How To Protect Students Against Identity Theft and Complying with Safeguarding Regulations

Transcription

1 How To Protect Students Against Identity Theft and Complying with Safeguarding Regulations 2017 BY: KAREN REDDICK NATIONAL CREDIT MANAGEMENT

2 WHAT DO THESE STARS HAVE IN COMMON? 2

3 Interesting Stats Identity theft is the fastest-growing crime in America Costing Americans $15.4 billion fraudulent charges Affecting 17.2 million people 19 people become victims of identity theft every minute 1 out of 6 people are victims #1 one consumer complaint to the U.S. Federal Trade Commission The average victim can expect to spend $500 dollars and 30 hours on average resolving each identity theft crime. The FTC estimates it takes victims months to clear their names 3

4 Interesting Stats Victims face higher interest rates, insurance rates, rejected loans, and/or unjust accusations of criminal conduct which require costly legal assistance to rectify $5.8 billion in Tax Fraud paid by the IRS 500,000 victims per year in Health Care Fraud 88% Non-Tech Related It is estimated that 13 percent of all victims reported a family member or relative as the person responsible for misusing their personal information 4

5 Interesting Stats 20 percent of identity theft victim information was misused through credit card fraud The second-highest incidence of identity theft occurred through government documents/benefits fraud, at 15% of all complaints 24 percent of identity theft victims were a part of the Y and Millennial Generations Lost or stolen laptops containing sensitive data can cost over $115,000 to a company in recovery efforts if a data breach goes undiscovered for at least a week 5

6 Interesting Stats 6

7 Interesting Stats 7

8 Stats By State 8

9 Education Is A Prime Target Education is most likely to be hacked 17 %of all reported data breaches, ranking second only to the medical industry with 27 percent Last year alone over 30 Colleges and Universities have had some sort of security breaches Main Source off Education/Campus Breaches Lost/stolen PCs, laptops and media Stolen wallets/purses/backpacks and personal financial information Dumpster Diving 9

10 Students are A Prime Target 90,000 complaints about identity theft filed last year 49 percent increase over the prior year. 18 to 24 were far more likely to experience identity theft. 22 percent of these were notified that they had been a victim of identity theft fraud after they were denied credit or contacted by a debt collector. 3 times higher then average fraud victims 4 times likely to be taken advantage of by someone they know compared with other consumers, according to the market researcher. Thief's use Low- and high-tech strategies Shoulder Surfing Bogus credit card offers 10

11 Educate our Students Guard all numbers Social Security Numbers ATM Codes Computer Passwords Never carry personal information on their persons Don t send important documents to dorms or apartments Avoid public Wi-Fi Be Savvy on social media Be careful sending important documents by mail. Don't send important documents to dormitories and off-campus apartments where mail might not be secure. 11

12 Social Engineering Social Media Obtain cell numbers, dorm address, private s Intelligence about friends and family Social Engineering Attacks to Watch Out For Phishing Pretexting Baiting Quid Pro Quo Tailgating 12

13 5 Scams Targeting Students Bogus Student Tax Tuition Scam Fake Credit Cards False Rental Listings Friendly Fraud 13

14 What To Protect Name Social Security # Date of Birth Address Credit Card# Bank Account # PIN s or Passwords 14

15 Types of Identity Theft 1. Financial ID Theft - Name and Social Security Number (telephone service, credit cards, loans, buy merchandise, lease cars and apartments). 2. Medical ID Theft A thief may use your name or health insurance numbers to see a doctor, get prescription drugs, file claims with your insurance provider, or get other care. 3. Criminal ID Theft - The imposter in this crime provides the victim s information instead of his own when stopped by law enforcement. 4. Identity Cloning - The imposter uses the victim s information to establish a new life. 5. Business Identity Theft - The perpetrator gets credit cards or checking accounts in the name of the business. 15

16 How To Protect Identity Opt out OPT-OUT or Remove your name from Credit Bureau Lists Good for 5 years To opt out permanently: You may begin the permanent Opt-Out process online at Monitor Your Credit Report and Your Children s (Under 18) ( Make copies of your credit cards and contents of wallet Protect personal items Do not use un secure wireless network Subscribe to AG No Call List Guard Your Social Security Number Zealously Do not carry social security numbers When someone asks for it: Why do you need? How do you protect it? How will it be used? What happens if I don t give it you? 16

