About

Policy 5409 – Identity Theft Prevention

Last Review:  02/09/2023

Original Effective Date: 07/01/2009

Responsible Office: Division of Finance

Policy:

Background

In November 2007, final rules implementing section 114 of the Fair and Accurate Credit Transactions Act of 2003 were issued by the Federal Trade Commission (“FTC”), the federal bank regulatory agencies, and the National Credit Union Administration (“NCUA”). A joint notice of final rule making was published in the Federal Register (72 FR 63718) finalizing the Identity Theft Red Flags Rule (“the Rule”). The Rule was issued with the underlying goal of detecting, preventing, and mitigating identity theft “in connection with the opening of certain accounts or existing accounts.” The Rule supplements existing legislation aimed at preventing identity theft through tightened data security (e.g., Gramm-Leach-Bliley) by addressing situations where individuals are trying to use another person’s identity in order to fraudulently obtain resources or services.

Purpose of Policy

Louisiana Tech University, in response to the growing problem of identity theft, recognizes the need to safeguard personal and private information of all of its constituents, including faculty, staff, students, vendors, and donors. Additionally, the University recognizes that some activities of the University are subject to the provisions of the Rule.

Under the Rule, the University is required to establish an Identity Theft Prevention Program tailored to its size, complexity, and the nature of its operation. The Program must:

  1. Identify relevant Red Flags for new and existing covered accounts and incorporate those Red Flags into the Program;
  2. Detect Red Flags that have been incorporated into the Program;
  3. Respond appropriately to any Red Flags that are detected to prevent and mitigate identity theft; and
  4. Ensure the Program is updated periodically to reflect changes in risks to students or to the safety and soundness of the student from identity theft.

Program Adoption

This Program was developed with oversight and approval of the University of Louisiana Systems Board of Supervisors. After consideration of the size and complexity of the University’s operations and account systems, and the nature and scope of the University’s activities, the University of Louisiana Systems Board of Supervisors determined that this Program was appropriate for the University, and therefore approved this Program on June 26, 2009.

Louisiana Tech as a Covered Entity

The Rule applies to financial institutions and creditors that offer or maintain accounts that provide for multiple transactions primarily for personal, family, or household purposes. The Rule defined “account” as “a continuing relationship established to provide a financial product or service that a financial holding company could offer by engaging in an activity that is financial in nature or incidental to such a financial activity under section 4(k) of the Bank Holding Company Act, 12 U.S.C. 1843(k).” The University is considered a covered entity due to certain activities that involve the University as a creditor.

The Rule is three different, but related, rules. Two of the rules will apply to the University as follows:

Users of consumer reports must develop reasonable policies and procedures to apply when they receive notice of an address discrepancy from a consumer reporting agency. This provision would apply to any areas of the University that utilize consumer reporting agencies for any reason, i.e. credit or background checks for new hires.

Financial institutions and creditors holding “covered accounts” must develop and implement a written identity theft prevention program for both new and existing accounts. This provision applies to any areas of the University that issue any type of credit, i.e. Perkins Loans, short term loans for students from the SGA or Emergency Loan Fund, student tuition and fees owed from return of Title IV Funds, etc.

The third rule should not apply as noted below:

Debit and credit card issuers must develop policies and procedures to assess the validity of a request for a change of address that is followed closely by a request for an additional or replacement card. This provision does not apply as the University does not issue debit and/or credit cards. While the Tech Express Card has debit functionality, it is a closed loop system and cannot be processed through the regular debit/credit card network. Our customers are all known entities associated with the University and address updates are received only through uploads from the student records database. All refunds are initiated from a written request from the student and are generated through the Accounts Payable system.

Covered Accounts

The University has identified the following covered accounts administered by the University or by a service provider.

  1. Perkins Loan Accounts
  2. Refunds of student account credit balances
  3. SGA Loans
  4. Emergency Loans
  5. Delinquent student account balances
  6. Tuition payment plans through the 3rd party payment plan administered by Tuition Management

Identification of Relevant Red Flags

The following are relevant Red Flags:

Suspicious Documents

  1. Identification document or card that appears to be forged, altered or not authentic;
  2. Identification document or card on which a person’s photograph or physical description is not consistent with the person presenting the document;
  3. Other document with information that is not consistent with existing customer information (such as if a person’s signature on a check appears forged); and
  4. Application for service that appears to have been altered or forged.

