identity Theft - Every Loan Originator Needs to Know This

Transcription

1 Module 4 Module 4 Identity Theft

2 Explanation: This pdf is only a copy of the module slides. To proceed through the course, you must read and click through each slide.

3 Fighting Identity Theft What EVERY Loan Originator should know Identity Theft Presentation Overview The Identity Theft Problem The Impact of Identity Theft The Identity Theft Assumption and Deterrence Act The Fair and Accurate Credit Transactions Act (FACTA) RED Flags Rule and RED Flag Triggers

4 A short clip from the Federal Trade Commission

5 Access to Information Living in the Information Age Many areas of our society including Military, Law Enforcement, Financial and Healthcare REQUIRE immediate access to massive amounts of information. Safeguarding that information from getting into the wrong hands is a constant challenge. Prevention Detection Protection mitigation

6 Five types of Identity Theft Loan officers and Realtors be aware It is far more than bank accounts and credit card numbers, there are often serious legal complications! You likely know someone who has been the victim of Identity Theft

7 How does it happen? Here are some of the ways it happens ILLEGAL ONLINE AUCTION sites where millions of credit card numbers are bought and sold. Credit card numbers are bid on like it s ebay. In fact, full identities are bid on, often for less than $25. According to Shawn Henry, the FBI s top Cyber Expert Lost or Stolen Wallets; Stealing information during a Payment Transaction; Friendly Theft, or identity theft by fellow employees, friends, family members, or other people you know; Online Methods, like e mail phishing schemes; Data Breaches, or hacking into company systems to gain customer information; Mailbox Raiding and Dumpster Diving for your personal and financial information Shred all personal information Bills, bank statements, invoices or records of any kind can be used by an identity thief.

8 Identity Theft is Everywhere

9 Identity Theft is spiraling out of control Over 550 million American s Identities have been reported lost or stolen since Jan PrivacyRights.org Over 400,000 Dead People opened Bank accounts last year AARP The revenue from trafficking financial data has surpassed that of drug trafficking. Secret Service March 2007 Every Three seconds (30,000 times per day) someone becomes a victim of Identity Theft. USA TODAY Identity Theft has no respect to race, gender, creed, nationality, political affiliation, financial standing, or credit rating... According to the FBI, less than 1 in 700 Identity Thieves get caught!

10 Identity Theft is spiraling out of control Almost 60% of victims had NEW ACCOUNTS opened in their name* Close to 70% had warrants issued for their arrest* 82% found out through an adverse action* Out of pocket cost to the average victim $1,800 $5,000* Victims spent an average of 600 hours trying to clean up the mess.. (CNBC Report 2011) 63% could not get their credit reports cleared 22% have their SSN tied to someone else s 19% had their fraud alerts ignored

11 How we are Affected by Identity Theft? Identity Theft and the Legal Issues that often occur can be life changing events Identity Theft is a legal issue* According to the FTC, Identity Theft Victims can spend 600+ hours to restore their Identity and between $1200 $5000 in associated expenses* Employees suffering the effects of Identity Theft can cost employers over $600 per year* Harris Interactive Employees with problems often become problem employees. *As a loan officer or Realtor, becoming a victim of Identity Theft could effect your ability to earn a living.

12 Identity Theft is Everywhere, who can we trust? Often, those we routinely trust, violate that trust Government Employees Medical Personnel Legal Counsel University Administrators Bank Officers Loan Officers Realtors Postal Inspectors

13 Where Are We Now? Identity Theft is spiraling out of control. Which of the following is not true about Identity Theft? a. Over 550 million American s Identities have been reported lost or stolen since Jan PrivacyRights.org b. Over 400,000 Dead People opened Bank accounts last year AARP c. The revenue from trafficking financial data has surpassed that of drug trafficking. Secret Service March 2007 d. According to the FBI, most Identity Thieves get caught! Over 550 million American s Identities have been reported lost or stolen since Jan PrivacyRights.org Over 400,000 Dead People opened Bank accounts last year AARP The revenue from trafficking financial data has surpassed that of drug trafficking. Secret Service March 2007 Every Three seconds (30,000 times per day) someone becomes a victim of Identity Theft. USA TODAY Identity Theft has no respect to race, gender, creed, nationality, political affiliation, financial standing, or credit rating... According to the FBI, less than 1 in 700 Identity Thieves get caught!

