Identity Theft Prevention Program

1. Identity Theft Prevention Program Red Flags Rules Fighting Fraud at Montana Tech

2. Training Objective: Ensure staff understand their responsibility to protect sensitive information, and know the steps to prevent, detect and respond to identity theft. This training is required as part of the Montana Tech Identity Theft Prevention Program.

3. Agenda Background Why me? What information are we talking about? Preventing Identity Theft How do I secure sensitive information to make sure this doesn’t happen? Detecting Identity Theft What is a Red Flag, and how do I know one when I see one? Responding to Identity Theft I found a Red Flag… now what do I do? For more information… Where can I learn more?

4. Background Failure to protect sensitive data can lead to identity theft or other harm to consumers — and also can harm Montana Tech, not just financially but also in loss of public trust. • The amount of data captured and stored by businesses doubles every 12-18 months. Information Week$221 billion a year is lost by businesses worldwide due to identity theft. The Aberdeen GroupAs many as 10 million Americans a year are victims of identity theft. Identity Theft Resource Center, The Aftermath Study

5. The Gramm-Leach-Bliley Act’s Safeguards Rule requires financial institutions to provide reasonable safeguards for customer data.Under the Act, “financial institution” includes any entity that allows deferred payment for services (for example, attending class before tuition and fees are paid in full). In other words… This includes all affiliated campuses of The University of Montana, their contractors and sub-contractors. Background

6. Existing laws require us to: “Implement measures that are reasonable and appropriate under the circumstances to protect sensitive consumer information,” and Notify affected customers if there's a data breach. Examples of protected sensitive information include social security number, account information and information derived from credit reports. Background Fair and Accurate Credit Transaction Act (FACT) Federal Educational Right to Privacy Act (FERPA) Federal Trade Commission Act Health Insurance Portability and Accountability Act (HIPAA) Gramm-Leach-Bliley Act Drivers Privacy Protection Act (DPPA) State Laws FTC Disposal Rule Fair Credit Reporting Act

7. What is Personally Identifiable Information? Information that can be used alone, or in conjunction with other information, to identify a specific person. Some examples: Name Address Social security number Birth date Drivers license number Other identification number (799) Passport number

8. Are you keeping information secure? • Safeguarding sensitive information on your computers and in your files is YOUR RESPONSIBILITY, and is critical in preventing identity theft. • A sound information security plan is built on five principles: • Take stock – know what you have • Scale down – keep only what you need • Lock it – protect the information in your care • Pitch it – properly dispose of what you don’t need • Plan ahead – know how to respond to incidents

9. Take Stock Check files and computers for what information you have and where it is stored. Don’t forget portable devices and offsite locations, including employees’ home computers. For example, an employee emails to a personal account, or copies to USB storage, sensitive information for use while working from home. Trace the flow of information from data entry, receipt/filing to disposal. At every stage, determine who has access – and who should have access.

10. Scale Down Collect only what you need, and keep it only for the time you need it. Be cautious of what you store on devices connected to the internet! For receipts you give to customers, eliminate sensitive or personally identifying information (for example, 799 number or credit card number). Do not collect social security numbers out of habit or convenience. Only collect them when needed (for example, payroll reporting to IRS).

11. Lock It Lock offices, desks, store rooms and file drawers, and train employees to keep them that way. Limit access to databases, computer files and storage areas with sensitive files to only those people required to use that information as part of their job duties. Don’t store sensitive information on a workstation or mobile device. Secure data that is shipped or stored offsite.

12. Pitch It Shred paper records you don’t need. Make sure you’ve met any applicable retention requirements! State Records Retention Schedules Use disk wiping utility programs on computers and portable storage devices before disposing of them. MUS Board of Regents Policy 1308 (Disposal of Computer Storage Devices)

13. Plan Ahead Put together a “What if?” plan to detect and respond to a security incident. Designate a senior staff member to coordinate your response. Investigate right away and know how to preserve evidence, such as computer logs and files, and original documents. Take steps to close off vulnerabilities, for example disconnect compromised computers from the Internet. Inform the Identity Theft Program Administrator for your campus and Public Safety or law enforcement.

14. Training and Oversight Train your employees! Oversee contractors and service providers Use good hiring practices (check references, and consider background checks in security-sensitive positions) Build information security training into orientation.

15. What is a Red Flag? “A pattern, practice, or specific activity that indicates the possible existence of Identity Theft” In other words… A Red Flaghelps us detect Identity Theft. A Red Flag is a warning that something may be wrong. It can be something one says, does, or gives you that makes you suspect he or she is not who they claim to be. It can be something that happens on an account that is unusual or suspicious.