Suspicious Personal Identifying Information

  1. Identifying information presented that is inconsistent with other information the customer provides (example: inconsistent birth dates);
  2. Identifying information presented that is inconsistent with other sources of information (for instance, an address not matching an address on a credit report);
  3. Identifying information presented that is the same as information shown on other applications that were found to be fraudulent;
  4. Identifying information presented that is consistent with fraudulent activity (such as an invalid phone number or fictitious billing address);
  5. Social security number presented that is the same as one given by another customer;
  6. An address or phone number presented that is the same as that of another person;
  7. A person fails to provide complete personal identifying information on an application when reminded to do so unless, by law social security numbers must not be required); and
  8. A person’s identifying information is not consistent with the information that is on file for the customer.

Suspicious Account Activity or Unusual Use of Account

  1. Change of address for an account followed by a request to change the account holder’s name;
  2. Payments stop on an otherwise consistently up-to-date account;
  3. Account used in a way that is not consistent with prior use (example: very high activity);
  4. Mail sent to the account holder is repeatedly returned as undeliverable;
  5. Notice to the University that a customer is not receiving mail sent by the University;
  6. Notice to the University that an account has unauthorized activity;
  7. Breach in the University’s computer system security; and
  8. Unauthorized access to or use of customer account information.

Alerts from Others

  1. Notice to the University from a customer, identity theft victim, law enforcement or other person that it has opened or is maintaining a fraudulent account for a person engaged in Identity Theft.
  2. Report of fraud accompanying a credit report;
  3. Notice or report from a credit agency of a credit freeze on a customer or applicant;
  4. Notice or report from a credit agency of an active duty alert for an applicant; and
  5. Indication from a credit report of activity that is inconsistent with a customer’s usual pattern or activity.

Oversight of the Program

Responsibility for developing, implementing and updating this Program lies with the Information Security Committee through the Division of Finance. Specific activities that may be performed include, but are not limited to:

  1. Ensuring the appropriate training of the University’s staff
  2. Oversight of service provider arrangements to ensure the service provider has reasonable policies and procedures in place concerning Red Flags
  3. Reviewing and documenting any reports regarding the detection of Red Flags from department heads and deans
  4. Considering periodic changes to the Program.

Non-disclosure of Specific Practices

For the effectiveness of this Program, knowledge about specific Red Flag identification, detection, mitigation and prevention practices may need to be limited. The Information Security Committee through the Division of Finance shall disseminate the necessary information to employees with a need to know. Any documents produced in order to develop or implement this program that list or describe specific practices and the information those documents contain are considered confidential and should not be shared with other University employees or the public. All documents and specific practices related to the Programs should be maintained in a confidential manner.

Definitions:

Creditor

Any person or organization who regularly extends, renews, or continues credit; any person or organization who regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who participates in the decision to extend, renew, or continue credit.

Covered Account

An account that a creditor offers or maintains, primarily for personal, family, or household purposes that involves or is designed to permit multiple payments or transactions.

Red Flag

A pattern, practice or specific activity that indicates the possible existence of identity theft.

Identifying Information

Any name or number that may be used, alone or in conjunction with any other information, to identify a specific person, including but not limited to: name, address, telephone number, social security number, date of birth, government issued driver’s license or identification number, alien registration number, government passport number, employer or taxpayer identification number, student identification number, computer’s Internet Protocol address, or routing code.