14 Identity Theft is Everywhere, who can we trust? Download Story Here

15 Identity Theft is Everywhere, who can we trust? Download Story Here

16 Being Careless, What can Happen? Mortgage Broker who discarded consumers personal financial records in a publicly accessible dumpster paid a $35,000 civil penalty to settle FTC charges Information Security Laws mandate the destruction of information about your customers, employees, or patients. Download Story Here

17 WAGING WAR in the Fight IDENTITY THEFT The Identity Theft and Assumption Deterrence Act of U.S.C DEFINITION OF IDENTITY THEFT Knowingly transfer or use, without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable State or local law.

18 WAGING WAR in the Fight IDENTITY THEFT The Identity Theft and Assumption Deterrence Act of U.S.C Act addresses the problem of Identity Theft by focusing on consumers as victims S. Rep. No , at 4 (1998). Penalties for Violations Violators are generally subject to a fine and/or imprisonment of up to 15 years. 1028(b)(1)(D).

19 What Loan Originators Must Know about FACTA The Fair and Accurate Credit Transactions ACT The Fair and Accurate Credit Transactions Act (which is also sometimes known as FACTA or the FACT Act) was enacted by Congress in 2003 (although some parts of it did not go fully into effect until late 2004) as a part of an overall effort to better assist individual consumers who have been victims of identity theft and/or have inaccurate reporting on their personal credit reports. The law can be found at 15 USC 1681 et seq. The Act provides uniform national standards for the credit markets, and strong Consumer Protections. Intended to primarily help Consumers fight the growing crime of identity theft. The Fair and Accurate Credit Transaction Act of 2003 (FACTA) amends the federal Fair Credit Reporting Act (FCRA, 15 U.S.C et seq.)

20 TITLE I IDENTITY THEFT PREVENTION AND CREDIT HISTORY RESTORATION Fraud Alerts and Active Duty Alerts Establishes a nationwide system of fraud alerts for consumers to place on their credit files (FACTA 112,FCRA 605A(a)(1)). ONE Call Fraud Alert Call one reporting agency, that agency will notify the others Establishment of Procedures for the Identification of Possible Instances of Identity Theft

21 Fraud Alerts and Active Duty Alerts FACTA 112 FACTA creates a national system of fraud detection to make identity thieves more likely to be caught. Previously, victims would have to make phone calls to all of their credit card companies and three major credit rating agencies to alert them to the crime. Now, consumers will only need to make one call FACTA 112, FCRA 605A(a)) to receive advice, set off a nationwide fraud alert, and protect their credit standing. FACTA also establishes a nationwide system of fraud alerts for consumers to place on their credit files. FACTA allows the consumer to contact the credit reporting agency and flag their account (FACTA 112, FCRA 605A(a)(1)). These fraud alerts are placed on the report for 90 days (FACTA 112, FCRA 605A(a)(1)(A)), but may be extended. Credit reporting agencies that receive such alerts from customers will now be obliged to follow procedures to ensure that any future requests are by the true consumer, not an identity thief posing as the consumer. In most cases the creditor is required to contact the consumer at a telephone number authorized by the consumer (FACTA 112, FCRA 605A (h)(1)(b)(ii)). The law also will enable active duty military personnel to place special alerts on their files when they are deployed overseas (FACTA 112, FCRA 605A(c)(1)(2)(3).

22 Truncation of Credit Card and Debit Card Account Numbers FACTA 113 FACTA FACTA helps prevent identity theft before it occurs by requiring merchants to leave all but the last five digits of a credit card number off store receipts (FACTA 113(g)(1)). The credit card s expiration date must not be printed on any receipt (FACTA 113(g)(1)). FACTA will make sure that slips of paper that most people throw away do not contain their credit card number, a key to their financial identities. This provision is enforced with statutory damages ranging from $100 to $1000 per violation, and when claims are aggregated in a class action class (brought by all the customers of a retailer that failed to truncate credit card numbers) the amount of damages can be massive. The provision excludes receipts that are handwritten or imprinted, where the only method of recording the credit card number is by such means. The act did not become effective for three years after its enactment for any cash register manufactured before January 1, 2005 and did not become effective for one year after its enactment for any cash register manufactured after January 1, 2005.

