to assess validity of a request for change of address • Users of consumer reports must develop reasonable policies and procedures to apply when they receive notice of an address discrepancy from a consumer reporting agency • Financial institutions and creditors holding “covered accounts” must develop and implement a written identity theft prevention program Three Key Rules

13. Identify relevant “red flags” you may encounter • Detect those “red flags” • Respondappropriately to detected red flags • Update the procedures periodically How can you help?

14. Documents provided for identification appearing altered or forged • Photograph on ID inconsistent with appearance of customer • Personal information inconsistent with information already on file at Lehigh “Red Flags” that could occur at Lehigh

15. Mail sent to customer repeatedly returned as undeliverable despite being an active account • A fraud alert included with a consumer report • A consumer reporting agency providing a notice of address discrepancy More red flags:

16. Preferred method of making student address changes is for the individual to make his/her own changes via Banner self-service. • See Registrar’s Office website for complete instructions Making an address change

17. Acceptable identity verification: • Government issued Picture ID Additional confirming information is required if : • Picture ID is issued by non-government organization (ex: employer-issued ID card) OR • ID does not include a picture(ex: Social Security Card) NOTE: All requests for change of address must be in writing! Requests made In-Person

18. Acceptable by Itself: • Email from a “lehigh.edu” account Additional Confirmation is Required If: • Email is sent from any other email account Requests made by Email

19. All such requests must be signed. If any question about validity, take additional steps to confirm, for example: • Photocopy of driver’s license • Copy of utility bill • Send sample mail to address to confirm • Phone directory • Internet directories Requests by Mail or Fax

20. No address should be changed without having something in writing from the customer. • This is for your protection as well as the customer’s. Requests by Phone

21. Before concluding you have an identity theft situation, consider the “big picture”: • Did a payment accompany the updated information? • How much was the payment? • How/who benefited from the payment? • Can the individual answer questions only student would know? • Have you ever temporarily forgotten some of your personal information? Red Flags are not Black & White!

22. Delay opening new account • Suspend access to an existing account • Attempt to contact customer at the last known legitimate address/phone number • If you’ve done the above and still suspect identity theft, contact Lehigh Police What to Do If You Suspect Identify Theft

23. Fines from the government • Costs to Lehigh to help mitigate damages • Possible lawsuit • Damage to Lehigh’s reputation • Its the right thing to do! Why you should be concerned

24. Contact Mike King, Bursar • See Federal Trade Commission website: www.ftc.gov Where to go for more Information