Identity Theft Prevention Program Policy

Authority: Business Affairs
Date Enacted or Revised: Enacted August 2016; Revised March 11, 2022

Purpose

McNeese State University, in response to the growing problem of identity theft, recognizes the need to safeguard personal and private information of all its constituents, including faculty, staff, students, vendors, and donors. Under the Federal Trade Commission’s (FTC) Red Flags Rule, which implements Section 114 of the Fair and Accurate Credit Transactions Act of 2003, the University is considered a financial institution, or creditor, holding “covered accounts.” As such, the University is required to establish an Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft in connection with conducting University business.

Definitions

  • Creditor: Any person or organization who regularly extends, renews, or continues credit; any person or organization who regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who participates in the decision to extend, renew, or continue credit. 
  • Covered Account: An account that a creditor offers or maintains, primarily for personal, family, or household purposes that involves or is designed to permit multiple payments or transactions. 
  • Red Flag: A pattern, practice or specific activity that indicates the possible existence of identity theft. 
  • Identifying Information: Any name or number that may be used, alone or in conjunction with any other information, to identify a specific person, including but not limited to: name, address, telephone number, social security number, date of birth, government issued driver’s license or identification number, alien registration number, government passport number, employer or taxpayer identification number, student identification number, computer’s internet protocol (IP) address, or routing code.

Policy

Under the FTC’s Red Flags Rule, the University is required to establish an Identity Theft Prevention Program tailored to its size, complexity, and the nature of its operation. The program must: 

  • Identify relevant red flags for new and existing covered accounts and incorporate those red flags into the program; 
  • Detect red flags that have been incorporated into the program;
  • Respond appropriately to any red flags that are detected to prevent and mitigate identity theft; and
  • Ensure the program is updated periodically to reflect changes in risks to students or to the safety and soundness of the student from identity theft. 

Covered Accounts

The following covered accounts are administered by the University or a service provider:

  1. Perkins loans
  2. Fee deferral payment plans
  3. Refunds of student account credit balances
  4. Bookstore PTA
  5. Emergency loans
  6. Delinquent student account balances

Identification of Relevant Red Flags

Suspicious Documents

  1. Identification document or card that appears to be forged, altered, or not authentic;
  2. Identification document or card on which a person’s photograph or physical description is not consistent with the person presenting the document;
  3. Other document with information that is not consistent with existing customer information (i.e., a person’s signature on a check appears forged); and
  4. Application for service that appears to have been altered or forged. 

Suspicious Personal Identifying Information

  1. Identifying information presented that is inconsistent with other information the customer provides (i.e., inconsistent birth dates);
  2. Identifying information presented that is inconsistent with other sources of information (i.e., an address not matching an address on a credit report);
  3. Identifying information presented that is the same as information shown on other applications that were found to be fraudulent;
  4. Identifying information presented that is consistent with fraudulent activity (i.e., an invalid phone number or fictitious billing address);
  5. Social security number presented that is the same as one provided by another customer;
  6. Address or phone number presented that is the same as that of another person;
  7. A person fails to provide complete personal identifying information on an application when reminded to do so (unless, by law, social security numbers must not be required); and
  8. A person’s identifying information is not consistent with the information that is on file for the customer. 

Suspicious Account Activity or Unusual Use of Account

  1. Change of address for an account followed by a request to change the account holder’s name;
  2. Payments stop on an otherwise consistently up-to-date account;
  3. Account used in a way that is not consistent with prior use (i.e., very high activity);
  4. Mail sent to the account holder is repeatedly returned as undeliverable;
  5. Notice to the University that a customer is not receiving mail sent by the University;
  6. Notice to the University that an account has unauthorized activity;
  7. Breach in the University’s computer system security; and
  8. Unauthorized access to or use of customer account information. 

Alerts from Others

  1. Notice to the University from a customer, identity theft victim, law enforcement or other person that it has opened or is maintaining a fraudulent account for a person engaged in identity theft;
  2. Report of fraud accompanying a credit report;
  3. Notice or report from a credit agency of a credit freeze on a customer or applicant;
  4. Notice or report from a credit agency of an active-duty alert for an applicant; and
  5. Indication from a credit report of activity that is inconsistent with a customer’s usual pattern or activity. 

Responding to Detected Red Flags

Should a potentially fraudulent activity be detected, an employee should promptly inform his/her supervisor and department head/dean as soon as possible that a potential red flag has been detected. The department head/dean should conduct any necessary inquiry to determine the validity of the red flag. If it is determined that a situation of identity theft has occurred, the department head/dean should immediately inform the vice president for business affairs.

Appropriate actions to mitigate the effects of the transaction should be taken immediately and will be dependent on the type of red flag identified, type of transaction, relationship with the victim of the fraud, availability of contact information for the victim of the fraud, and numerous other factors. Appropriate actions may include, but are not limited to:

  1. Monitoring a covered account for evidence of identity theft.
  2. Contacting the customer.
  3. Changing any passwords, security codes, or other security devices that permit access to a covered account.
  4. Reopening a covered account with a new account number.
  5. Not opening a new covered account.
  6. Closing an existing covered account.
  7. Notifying law enforcement.
  8. Determining no response is warranted under the particular circumstances.

In all situations where it is determined that a red flag has been positively identified, the department head/dean shall document the discovery of the red flag, the inquiry of the red flag, and any specific actions taken to mitigate an actual identity theft discovered. This information should be forwarded to the vice president for business affairs for review and documentation of the event.

Internal Steps

The University will take the following steps from its internal operating procedures to prevent the likelihood of identity theft occurring with respect to covered accounts:

  1. Ensure that its website is secure or provide clear notice that the website is not secure;
  2. Ensure complete and secure destruction of paper documents and computer files containing student account information when a decision has been made to no longer maintain such information;
  3. Ensure that office computers with access to covered account information are password protected;
  4. Limit the use of social security numbers to activities for which they are required;
  5. Ensure computer virus protection is up to date; and
  6. Require and retain only student and employee information necessary for University purposes. 

Use of Service Providers

In the event the University engages a service provider to perform an activity in connection with one or more covered accounts, the University will take the following steps to ensure the service provider performs its activity in accordance with reasonable policies and procedures designed to detect, prevent and mitigate the risk of identity theft.

  1. Require that service providers have such policies and procedures in place; and
  2. Require that service providers review the program and report any red flags to the vice president for business affairs or the University employee with primary oversight of the service provider relationship.

Oversight of the Program

Responsibility for the development, implementation, and revision of the program lies with the vice president for business affairs. Specific activities that may be performed include, but are not limited to:

  1. Ensuring the appropriate training of University staff;
  2. Oversight of service provider arrangements to ensure the service provider has reasonable policies and procedures in place concerning red flags;
  3. Reviewing and documenting any reports regarding the detection of red flags from department heads and deans; and
  4. Considering periodic changes to the program.

Non-Disclosure of Specific Practices

For the effectiveness of this program, knowledge about specific red flag identification, detection, mitigation, and prevention practices may need to be limited. The vice president for business affairs shall disseminate the necessary information to employees with a need to know. Any documentation regarding the development or implementation of this program that lists or describes specific practices or contains confidential information should not be shared with other University employees or the public. All documents and specific practices related to the program should be maintained in a confidential manner.

Communication

This policy is distributed via the Academic Advisory Council, the Administrative Advisory Council, and the University Policies webpage.