23 TITLE I IDENTITY THEFT PREVENTION AND CREDIT HISTORY RESTORATION (Continued) 114 The RED FLAGS Rule Red Flag: means a pattern, practice, or specific activity that indicates the possible existence of identity theft. Look for Red Flags Red Flags Rule Joint Rule Making Red Flag provision, requires that the Federal Trade Commission and Federal Banking Agencies issue identity theft program guidelines and Regulations Final Rules Published November 9, 2007

24 TITLE I IDENTITY THEFT PREVENTION AND CREDIT HISTORY RESTORATION (Continued) Red Flags Rule (Continued) A financial institution is: A state or national bank A state or federal savings and loan association A mutual savings bank A state or federal credit union, or Any other person that directly or indirectly holds a transaction account belonging to a consumer Section l.90(b)(7) A covered account is: A consumer account designed to permit multiple payments or transactions, and any other account for which there is a reasonably foreseeable risk from identity theft Section l.90(b)(3)

25 TITLE I IDENTITY THEFT PREVENTION AND CREDIT HISTORY RESTORATION (Continued) Red Flags Rule (Continued) Must include policies and procedures to: Identify relevant red flags and incorporate them into the Program Detect red flags that are part of the Program Respond appropriately to any red flags that are detected Ensure the Program is updated periodically to address changing risks Section l.90(d)(1)

26 Red Flag Rule (continued) Under the Red Flags Rules, mortgage loan originators must develop a written program that identifies and detects the warning signs of identity theft. A Red Flag compliance program should address and detail company policies and procedures that protect against identity theft during the processing of a mortgage loan application. The program must also describe appropriate responses that would prevent and mitigate if a security breach occurs and detail a plan to update the program (FCRA ). The program must be managed by the Board of Directors or senior employees of the financial institution or creditor, include appropriate staff training, and provide for oversight of any service providers. Penalties for noncompliance The FTC can seek both monetary civil penalties and injunctive relief for violations of the Red Flags Rule. Where the complaint seeks civil penalties, the U.S. Department of Justice typically files the lawsuit in federal court, on behalf of the FTC. Currently, the law sets $3,500 as the maximum civil penalty per violation. Each instance in which the company has violated the Rule is a separate violation. Injunctive relief in cases like this often requires the parties being sued to comply with the law in the future, as well as provide reports, retain documents, and take other steps to ensure compliance with both the Rule and the court order. Failure to comply with the court order could subject the parties to further penalties and injunctive relief. Source: The Red Flags Rule: Frequently Asked Questions,

27 TITLE I IDENTITY THEFT PREVENTION AND CREDIT HISTORY RESTORATION (Continued) FACTA Identity Theft "Red Flags What Business Owners Must Know about FACTA FACTA Regulations provide the following 26 examples of activities that may indicate potential identity theft and raise a Red Flag. Source: Supplement A to Appendix J Appendix J to Part 334 Interagency Guidelines on Identity Theft Detection, Prevention, and Mitigation

28 TITLE I IDENTITY THEFT PREVENTION AND CREDIT HISTORY RESTORATION (Continued) FACTA Identity Theft "Red Flags FACTA Regulations provide the following 26 examples of activities that may indicate potential identity theft and raise a Red Flag. Alerts, Notifications or Warnings from a Consumer Reporting Agency 1. A fraud alert included with a consumer report. 2. Notice of a credit freeze in response to a request for a consumer report. 3. A consumer reporting agency providing a notice of address discrepancy. 4. Unusual credit activity, such as an increased number of accounts or inquiries. Source: Appendix J Section IIb and Supplement A to Appendix J.