17 Resources Credit Freeze In some states you can put a freeze on your credit file, so no one will have access to your information without your authorization. 17

18 Credit Freeze es/0497-credit-freeze-faqs#what 18

19 Equifax Breach 143 Million Consumers May-July 2017 Trusted ID Premier Removed Litigation Clause Information Compromised Social Security # Date of Birth 19

20 What To Do If Someone Is A Victim 1. Place a fraud alert on your credit reports and review your reports 2. Close the accounts that you know, or believe, have been tampered with or opened fraudulently 3. Demand several layers of security before establishing a new account 4. Report it to the Organization where your data was breached 5. File a report with your local police or the police in the community where the identity theft took place 6. File a complaint with the Federal Trade Commission 20

21 21

22 Tips To Remember Look at your physical environment Messy vs. clean desk Reports and files stored out of site Locking file cabinets and offices Passwords on post-it notes? USB drives easily available Flash Cards, CDs, and disk lying around in plan site Monitor location/desk direction Are visitors identified, challenged? Public access to business areas? Public Fax? Use Cross Cut Shredders 22

23 Tips To Remember Information Security Policy Do not store sensitive information on workstation or mobile device Written justification and approval for sensitive data storage Purge sensitive information as soon as its business need no longer exists Record retention schedules give useful life of each type of information Purge info-wipe, not delete Security File Deletion Utilities Cross cut shred, not store 23

24 IT Security Tips To Remember Secure wireless internet Anti-virus software that is up-to-date Personal firewall that offers both inbound and outbound permission-based monitoring Apply updates for all vendor software (Microsoft releases patches the second Tuesday of every month Do not access secure portals with sensitive information such as financial institution accounts even if the Web site starts with https Disable file and printer sharing 24

25 Tips To Remember Be aware of your environment If your office uses cubicles Play background music (white noise) Use fabric sound absorbing covers Authenticate Each Individual Don t use 2 Factor Authentication PIN/Passwords Assign PIN and after 2 nd authentication have student change one of their choosing KBA Authentication Knowledge Based Appropriate to secure most information Less intrusive 25

26 EXISTING LAWS THAT REGULATE STUDENT PRIVACY FERPA: Family Educational Rights and Privacy Act GLBA: Gramm-Leach-Bliley Privacy Act FACT-Red Flag Rules PCI ( We wont be covering this one today) 26

27 FERPA FERPA: Family Educational Rights and Privacy Act Statue: 20 U.S.C. 1232(g) Regulations: 34CFR Part 99 The intent of the Act is to protect the rights of students and to insure the privacy and accuracy of education records Those protected by FERPA are students and former students who have been in attendance at the institution Rights belong to the student 27

28 Solution Have all students sign a release of information form and identify which parties are privy to their information 28

29 GLBA GLBA: Gramm-Leach Bliley Act signed into law November Regulation: Privacy regulations issued by federal agencies (Compliance required as of 7/1/01) FTC PART 314-Standards for Safeguarding Customer Information (Effective 5/23/03) Scope: Regulates the sharing of: Nonpublic personal information about individuals who obtain financial products or services From financial institutions primarily for personal, family or household purposes 29

30 GLBA-Implementing the Safeguards Rule The Gramm Leach Bliley Act - Requires financial institutions to ensure the security and confidentiality of customer personal information. The Federal Trade Commission (FTC) implemented GLBA by issuing the Privacy Rule and the Safeguards Rule. Colleges and Universities are considered financial institutions primarily due to student loan making activities. 30

31 Solutions Design and implement a written security plan Select a group or committee to implement program Identify all foreseeable risks Training/Human Resources/Management Information Systems System Failures/Intrusions-Disaster Plans Put together a written program to control these risks Oversee service providers to make sure they are capable of maintaining appropriate safeguards and require by contract to implement and maintain such safeguards Evaluate program each year as environment changes 31

