ARE YOU READY FOR NOVEMBER 1ST, 2008
The OCC, Board, FDIC, OTS, NCUA and FTC (the Agencies) are jointly issuing final rules and guidelines implementing section 114 of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act) and final rules implementing section 315 of the FACT Act.
The final rules require each financial institution and creditor that holds any consumer account, or other account for which there is a reasonably foreseeable risk of identity theft, to develop and implement an Identity Theft Prevention Program (Program) for combating identity theft in connection with new and existing accounts. The Program must include reasonable policies and procedures for detecting, preventing, and mitigating identity theft and enable a financial institution or creditor to:
1. Identify relevant patterns, practices, and specific forms of activity that are “red flags” signaling possible identity theft and incorporate those red flags into the Program;
2. Detect red flags that have been incorporated into the Program;
3. Respond appropriately to any red flags that are detected to prevent and mitigate identity theft; and
4. Ensure the Program is updated periodically to reflect changes in risks from identity theft.
The final rules also require credit and debit card issuers to develop policies and procedures to assess the validity of a request for a change of address that is followed closely by a request for an additional or replacement card. In addition, the final rules require users of consumer reports to develop reasonable policies and procedures to apply when they receive a notice of address discrepancy from a consumer reporting agency.
DATES: The joint final rules and guidelines are effective January 1, 2008. The mandatory compliance date for this rule is November 1, 2008.
What is Identity Theft?
Identity Theft occurs when someone uses the personal information of another (name, date of birth, social security number, credit number, credit card numbers, bank account number, etc) fraudulently and without permission.
The FBI calls it "the fastest growing white-collar crime in America."
Consequences of Identity Theft
“Identity Theft is the nation's fastest growing crime according to FBI statistics and identity theft/fraud is the fastest-growing category of Federal Trade Commission (FTC) complaints.”
– Number of victims: 9.9 million
– Average loss to businesses per victim: $4,800
– Loss to businesses: $47.6 billion
– Average out-of-pocket loss for victims: $500
– Total loss to victims: $5 billion
– Hours spent per victim resolving the problem: 30
– Hours spent resolving problem: 297 million
(Source: FTC identity theft survey report, 2003 )
FACT Act - Identity Theft Red Flags & Address Discrepancies
• Must implement an Identity Theft Prevention Program designed to identify, prevent and mitigate identity theft
• Develop list of Red Flags, to prevent and mitigate identity theft
• Obtain identifying information and verify identity of customers
• Authenticate and monitor transaction for existing customer
• Verify address changes and respond to address discrepancies
FACT Act - Red Flag Categories
• Alerts, notification or warnings from a Consumer Reporting Agency
• Suspicious Documents
• Suspicious Personal Identifying Information
• Suspicious or Unusual Activity
• External notice of Identity Theft
Identity Thieves’ Tactics
• They remove mails from inbox or direct it to their mailbox and obtain the crucial data.
• Steal confidential information from wallets, homes, vehicles, computers, web sites or purses to conduct identity theft.
• Retrieve private details from the recycling bins or trash bins.
• They may also pose as employer, creditor or property owner to obtain the copy of individual’s credit report or gain access to confidential data through other sources.
• They tamper with the ABMs (Automated Banking Machines) and other sale terminals to obtain the PIN (Personal identification number) of credit cards.
• Identity thieves explore public utility services such as telephone books, libraries, citizen records and obituaries to derive more information to conduct identity theft.
• They may buy required details from an unfaithful employee, who works in the organization where the financial information of the individuals are stored and commit identity theft.
Prevent & Mitigate Identity Theft
• Become familiar with the Red Flags applicable to your institution
• Report Identity Theft to your Compliance department & Information Security Officer
• Become familiar with Identity Thieves’ methods
• Be diligent in reviewing customer activity and preventing identity theft