2009 - 07-20-09 Regular Meeting - Laserfiche WebLink

Home Browse Search

BOOK 22 Pace 986 2. Existing Accounts. In order to detect any of the red flags identified above for an existing account, employees shall take the following steps to monitor transactions within an account: a. Verify the identification of customers if they request information (in person, via telephone, via facsimile, via email). b. Verify the validity of requests to change billing addresses. C. Verify changes in banking information given for billing and payment purposes. 3. Notice of Address Discrepancv. In order to detect any of the red flags identified regarding a Notice of Address Discrepancy, employees shall take the following steps: a. Compare information in the consumer report to information the user (1) maintains in its records; (2) obtains from third-party sources; and (3) obtains to comply with consumer information program rules. b. Verify information in the consumer report with the customer. c. Form a reasonable belief that the consumer report relates to the customer about whom it has requested the report, when the user receives a notice of address discrepancy. d. Notify the credit reporting agency that provided the Notice of Address Discrepancy of the County's findings (whether the person at issue is in fact the same person about whom the discrepancy notice was received.) (d) Step. 3. Responding to Red Flags - Preventing and Mitigating Theft. In the event personnel detect any identified Red Flags, such personnel shall take one of more of the following steps, depending on the degree of risk posed by the Red Flag` 1. Internal notification. Any County employee who becomes aware of a suspected or actual security breach must notify his or her immediate supervisor. The immediate supervisor will notify department management who is responsible for further investigation, notification, and remediation. 2. External notification. The County is required to notify affected individuals of actual security breaches. Each suspected breach will be reviewed by the department where the breach occurred and then, with the County Manager of his/her designee, determine appropriate action to include the following: a. Notify the affected individuals without unreasonable delay providing information in general terms about the incident, the type of sensitive information that was subject to the unauthorized access, the actions that the County will take to protect the information from further access. b. Notice to affected individuals may be provided by one or more of the following methods: i. Written notice. Identity Theft/Red Flag Rules Page 8