Compliance with
Federal Trade
Commission’s “Red
Flag Rule”
Identify Theft is one of the fastest growing areas
of white collar crime
U.S. Congress passed Fair and Accurate Credit
Transactions of 2003 (FACT Act)
Act charged Federal Trade Commission (FTC) to
address identity theft
FTC issued “Red Flags Rules”
Background
Red Flags Rules requires “financial
institutions” and “creditors” that hold
“covered accounts” to develop and
implement “an identity theft prevention
program”
Primarily designed for banks
and financial institutions
We meet the criteria because of loan
programs, installment payment plans, use
of credit reports. For example:
◦ Federal Perkins Loans
◦ University Loans
◦ Bursar’s Office Installment Payment Plans
◦ Lehigh credit and/or background checks
Why Lehigh?
Why Lehigh?
University systems maintain and
communicate confidential personal
information, consider for example:
W-2’s
1098-T’s
Loan Notes
Offer Letters
Board of Trustees has approved Lehigh’s Identity
Theft Prevention Program
Oversight by Peggy Plympton
Training appropriate University staff is part of the
program
New hires will be trained in coordination with
Banner training
Implementation of the Program
What’s a common method used to gain
information about someone in order to
“steal” their identity?
What’s a thief’s common strategy to delay
someone from discovering their identity
has already been stolen?
Questions to Consider:
Answer:
Change their address
You have access to change addresses in
BANNER using one of the following forms:
1. SPAIDEN
2. PPAIDEN
3. FOAIDEN
4. APAIDEN
Why are you being trained?
Lehigh is already “ahead of the curve”
The University has already established
policies and procedures that include
very good controls to safeguard
identity and financial information
To raise your level of awareness
To help you maximize the effectiveness of
your department’s policies and procedures
To make sure your day-to-day practices =
your policies and procedures
To know what to do if you encounter a red
flag
Purpose of the training
1) Debit and credit card issuers must develop policies
and procedures to assess validity of a request for
change of address
2) Users of consumer reports must develop reasonable
policies and procedures to apply when they receive
notice of an address discrepancy from a consumer
reporting agency
3) Financial institutions and creditors holding “covered
accounts” must develop and implement a written
identity theft prevention program
Three Key Rules
Identify relevant “red flags” you may
encounter
Detect those “red flags”
Respond appropriately to detected red
flags
Update the procedures periodically
How can you help?
Documents provided for identification
appearing altered or forged
Photograph on ID inconsistent with
appearance of customer
Personal information inconsistent with
information already on file at Lehigh
“Red Flags” that could occur at
Lehigh
Mail sent to customer repeatedly returned
as undeliverable despite being an active
account
A fraud alert included with a consumer
report
A consumer reporting agency providing a
notice of address discrepancy
More red flags:
Preferred method of making student
address changes is for the individual to
make his/her own changes via Banner
self-service.
See Registrar’s Office website for
complete instructions
Making an address change
Acceptable identity verification:
Government issued Picture ID
Additional confirming information is
required if :
Picture ID is issued by non-government
organization (ex: employer-issued ID card) OR
ID does not include a picture(ex: Social Security
Card)
NOTE: All requests for change of address must be in writing!
Requests made In-Person
Acceptable by Itself:
◦ Email from a “lehigh.edu” account
Additional Confirmation is Required If:
◦ Email is sent from any other email account
Requests made by Email
All such requests must be signed. If any
question about validity, take additional
steps to confirm, for example:
Photocopy of driver’s license
Copy of utility bill
Send sample mail to address to confirm
Phone directory
Internet directories
Requests by Mail or Fax
No address should be changed without
having something in writing from the
customer.
This is for your protection as well as the
customer’s.
Requests by Phone
Before concluding you have an identity theft
situation, consider the “big picture”:
Did a payment accompany the updated
information?
How much was the payment?
How/who benefited from the payment?
Can the individual answer questions only student
would know?
Have you ever temporarily forgotten some of
your personal information?
Red Flags are not Black &
White!
Delay opening new account
Suspend access to an existing account
Attempt to contact customer at the last
known legitimate address/phone number
If you’ve done the above and still suspect
identity theft, contact Lehigh Police
What to Do If You Suspect
Identify Theft
Fines from the government
Costs to Lehigh to help mitigate damages
Possible lawsuit
Damage to Lehigh’s reputation
Its the right thing to do!
Why you should be concerned
Contact Mike King, Bursar
See Federal Trade Commission website:
www.ftc.gov
Where to go for more Information