32 RED FLAG RULES Red Flag Requirements For Financial Institutions Require financial institutions to develop and implement written identity theft prevention programs as part of the Fair and Accurate Credit Transactions Act of 2003 Under the Rule, each institution must develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft in connection with new or existing accounts Effective date was January 1, 2008 The FTC had delayed enforcement of the rule five times, most recently until December 31,

33 Three Identity Theft Rules Under 16 CFR Part 681 Rule # Duties of users of consumer reports regarding address discrepancies. This rule applies to users of consumer reports that are subject to administrative enforcement of FCRA. If you use consumer reports to extend credit, for skip tracing purposes, to report accounts or if your third party reports on your behalf then you would need to comply. If you or your third party servicer does not use consumer reports than you do not need to comply. 33

34 Rule #2 Three Identity Theft Rules Under 16 CFR Part Duties regarding the detection, prevention, and mitigation of identity theft-aka Red Flag Rules/Identity Theft Prevention Program. This applies to financial institutions and creditors that are subject to administrative duties. This would apply to all of us who extend credit in any means, i.e.: student loans, payment plans. All of us need to comply unless you are strictly cash and carry. 34

35 Rule #3 Three Identity Theft Rules Under 16 CFR Part Duties of card issuers regarding changes of address. This rule applies only to those who issue a debit or credit card. So unless you have a debit card/credit cards attached to the student IDs or purchasing cards then most schools would not have to comply. 35

36 RED FLAG RULES The program must provide for the identification, detection, and response to patterns, practices, or specific activities - known as red flags - that could indicate identity theft Under these new rules, institutions must develop a written program that identifies and detects the relevant warning signs (red flags) or identity theft Examples of these Warning Signs: Unusual account activity Fraud Alerts from Consumer Reporting Agencies Attempted use of suspicious account application documents Notice of ID Theft from the student It must also describe appropriate responses that would prevent and mitigate the crime and detail a plan to update the program Program must be managed by senior employees, include appropriate staff training, and provide for oversight of any service providers 36

37 Elements on How to Comply With Red Flag Requirements 4 Elements: 1. Identity patterns, practices or activities that indicate the possible existence of identity theft (red flags) 2. Detect Red Flags 3. Respond to detected Red Flags to prevent and mitigate identity theft 4. Update the Program periodically to reflect changes in risks to customers and the institution This initial plan needs to be approved by the institutions Board of Directors or Committee. 37

38 HOW TO IDENTIFY THESE RED FLAGS The FTC has identified 26 possible red flags 5 Categories Alerts, notifications, or warnings from a consumer reporting agency Suspicious documents Suspicious personally identifying information, such as suspicious address Unusual use of or suspicious activity relating to a covered account Notices from customers, victims of identity theft, law enforcement authorities, or other businesses about identity theft in connection with covered accounts 38

39 Solutions Verify Identity Authenticate Customers Monitor Transactions Verify Validity of Address Change 39

40 Respond Appropriately Monitor Accounts Contact Customer Change Passwords Close and Reopen Accounts Refuse to Open Accounts Don t Bill or Collect on the Account Notify Law Enforcement 40

41 Don t panic! Don t recreate the wheel So Now What? Evaluate your existing security plans (GLBA) and (Red Flags) If you have not developed one, incorporate these rules into your existing security plan The FTC says in Appendix J to Part 681, that you may incorporate as appropriate, existing policies, procedures and other arrangements that control reasonably foreseeable risks to customers or to the safety and soundness of the financial institutions or creditor from identity theft. Have your service providers incorporate these rules into your contracts and their existing plans Whether this law is relevant to Higher Education or not it is imperative to know how to prevent or mitigate identity theft Human Resources - Training is essential in any successful program Be proactive and have a plan to prevent future liability 41

42 Resources For Victims Free Credit Report To Report Identity Theft Identity Theft Resource Center (ITRC) US Department of Education Office of the Inspector General-Resource on Identity Theft U.S. Studentshttp://www2.ed.gov/about/offices/list/oig/misused/index.html 42

43 CREDIT BUREAU CONTACT INFORMATION Equifax Experian TransUnion

44 Resources For Implementation GLBA FERPA RED FLAG RULES 44