29 Where Are We Now? The Identity Theft and Assumption Deterrence Act of 1998 (18 U.S.C. 1028) addresses the problem of Identity Theft by focusing on consumers as victims. Violators of the ACT are generally subject to a fine and/or imprisonment of up to: a. 15 years. b. 7 years c. 30 years d. 1 year This law criminalizes fraud as it relates to the unlawful theft and misuse of personal identifying information, regardless of whether the information appears or is used in documents, software, or computer files. Violators are generally subject to a fine and/or imprisonment of up to 15 years. The law also makes it a crime to aid anyone in the theft or fraudulent use of identifying information. The Act makes identity theft a Federal crime with penalties up to 15 years imprisonment and a maximum fine of $250,000.

30 TITLE I IDENTITY THEFT PREVENTION AND CREDIT HISTORY RESTORATION (Continued) FACTA Identity Theft "Red Flags FACTA Regulations provide the following 26 examples of activities that may indicate potential identity theft and raise a Red Flag. Presentation of suspicious documents 5. Documents provided for identification appearing altered or forged. 6. Photograph on ID inconsistent with appearance of customer. 7. Information on ID inconsistent with information provided by person opening account. 8. Information on ID, such as signature, inconsistent with information on file at financial institution. 9. Application appearing forged or altered or destroyed and reassembled. Source: Appendix J Section IIb and Supplement A to Appendix J.

31 TITLE I IDENTITY THEFT PREVENTION AND CREDIT HISTORY RESTORATION (Continued) FACTA Identity Theft "Red Flags FACTA Regulations provide the following 26 examples of activities that may indicate potential identity theft and raise a Red Flag. Presentation of suspicious documents 10. Information on ID not matching any address in the consumer report, Social Security number has not been issued or appears on the Social Security Administration's Death Master File, a file of information associated with Social Security numbers of those who are deceased. 11. Lack of correlation between Social Security number range and date of birth. Source: Appendix J Section IIb and Supplement A to Appendix J.

32 TITLE I IDENTITY THEFT PREVENTION AND CREDIT HISTORY RESTORATION (Continued) FACTA Identity Theft "Red Flags FACTA Regulations provide the following 26 examples of activities that may indicate potential identity theft and raise a Red Flag. 12. Personal identifying information associated with known fraud activity. 13. Suspicious addresses supplied, such as a mail drop or prison, or phone numbers associated with pagers or answering service. Source: Appendix J Section IIb and Supplement A to Appendix J.

33 Where Are We Now? FACTA allows the consumer to contact the credit reporting agency and flag their account. These fraud alerts are placed on the report for a. 90 days b. 30 days c. 6 months d. 1 year FACTA gives the consumer the right to contact a credit reporting agency to flag their account. To place a fraud alert, the consumer must provide proof of their identity to the credit bureau. The fraud alert is initially effective for 90 days, but may be extended at the consumer s request for seven years when they provide a police report to the credit bureaus that indicates they are a victim of identity theft.

34 TITLE I IDENTITY THEFT PREVENTION AND CREDIT HISTORY RESTORATION (Continued) FACTA Identity Theft "Red Flags FACTA Regulations provide the following 26 examples of activities that may indicate potential identity theft and raise a Red Flag. Suspicious activity relating to a covered account 14. Social Security number provided matching that submitted by another person opening an account or other customers. 15. An address or phone number matching that supplied by a large number of applicants. Source: Appendix J Section IIb and Supplement A to Appendix J.

35 TITLE I IDENTITY THEFT PREVENTION AND CREDIT HISTORY RESTORATION (Continued) FACTA Identity Theft "Red Flags FACTA Regulations provide the following 26 examples of activities that may indicate potential identity theft and raise a Red Flag. 16. The person opening the account unable to supply identifying information in response to notification that the application is incomplete. 17. Personal information inconsistent with information already on file at financial institution or creditor. 18. Person opening account or customer unable to correctly answer challenge questions. Source: Appendix J Section IIb and Supplement A to Appendix J.

