Red Flag Rules

1. Red Flag Rules Identity Theft Prevention Program Training Quiz

2. Training Instructions • Welcome to the Virginia Community College System Red Flag Training Quiz. The following instructions will help you navigate through the module. Thank you for taking the time to participate in this training and good luck and enjoy. • In order to navigate through the presentation charts, please utilize the arrows ( ) at the bottom of each page. • Inserted within the module are a number of multiple choice questions to gauge your understanding of the information. In order to answer the question, just click anywhere on the answer you choose. You will not be able to proceed to the next section until you have correctly answered the question.

3. Question #1 – What does the FTC say we must do? • Identify what types of indicators could be Red Flags – what to look for • Detect when these Red Flag indicators might be occurring • Mitigate or reduce the exposure not only to the Colleges, but also to these customer who might have had his/her ID stolen • Train our employees on how to accomplish all of this • All of the above

4. Congratulations - Correct Answer Answer: E The FTC requires that we be able to: • Identify what accounts are considered “covered accounts” and what Red Flags could be present within these accounts • Detect the Red Flags within these identified “covered accounts” • Reducethe exposure these Red Flags might cause to both VCCS and the customer by investigating and responding appropriately • Train our employees in these areas

5. Sorry – Answer Incorrect Click Here to Go back to the Question and try again

6. Question #2 – What is considered a “covered account”? • An account that allows an individual to make payments over time • An account for small businesses that pay for services in full at the time they are rendered • An account that is covered by VCCS in case of student default • Only A and B • All of the above

7. Congratulations - Correct Answer Answer: A For individuals, covered accounts include any account that allows individuals to make multiple payments to pay off an obligation. Only small business accounts or individuals that do not pay at the time the product or service is received (such as monthly billing) could be considered as “covered” by the Red Flag Regulation. These may or may not be considered as covered based upon the risk associated with identity theft.

8. Sorry – Answer Incorrect Click Here to Go back to the Question and try again

9. Question #3 – Is cashing a check for a student considered a “covered account activity”? • Yes • No

10. Congratulations - Correct Answer Answer: No Single transaction items, such as cashing a check for a student, are not considered as covered account activities by the regulation. Also, purchasing a book or article from the bookstore or cafeteria on your credit card is not considered as “covered” by the Red Flag Rules.

11. Sorry – Answer Incorrect Click Here to Go back to the Question and try again

12. Question #4: Which of the following is NOT considered Personal Identifying Information? • Address • Phone number • Automobile license plate number • Student ID • Government issued driver’s license number or identification number

13. Congratulations - Correct Answer Answer: C An automobile license plate number is not a government authorized form of identification. All others are recognized as valid forms of identification.

14. Sorry – Answer Incorrect Click Here to Go back to the Question and try again

15. Question #5: Which of the following is NOT considered Personal Identifying Information by the FTC? • Date of Birth • Social Security number • Employer or taxpayer identification number • Financial routing code • An individual’s height and weight

16. Congratulations - Correct Answer Answer: E Even though a person’s height and weight are personal information from an individual’s perspective, they are not considered as information to qualify as a possible Red Flag. All others are recognized as valid forms of identification or are protected information.

17. Sorry – Answer Incorrect Click Here to Go back to the Question and try again

18. Question #6 – Which of the following is not a Red Flag category? • Notifications and warnings from credit agencies • Suspicious documents or personal identifying information • Suspicious account activity • Expired documents • Alerts and notifications from identity theft victims

19. Congratulations - Correct Answer Answer: D. Expired documents do not raise Red Flags, and, in fact, expired documents can actually be utilized to verify identification.

20. Sorry – Answer Incorrect Click Here to Go back to the Question and try again

21. Question #7 – Where can Red Flags be detected? • The opening of a customer account • The ongoing monitoring of a customer account • A response from a credit bureau • Both A and B • All of the above

22. Congratulations - Correct Answer Answer: E Red Flags can be detected when opening a new covered account, while monitoring an existing covered account, in general communications or correspondence with a customer, and with notifications from a credit bureau. Looking for suspicious documents and mismatching IDs should be accomplished when opening new accounts. Existing accounts should be monitored for unusual activity and notifications from customers concerning invalid or unauthorized transactions. Also, all correspondence from a credit bureau or agency should be monitored for possible signals for ID theft or Red Flags.

