1. Identity Theft Prevention Program Training
Red Flags Rule
Identity Theft Prevention Program Training
Developed in part based on materials published or provided by the Federal Trade Commission (FTC) and National Association of College and University Business Officers (NACUBO)

2. Purpose Establish processes that:
Identify Red Flags for new and existing Covered Accounts
Detect Red Flags
Respond appropriately to any Red Flags to prevent and mitigate Identity Theft
Ensure the program is updated periodically

3. Definitions
“Identity Theft” is a “fraud committed or attempted using the identifying information of another person without authority.”
A “Red Flag” is a “pattern, practice, or specific activity that indicates the possible existence of Identity Theft.”
A “Covered Account” is any consumer account used for personal purposes that involves multiple payments transactions or one offered or maintained that has a reasonable risk of identity theft as determined by the University.

4. Definitions (cont.)
“Program Administrator” is the individual designated with primary responsibility for oversight of the program. This is the Vice President for Finance and Administration.
“Identifying information” is any name or number that may be used, alone or in conjunction with any other information, to identify a specific person, including name, address, telephone number, social security number, date of birth, government issued driver’s license or identification number, alien registration number, government passport number, employer or taxpayer identification number, student identification number (UCA ID), computer’s Internet Protocol (IP) address, or routing code.

5. Red Flag Identification
Notifications and Warnings from Credit Reporting Agencies (Experian, Equifax, TransUnion)
Suspicious Documents
Suspicious Personal Identifying Information
Suspicious Covered Account Activity or Unusual Use of Account
Alerts from Others

6. Red Flag Identification Examples
A student requests information from Student Accounts and provides an ID that does not resemble the student.
Financial Aid mails correspondence to the student’s address on file and it is returned as undeliverable multiple times.
A student notifies Student Accounts an expected financial aid refund was not received. Student Accounts notices the direct deposit information was recently changed.

7. Detecting Red Flags Areas of Concern and Action
Student Enrollment
Require identifying information and verify student’s identity
Existing Accounts
Verify identity & validity of requests for account changes
Consumer (“Credit”) Report Requests
Require written verification that the address provided is accurate at the time of a request

8. Preventing and Mitigating Identity Theft
If a Red Flag is detected, take one of more of the following steps as necessary:
Continue to monitor the account(s)
Contact the student or applicant
Change passwords or other security measures that permit access to Covered Accounts
Do not open a new Covered Account
Provide the student with a new ID number
Notify the Program Administrator
Notify Law Enforcement
File or assist in filing a Suspicious Activities Report (“SAR”)
Determine that no response is needed

9. Preventing and Mitigating Identity Theft
To prevent the likelihood of Identity Theft, UCA will:
Ensure that its website is secure and provide notice if it is not secure
Ensure paper documents and computer files are discarded in accordance with UCA’s Document Retention Guidelines
Ensure that office computers are password protected
Avoid use of social security numbers when possible
Ensure computer virus protection is up to date
Require and keep only student information considered necessary

10. Non–disclosure of Specific Practices
For the effectiveness of the Program:
Knowledge about specific Red Flag identification, detection, mitigation, and prevention practices may be limited to the Program Administrator and those employees with a need to know them, and
Any documents produced in order to develop or implement this Program are considered “confidential” and should not be shared with other UCA employees or the public unless required by the Arkansas Freedom of Information Act.

11. The Most Important Element of the Program: YOU!
By detecting “Red Flags” associated with identity theft, you can do your part to help prevent it
Remember to request and verify all required information
Thank you for keeping our students’ information safe!

12. Sources
Educause®; ID Theft Red Flags. Published September 23, Accessed April 23, 2018.
Federal Trade Commission; Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business. Published May Accessed June 11, 2018.
National Association of College and University Business Officers; FTC Red Flags Rule. Published November 28, Accessed May 31, 2018.