36 TITLE I IDENTITY THEFT PREVENTION AND CREDIT HISTORY RESTORATION (Continued) FACTA Identity Theft "Red Flags FACTA Regulations provide the following 26 examples of activities that may indicate potential identity theft and raise a Red Flag. 19. Shortly after change of address, creditor receiving request for additional users of account. 20. Most of available credit used for cash advances, jewelry or electronics, plus customer fails to make first payment. 21. Drastic change in payment patterns, use of available credit or spending patterns. Source: Appendix J Section IIb and Supplement A to Appendix J.

37 TITLE I IDENTITY THEFT PREVENTION AND CREDIT HISTORY RESTORATION (Continued) FACTA Regulations provide the following 26 examples of activities that may indicate potential identity theft and raise a Red Flag. 22. An account that has been inactive for a lengthy time suddenly exhibiting unusual activity. 23. Mail sent to customer repeatedly returned as undeliverable despite ongoing transactions on active account. Financial institution or creditor notified of unauthorized charges or transactions on customer's account. Be on the look out for "Red Flags"

38 TITLE I IDENTITY THEFT PREVENTION AND CREDIT HISTORY RESTORATION (Continued) Any notices received from identify theft victims, law Enforcement authorities, or other parties containing information related to identity theft as to covered accounts. 24. Financial institution or creditor notified that customer is not receiving paper account statements. 25. Financial institution or creditor notified of unauthorized charges or transactions on customer's account. 26. Financial institution or creditor notified that it has opened a fraudulent account for a person engaged in identity theft. When does FACTA s Red Flag Rules take effect and what is the deadline for compliance? December 31, 2010 Source: Appendix J Section IIb and Supplement A to Appendix J.

39 FACTA noncompliance can mean severe fines and even class action lawsuits, including: Civil Liability actual damages sustained if identity is stolen as a result of corporate inaction or statutory damages up to $1,000 per employee. Class Action Lawsuits If large numbers of employees are affected, they may be able to bring classaction suits and get punitive damages from employers. [15 U.S.C. 1681n] Federal Fines up to $2,500 for each violation. [15 U.S.C. 1681n]

40 TITLE II IMPROVEMENTS IN USE OF AND CONSUMER ACCESS TO CREDIT INFORMATION Free Consumer Reports FACTA 211 Consumers have the right to obtain one free copy of their credit report from Experian, Trans Union, Equifax and CoreLogic credit bureaus every 12 Months. is the ONLY place you can get your annual credit report for free. One free report from EACH one annually. Each national credit bureau must provide, at no charge, a report within 15 days of a request (FACTA 211(C)(2)). Free reports are available through a dedicated web site, As 2012, all four reporting agencies will provide one free report each year.

41 TITLE II IMPROVEMENTS IN USE OF AND CONSUMER ACCESS TO CREDIT INFORMATION FALSE CLAIMS LEAD TO HEAVY FINES Download Story Here

42 TITLE II IMPROVEMENTS IN USE OF AND CONSUMER ACCESS TO CREDIT INFORMATION Disclosure of Credit Scores 212 Mortgage loan originators must provide credit scores, and information on key factors lowering a consumer s score to those who apply for mortgages (FACTA 212) As a mortgage loan originator, you must provide this*.

43 Where Are We Now? One FACTA identity theft related provision requires the "truncation" of account numbers on electronic credit and debit card receipts. Specifically, electronically printed credit and debit card receipts provided to consumers shall not include more than the: a. Last three digits of the card number or the expiration date. b. Last five digits of the card number only. c. Cardholder s full name. d. Last five digits of the card number or the expiration date. FACTA helps prevent identity theft before it occurs by requiring merchants to leave all but the last five digits of a credit card number off store receipts (FACTA 113(g)(1)). The credit card s expiration date must not be printed on any receipt (FACTA 113(g)(1)).

