Identity Theft Prevention Program Training Red Flags Rule Identity Theft Prevention Program Training Developed in part based on materials published or provided by the Federal Trade Commission (FTC) and National Association of College and University Business Officers (NACUBO)

Purpose Establish processes that: Identify Red Flags for new and existing Covered Accounts Detect Red Flags Respond appropriately to any Red Flags to prevent and mitigate Identity Theft Ensure the program is updated periodically

Definitions “Identity Theft” is a “fraud committed or attempted using the identifying information of another person without authority.” A “Red Flag” is a “pattern, practice, or specific activity that indicates the possible existence of Identity Theft.” A “Covered Account” is any consumer account used for personal purposes that involves multiple payments transactions or one offered or maintained that has a reasonable risk of identity theft as determined by the University.

Definitions (cont.) “Program Administrator” is the individual designated with primary responsibility for oversight of the program. This is the Vice President for Finance and Administration. “Identifying information” is any name or number that may be used, alone or in conjunction with any other information, to identify a specific person, including name, address, telephone number, social security number, date of birth, government issued driver’s license or identification number, alien registration number, government passport number, employer or taxpayer identification number, student identification number (UCA ID), computer’s Internet Protocol (IP) address, or routing code.

Red Flag Identification Notifications and Warnings from Credit Reporting Agencies (Experian, Equifax, TransUnion) Suspicious Documents Suspicious Personal Identifying Information Suspicious Covered Account Activity or Unusual Use of Account Alerts from Others

Red Flag Identification Examples A student requests information from Student Accounts and provides an ID that does not resemble the student. Financial Aid mails correspondence to the student’s address on file and it is returned as undeliverable multiple times. A student notifies Student Accounts an expected financial aid refund was not received. Student Accounts notices the direct deposit information was recently changed.

Detecting Red Flags Areas of Concern and Action Student Enrollment Require identifying information and verify student’s identity Existing Accounts Verify identity & validity of requests for account changes Consumer (“Credit”) Report Requests Require written verification that the address provided is accurate at the time of a request

Preventing and Mitigating Identity Theft If a Red Flag is detected, take one of more of the following steps as necessary: Continue to monitor the account(s) Contact the student or applicant Change passwords or other security measures that permit access to Covered Accounts Do not open a new Covered Account Provide the student with a new ID number Notify the Program Administrator Notify Law Enforcement File or assist in filing a Suspicious Activities Report (“SAR”) Determine that no response is needed

Preventing and Mitigating Identity Theft To prevent the likelihood of Identity Theft, UCA will: Ensure that its website is secure and provide notice if it is not secure Ensure paper documents and computer files are discarded in accordance with UCA’s Document Retention Guidelines Ensure that office computers are password protected Avoid use of social security numbers when possible Ensure computer virus protection is up to date Require and keep only student information considered necessary

Non–disclosure of Specific Practices For the effectiveness of the Program: Knowledge about specific Red Flag identification, detection, mitigation, and prevention practices may be limited to the Program Administrator and those employees with a need to know them, and Any documents produced in order to develop or implement this Program are considered “confidential” and should not be shared with other UCA employees or the public unless required by the Arkansas Freedom of Information Act.

The Most Important Element of the Program: YOU! By detecting “Red Flags” associated with identity theft, you can do your part to help prevent it Remember to request and verify all required information Thank you for keeping our students’ information safe!

Sources Educause®; ID Theft Red Flags. https://library.educause.edu/topics/policy-and-law/id-theft-red-flags. Published September 23, 2008. Accessed April 23, 2018. Federal Trade Commission; Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business. https://www.ftc.gov/tips-advice/business-center/guidance/fighting-identity-theft-red-flags-rule-how-guide-business. Published May 2013. Accessed June 11, 2018. National Association of College and University Business Officers; FTC Red Flags Rule. https://www.nacubo.org/Topics/Other-Business-Areas/Privacy-Intellectual-Property/FTC-Red-Flags-Rule. Published November 28, 2011. Accessed May 31, 2018.