23. Sorry – Answer Incorrect Click Here to Go back to the Question and try again

24. Question #8 – Are all Customer Accounts considered as Covered Accounts? • Yes • No

25. Congratulations - Correct Answer Answer: B Not all customer accounts are necessarily considered as covered accounts under the Red Flag regulations. Any individual account that offers multiple payments over time is always considered a covered account. Other customer accounts (both small business and individual accounts) that allow the purchase of a service or product without the immediate payment by the customer could be considered a covered account, based on the financial and personal risks to both the customer and the VCCS. If there is limited risk involved, then the customer account does not require designation as a covered account.

26. Sorry – Answer Incorrect Click Here to Go back to the Question and try again

27. Question #9 – Which of the following is NOT part of the process for Reducing Exposure and Liability? • You must act quickly • You must follow all individual department procedures and regulations • You must gather all information and documentation • For every Red Flag identified, you must complete the Red Flag Suspicious Activities Report and forward it to the Program Administrator • None of the above

28. Congratulations - Correct Answer Answer: D The Program Administrator should not be notified unless there has been a potential fraud determined through investigation, not just if a Red Flag has been detected. A thorough investigation needs to be completed by the individual and his/her management prior to involving the Program Administrator. The other items listed should occur during the process. Gather all information, follow internal department processes, and remember to act quickly because, if it is an actual fraud, speed is of the essence in determining this and stopping any future fraudulent activities.

29. Sorry – Answer Incorrect Click Here to Go back to the Question and try again

30. Question #10 – When opening a new account or issuing a replacement ID card an employee must do which of the following? • Verify the individual’s identification with a Government issued photo ID before capturing an image • Accept a written authorization from the individual for another person to obtain the card for them (from an on-line submission) • Notify a supervisor if the individual can not product a valid photo ID • Ensure that the individual sign a log book prior to obtaining the card • All of the above

31. Congratulations - Correct Answer Answer: A Never issue a card to someone other than the actual individual owner of the account even if the individual has supposedly signed to allow someone else to pick it up. The signature can not be verified. Do not contact a supervisor just because the individual can not produce a valid photo ID at that time. Politely ask them to obtain one and come back. But if you feel that the ID has been altered or compromised in any way, then contacting a supervisor is appropriate. Even though the Red Flag regulation does not require a log book, individual departmental guidelines may require a signature prior to obtaining the card. And again, never issue a card to anyone but the account owner.

32. Sorry – Answer Incorrect Click Here to Go back to the Question and try again

33. Question #11 – When disbursing a student short term loan an employee must do which of the following? • Verify the individual’s identification with a Government issued photo before disbursing any money • Accept a written authorization from the individual for another person to obtain the money for them • Notify a supervisor if the individual can not produce a valid photo ID • Verify that the individual’s class schedule to ensure they are a full time student • All of the above

34. Congratulations - Correct Answer Answer: A Never disburse a loan to someone other than the actual individual owner of the account, even if the individual has supposedly signed to allow someone else to pick it up. The signature can not be verified. Verifying the class schedule is not part of the process. Part time students can also receive short term student loans. Do not contact a supervisor just because the individual can not produce a valid photo ID at that time. Politely ask them to obtain one and come back. But if you feel that the ID has been altered or compromised in any way, then contacting a supervisor is appropriate. And again, never disburse money to anyone but the loan account owner

35. Sorry – Answer Incorrect Click Here to Go back to the Question and try again

36. Question #12 – Could a community college with no identified covered accounts be affected by the FTC Red Flag Regulation? • Yes • No

37. Congratulations - Correct Answer Answer: A Any community college that interfaces with a consumer reporting agency or credit bureau must implement a policy to respond to address discrepancy reports received by the agency or bureau. While this is not an actual part of the Red Flag Regulation, it is a part of the overall FTC Identity Theft Rules that includes the Red Flag section.

38. Sorry – Answer Incorrect Click Here to Go back to the Question and try again

39. CONGRATULATIONS!! You have completed the Red Flag Training as specified by the Federal Trade Commission and Virginia Community College System Thank you for taking this training quiz.