44 TITLE II IMPROVEMENTS IN USE OF AND CONSUMER ACCESS TO CREDIT INFORMATION Disposal of Consumer Reports 216 The disposal rule requires covered entities that maintain or possess consumer report information for a business purpose to take reasonable measures to protect against unauthorized access to or use of the In formation in connection with its disposal. Federal Register (69 FR 68690) Rule 30(b)(2)(i) You MUST Dispose of Documents Properly

45 TITLE II IMPROVEMENTS IN USE OF AND CONSUMER ACCESS TO CREDIT INFORMATION Reasonable Measures include but is NOT limited to: Burning, pulverizing or shredding of information Destruction or erasure of electronic media so that information cannot be read or reconstructed You MUST Dispose of Documents Properly Federal Register (69 FR 68690) Rule 30(b)(2)(i)

46 TITLE III ENHANCING THE ACCURACY of CONSUMER REPORT INFORMATION Reconciling Addresses 315 The Address Discrepancy Rule National CRAs are required to issue a notice of address discrepancy when an address provided by a user requesting a consumer report substantially differs from the address the CRA has on file for that consumer.

47 Identity Theft prevalent in the work place Fighting Fraud with the Red Flags Rule Active enforcement is now in place, regulators are increasingly taking action against violators. Taking steps now to protect your company, employees and customers will go a long way towards reducing any potential liabilities should a breach occur at your company.

48 What you MUST know about Identity Theft Federal and State Governments have enacted various laws including: FACTA Red Flag Rules Gramm, Leach Bliley 2006 False Claims Act Various state laws YOU may be held RESPONSIBLE! These laws now potentially make your company and even you as an employee/associate/ or Agent liable for losing information. Some of these violations include fines up to $1,000,000 and up to 10 years in jail.

49 Steps you MUST take against Identity Theft It is important for you to understand that these laws require companies to: Appoint an Information Security Officer in writing; either an officer of the company or senior level employee Develop a written plan and policy to protect the non public information of employees and customers Conduct regularly scheduled training for all employees and staff including employees at satellite offices and temporary help Oversee service provider arrangements the Red Flag Guidelines state that a financial institution or creditor is responsible for ensuring the service provider s compliance with the Red Flags Rules.

50 IMPORTANT, Employers are RESPONSIBLE A rise in identity theft is presenting employers with a major headache: They are being held liable for identity theft that occurs in the workplace. Douglas Hottle, Meyer, Unkovic & Scott, Workplace Identity Theft: How to Curb an HR Headache BLR: Business and Legal Reports, September 19, 2006 *(Identity Theft Resource Center 2007)

51 Implement a clean desk policy Identity Theft in the Workplace Pictures taken with cell phone camera after waiting several minutes for someone to respond.

52 Where Are We Now? FACTA makes it possible for every consumer to review a free report every year for unauthorized activity, including activity that might be the result of identity theft. Each national credit bureau must provide: a. A report free of charge within 15 days of the request. b. Access to a report for a fee. c. A report only if the consumer has been denied credit in the past 30 days. d. A report free of charge within 30 days of the request. Free Consumer Reports FACTA 211 This law makes it possible for every consumer to review a free report every year for unauthorized activity, including activity that might be the result of identity theft. Each national credit bureau must provide, at no charge, a report within 15 days of a request (FACTA 211(C)(2)). Reports are available though the web site, by telephone at (877) or by mail. To receive a credit report by mail go to, www. annualcreditreport.com/cra.requestformfinal.pdf

53 Implement a clean desk policy Identity Theft in the Workplace Cell phones and personal files are at risk Access to the computer, mail and other documents possible.

54 IDENTITY THEFT in the Work Place Think about your company s Red Flag Compliance Program. What does you companies Red Flag program look like? Do you receive training on a on going basis?

55 Special care MUST be taken at the work place In Summary Identity Theft Laws have become increasingly restrictive in recent years and are likely to continue to do so. *Security risks will continue to increase due to the massive volume of personal information that is collected, disclosed, and used on a daily basis in the United States. Important steps you can take right now include: *You MUST be aware of the increasing legal obligation arising from identity theft risks and establish reasonable information security practices to protect the personal information in your possession. Sources of Information include: Federal Trade Commission, Texas Attorney General, Privacy Rights Clearinghouse, Consumer Sentinel, WJS, USA Today, CNN, IDTI, PPL, ITAG, 60 Minutes, Human Resource Executive, Texas Business Today, Magtek, Inc., Jack Henry & Associates, Inc., msnbc.com

56 Module 4 End of Module 4 Identity Theft Proceed to the Module 4 quiz