16. Five Categories of Red Flags An alert, notification or warning from a consumer reporting agency Suspicious documents Suspicious personally identifying information Unusual use of, or suspicious activity related to, a covered account Notification by a victim of identity theft, a law enforcement authority, or other person, that the account is being used for identity theft

17. What are coveredaccounts? Any account that the University offers or maintains that is designed to permit multiple payments or transactions. Other types of accounts if there is a reasonably foreseeable risk of fraud or identity theft risk to customers or The University. Student Accounts Payroll Accounts Student Loans & Financial Aid Campus ID Cards! (Digger Card)

18. Suspicious Documents Documents that appear to be altered or forged. A photo ID that does not reasonably resemble the person presenting it. Information on an ID that does not agree with other information being provided, for example different names or birth dates, or signatures that are not reasonably alike. Information that does not agree with data already on file. Hmm…

19. PII provided: Is not consistent when compared with external sources Is not consistent with other PII provided by the customer Is associated with known fraudulent activity Is a type commonly associated with fraudulent activity Is not consistent with other PII on file with the University The social security number provided is the same as that submitted by someone else The address or telephone number provided is the same as an unusually large number of other people The person attempting to open a new account fails to provide all required PII on request Suspicious Personally Identifying Information

20. Shortly following the notice of a change of address, the University receives a request for a new card or additional authorized users of an account The covered account is used in a manner that is not consistent with established patterns of activity Mail is repeatedly returned as undeliverable though transactions continue to be conducted on the account An account that has been inactive for a relatively long period of time is used The University is notified that the account holder is no longer receiving paper account statements The University is notified of unauthorized changes or transactions in connection with a covered account. Examples of Unusual Use or Suspicious Activity

21. Follow your department’s procedures for verifying the identity of your customer. Offices and departments should also incorporate identity theft experience of the University, office or school into their procedures, such as: Actual past incidents of identity theft Additional methods the University has identified that reflect changes in identity theft risks Updates to the Identity Theft Prevention Program Ask your Identity Theft Prevention Program Administrator for help in making sure your procedures are sufficient. University Experience and Guidance

22. Student Enrollment Offices (new accounts) Require certain identifying information such as name, date of birth, academic records, home address or other identification. Verify the student’s identity when you issue the student ID card (with drivers license or other government-issued photo identification) Ask your supervisor for information on the specific documents that are (and are not!) acceptable to verify identity. When should I look for Red Flags? Montana Tech - Identity Theft Prevention Program 22

23. For Existing Accounts Verify the identification of students if they request any information about their records or account , regardless of whether the request is in person, by phone, by fax or by email. Verify the validity of any request to change billing address, and provide the student a reasonable means of promptly reporting incorrect billing address changes. Verify any request to change banking information given for billing and payment purposes. When should I look for Red Flags? Montana Tech - Identity Theft Prevention Program 23

24. What do I do if I suspect identity theft? Notify your supervisor. Investigate to the extent needed to determine if identity theft is likely or a data breach has occurred. Assess whether a response is needed and take immediate action if necessary. Notify your Identity Theft Prevention Program Administrator and Public Safety or local law enforcement (if applicable), and plan your response.

25. Actions to Consider(depending on circumstances): Cancel the suspected fraudulent transaction if possible Contact the person who “owns” the account (for example, the student) Change any passwords or security codes/devices that permit access to the account Monitor activity on the account Place a hold on the account

26. Actions to Consider (depending on circumstances): Close the account Reopen the account with a new account number Refuse to open a new account Refuse payments on an account Other actions based on advice from Identity Theft Prevention Program Administrator for your campus Public Safety or local law enforcement IT Security Officer Internal Audit

27. For More Information Policies and Procedures MUS Board of Regents Policy 960.1 (Identity Theft Prevention Program) MUS Board of Regents Policy 1300.1(Information Security) Montana Tech Policy Montana Tech Identity Theft Prevention Program Other Resources for Businesses (to help us protect our customers) Federal Trade Commission Fighting Fraud with the Red Flags Rule: A How-To Guide for Business Fighting Back Against Identity Theft Information Compromise and the Risk of Identity Theft: Guidance for your Business US Department of the Treasury, President’s Task Force on Identity Theft, Combating Identity Theft: A Strategic Plan Department of Defense, Personally Identifiable Information Training

28. For More Information (cont.) Other Resources for Consumers(to help you protect yourself!) Federal Trade Commission, Avoid Identity Theft video Federal Trade Commission, Take Charge: Fighting Back Against Identity Theft OnGuardOnLine, ID Theft Face Off online game/quiz National Consumers League

29. Questions/Comments? Identity Theft Prevention Program Administrator Marlene McMillan (Montana Tech), 496-4252 Mark Pullium (UM, 406-243-5757 IT Security Officer Mike Kukay (Montana Tech), 496-4673

30. Quiz

31. Quiz