Procedures:

Responding to Detected Red Flags

Should a potentially fraudulent activity be detected, an employee should inform his/her Department Head or Dean as soon as possible that he/she has detected a potential Red Flag. The Department Head or Dean should conduct any necessary inquiry to determine the validity of the Red Flag. If it is determined that a situation of identity theft has occurred, the Department Head or Dean should immediately contact the Information Security Committee through the Division of Finance to inform them of the matter. Appropriate actions to mitigate the effects of the transaction should be taken immediately. Appropriate actions will be dependent on the type of Red Flag identified, type of transaction, relationship with the victim of the fraud, availability of contact information for the victim of the fraud, and numerous other factors. Appropriate actions may include, but are not limited to:

  1. Monitoring a covered account for evidence of identity theft.
  2. Contacting the customer.
  3. Changing any passwords, security codes or other security devices that permit access to a covered account.
  4. Reopening a covered account with a new account number.
  5. Not opening a new covered account.
  6. Closing an existing covered account.
  7. Notifying law enforcement.
  8. Determining no response is warranted under the particular circumstances.

In all situations where it is determined that a Red Flag has been positively identified, the Department Head or Dean shall document the discovery of the Red Flag, the inquiry of the Red Flag, and any specific actions taken to mitigate an actual identity theft discovered. This information should be forwarded to the Information Security Committee through the Division of Finance for review and documentation of the event.

Internal Steps

The University will take the following steps with respect to its internal operating procedures to prevent the likelihood of identity theft occurring with respect to covered accounts:

  1. Ensure that its website is secure or provide clear notice that the website is not secure;
  2. Ensure complete and secure destruction of paper documents and computer files containing student account information when a decision has been made to no longer maintain such information;
  3. Ensure that office computers with access to covered account information are password protected;
  4. Limit the use of social security numbers to activities for which they are required;
  5. Ensure computer virus protection is up to date; and
  6. Require and keeps only the kinds of student information that are necessary for University purposes.

Use of Service Providers

In the event the University engages a service provider to perform an activity in connection with one or more covered accounts, the University will take the following steps to ensure the service provider performs its activity in accordance with reasonable policies and procedures designed to detect, prevent and mitigate the risk of Identity Theft.

  1. Require that service providers have such policies and procedures in place; and
  2. Require that service providers review the Program and report any Red Flags to the Information Security Committee through the Division of Finance or the University employee with primary oversight of the service provider relationship.

Policy 5409 – Identity Theft Prevention

Last Review:  02/09/2023

Original Effective Date: 07/01/2009

Responsible Office: Division of Finance

Policy:

Background

In November 2007, final rules implementing section 114 of the Fair and Accurate Credit Transactions Act of 2003 were issued by the Federal Trade Commission (“FTC”), the federal bank regulatory agencies, and the National Credit Union Administration (“NCUA”). A joint notice of final rule making was published in the Federal Register (72 FR 63718) finalizing the Identity Theft Red Flags Rule (“the Rule”). The Rule was issued with the underlying goal of detecting, preventing, and mitigating identity theft “in connection with the opening of certain accounts or existing accounts.” The Rule supplements existing legislation aimed at preventing identity theft through tightened data security (e.g., Gramm-Leach-Bliley) by addressing situations where individuals are trying to use another person’s identity in order to fraudulently obtain resources or services.

Purpose of Policy

Louisiana Tech University, in response to the growing problem of identity theft, recognizes the need to safeguard personal and private information of all of its constituents, including faculty, staff, students, vendors, and donors. Additionally, the University recognizes that some activities of the University are subject to the provisions of the Rule.

Under the Rule, the University is required to establish an Identity Theft Prevention Program tailored to its size, complexity, and the nature of its operation. The Program must:

  1. Identify relevant Red Flags for new and existing covered accounts and incorporate those Red Flags into the Program;
  2. Detect Red Flags that have been incorporated into the Program;
  3. Respond appropriately to any Red Flags that are detected to prevent and mitigate identity theft; and
  4. Ensure the Program is updated periodically to reflect changes in risks to students or to the safety and soundness of the student from identity theft.

Program Adoption

This Program was developed with oversight and approval of the University of Louisiana Systems Board of Supervisors. After consideration of the size and complexity of the University’s operations and account systems, and the nature and scope of the University’s activities, the University of Louisiana Systems Board of Supervisors determined that this Program was appropriate for the University, and therefore approved this Program on June 26, 2009.

