Condo Media - January 2010 - 49

1. Identify relevant “red flags” for new and existing covered accounts. That is, identify the red flags of identity theft that are most relevant to the organization’s particular business and incorporate those red flags into the program. 2. Detect red flags that have been incorporated into the program. Set up procedures to detect those red flags in the organization’s dayto-day business. 3. Prevent and mitigate identity theft. Respond appropriately to any red flags that are identified and subsequently detected. 4. Update the program. Review and update the program periodically (at least annually) to reflect changes in risks to customers or to the safety and soundness of the creditor from identity theft. The rule requires approval of the procedures by the board of directors or an appropriate committee of the board for any entity covered, oversight of service providers who deal with covered accounts, and appropriate training. Annual reports to the board or senior management also are mandated. More information may be found on the FTC Web site. The final rule may be found in the Federal Register (16 C.F.R. Part 681). The FTC also has posted a short Web video on compliance issues. CM This analysis was prepared by the CAI Government and Public Affairs staff. CAI will continue to seek additional clarification on the scope of the rule and will provide members with additional updates as this issue evolves. During this time, individuals are encouraged to take the opportunity to learn more about the rule’s potential impact on your association. and verify the validity of change-of-address requests and changes in banking information given for billing purposes 4. In general, Association staff should be alert for the possibility of identity theft in the following situations: • The photo identification submitted by the homeowner does not resemble the homeowner • Identifying information submitted by the homeowner appears to be altered or forged. • Information on one form of identification the homeowner has submitted is inconsistent with information on another form of identification or with information already in the records kept by Association • An address or telephone number is discovered to be incorrect, non-existent, or fictitious • The homeowner fails to provide identifying information or documents • The homeowner’s signature does not match a signature in the homeowner’s records • [If programs are already being used to mitigate identity theft, such tools should also be listed here.] III. Respond to Red Flags. If any employee of the Association detects fraudulent activity or if a homeowner claims to be a victim of identity theft, the Association will respond to and investigate the situation. If potentially fraudulent activity (a red flag) is detected by an employee of the Association: 1. The employee should gather all documentation and report the incident to his or her immediate supervisor or the designated privacy official. If reported to a supervisor, that supervisor should relay the information to the privacy official 2. The privacy official will determine whether the activity is fraudulent or authentic 3. If the activity is determined to be fraudulent, then the Association should take immediate action, which may include the following: • Canceling the transaction; • Closing an existing account; • Reopening an account with a new account number; • Not opening a new account; • Not trying to collect on an account or not selling an account to a debt collector; • Notifying appropriate law enforcement; • Notifying the affected homeowner; and • Changing any passwords or other security devices that permit access to accounts. If a homeowner claims to be a victim of identity theft, the following procedures should be followed: 1. The homeowner should be encouraged to file a police report for identity theft if the homeowner has not done so already. 2. The homeowner should be encouraged to complete the ID Theft Affidavit developed by the Federal Trade Commission, along with supporting documentation. 3. Association will compare the homeowner’s documentation with personal information in the homeowner’s records. 4. If, following investigation, it appears that the homeowner has been a victim of identity theft, the Association will promptly consider what further remedial act/notifications may be needed under the circumstances. 5. If, following investigation, it does not appear that the homeowner has been a victim of identity theft, the Association will take whatever action it deems appropriate. CONDO MEDIA • JANUARY 2010

Condo Media - January 2010

Table of Contents for the Digital Edition of Condo Media - January 2010