Louisiana Tech as a Covered Entity

The Rule applies to financial institutions and creditors that offer or maintain accounts that provide for multiple transactions primarily for personal, family, or household purposes. The Rule defined “account” as “a continuing relationship established to provide a financial product or service that a financial holding company could offer by engaging in an activity that is financial in nature or incidental to such a financial activity under section 4(k) of the Bank Holding Company Act, 12 U.S.C. 1843(k).” The University is considered a covered entity due to certain activities that involve the University as a creditor.

The Rule is three different, but related, rules. Two of the rules will apply to the University as follows:

Users of consumer reports must develop reasonable policies and procedures to apply when they receive notice of an address discrepancy from a consumer reporting agency. This provision would apply to any areas of the University that utilize consumer reporting agencies for any reason, i.e. credit or background checks for new hires.

Financial institutions and creditors holding “covered accounts” must develop and implement a written identity theft prevention program for both new and existing accounts. This provision applies to any areas of the University that issue any type of credit, i.e. Perkins Loans, short term loans for students from the SGA or Emergency Loan Fund, student tuition and fees owed from return of Title IV Funds, etc.

The third rule should not apply as noted below:

Debit and credit card issuers must develop policies and procedures to assess the validity of a request for a change of address that is followed closely by a request for an additional or replacement card. This provision does not apply as the University does not issue debit and/or credit cards. While the Tech Express Card has debit functionality, it is a closed loop system and cannot be processed through the regular debit/credit card network. Our customers are all known entities associated with the University and address updates are received only through uploads from the student records database. All refunds are initiated from a written request from the student and are generated through the Accounts Payable system.

Covered Accounts

The University has identified the following covered accounts administered by the University or by a service provider.

  1. Perkins Loan Accounts
  2. Refunds of student account credit balances
  3. SGA Loans
  4. Emergency Loans
  5. Delinquent student account balances
  6. Tuition payment plans through the 3rd party payment plan administered by Tuition Management

Identification of Relevant Red Flags

The following are relevant Red Flags:

Suspicious Documents

  1. Identification document or card that appears to be forged, altered or not authentic;
  2. Identification document or card on which a person’s photograph or physical description is not consistent with the person presenting the document;
  3. Other document with information that is not consistent with existing customer information (such as if a person’s signature on a check appears forged); and
  4. Application for service that appears to have been altered or forged.

Suspicious Personal Identifying Information

  1. Identifying information presented that is inconsistent with other information the customer provides (example: inconsistent birth dates);
  2. Identifying information presented that is inconsistent with other sources of information (for instance, an address not matching an address on a credit report);
  3. Identifying information presented that is the same as information shown on other applications that were found to be fraudulent;
  4. Identifying information presented that is consistent with fraudulent activity (such as an invalid phone number or fictitious billing address);
  5. Social security number presented that is the same as one given by another customer;
  6. An address or phone number presented that is the same as that of another person;
  7. A person fails to provide complete personal identifying information on an application when reminded to do so unless, by law social security numbers must not be required); and
  8. A person’s identifying information is not consistent with the information that is on file for the customer.

Suspicious Account Activity or Unusual Use of Account

  1. Change of address for an account followed by a request to change the account holder’s name;
  2. Payments stop on an otherwise consistently up-to-date account;
  3. Account used in a way that is not consistent with prior use (example: very high activity);
  4. Mail sent to the account holder is repeatedly returned as undeliverable;
  5. Notice to the University that a customer is not receiving mail sent by the University;
  6. Notice to the University that an account has unauthorized activity;
  7. Breach in the University’s computer system security; and
  8. Unauthorized access to or use of customer account information.

Alerts from Others

  1. Notice to the University from a customer, identity theft victim, law enforcement or other person that it has opened or is maintaining a fraudulent account for a person engaged in Identity Theft.
  2. Report of fraud accompanying a credit report;
  3. Notice or report from a credit agency of a credit freeze on a customer or applicant;
  4. Notice or report from a credit agency of an active duty alert for an applicant; and
  5. Indication from a credit report of activity that is inconsistent with a customer’s usual pattern or activity.

Oversight of the Program

Responsibility for developing, implementing and updating this Program lies with the Information Security Committee through the Division of Finance. Specific activities that may be performed include, but are not limited to:

  1. Ensuring the appropriate training of the University’s staff
  2. Oversight of service provider arrangements to ensure the service provider has reasonable policies and procedures in place concerning Red Flags
  3. Reviewing and documenting any reports regarding the detection of Red Flags from department heads and deans
  4. Considering periodic changes to the Program.

Non-disclosure of Specific Practices

For the effectiveness of this Program, knowledge about specific Red Flag identification, detection, mitigation and prevention practices may need to be limited. The Information Security Committee through the Division of Finance shall disseminate the necessary information to employees with a need to know. Any documents produced in order to develop or implement this program that list or describe specific practices and the information those documents contain are considered confidential and should not be shared with other University employees or the public. All documents and specific practices related to the Programs should be maintained in a confidential manner.

Definitions:

Creditor

Any person or organization who regularly extends, renews, or continues credit; any person or organization who regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who participates in the decision to extend, renew, or continue credit.

Covered Account

An account that a creditor offers or maintains, primarily for personal, family, or household purposes that involves or is designed to permit multiple payments or transactions.

Red Flag

A pattern, practice or specific activity that indicates the possible existence of identity theft.

Identifying Information

Any name or number that may be used, alone or in conjunction with any other information, to identify a specific person, including but not limited to: name, address, telephone number, social security number, date of birth, government issued driver’s license or identification number, alien registration number, government passport number, employer or taxpayer identification number, student identification number, computer’s Internet Protocol address, or routing code.

Procedures:

Responding to Detected Red Flags

Should a potentially fraudulent activity be detected, an employee should inform his/her Department Head or Dean as soon as possible that he/she has detected a potential Red Flag. The Department Head or Dean should conduct any necessary inquiry to determine the validity of the Red Flag. If it is determined that a situation of identity theft has occurred, the Department Head or Dean should immediately contact the Information Security Committee through the Division of Finance to inform them of the matter. Appropriate actions to mitigate the effects of the transaction should be taken immediately. Appropriate actions will be dependent on the type of Red Flag identified, type of transaction, relationship with the victim of the fraud, availability of contact information for the victim of the fraud, and numerous other factors. Appropriate actions may include, but are not limited to:

  1. Monitoring a covered account for evidence of identity theft.
  2. Contacting the customer.
  3. Changing any passwords, security codes or other security devices that permit access to a covered account.
  4. Reopening a covered account with a new account number.
  5. Not opening a new covered account.
  6. Closing an existing covered account.
  7. Notifying law enforcement.
  8. Determining no response is warranted under the particular circumstances.

In all situations where it is determined that a Red Flag has been positively identified, the Department Head or Dean shall document the discovery of the Red Flag, the inquiry of the Red Flag, and any specific actions taken to mitigate an actual identity theft discovered. This information should be forwarded to the Information Security Committee through the Division of Finance for review and documentation of the event.

Internal Steps

The University will take the following steps with respect to its internal operating procedures to prevent the likelihood of identity theft occurring with respect to covered accounts:

  1. Ensure that its website is secure or provide clear notice that the website is not secure;
  2. Ensure complete and secure destruction of paper documents and computer files containing student account information when a decision has been made to no longer maintain such information;
  3. Ensure that office computers with access to covered account information are password protected;
  4. Limit the use of social security numbers to activities for which they are required;
  5. Ensure computer virus protection is up to date; and
  6. Require and keeps only the kinds of student information that are necessary for University purposes.

Use of Service Providers

In the event the University engages a service provider to perform an activity in connection with one or more covered accounts, the University will take the following steps to ensure the service provider performs its activity in accordance with reasonable policies and procedures designed to detect, prevent and mitigate the risk of Identity Theft.

  1. Require that service providers have such policies and procedures in place; and
  2. Require that service providers review the Program and report any Red Flags to the Information Security Committee through the Division of Finance or the University employee with primary oversight of the service provider relationship.