identity theft industry awareness & prevention presented by: julia a. langston j.d. director,...
TRANSCRIPT
Identity Identity TheftTheft
Industry Awareness & PreventionIndustry Awareness & Prevention
Presented by:Julia A. Langston J.D.
Director, Regulatory & Legal Affairs
An industry training module of First Advantage-SafeRent Inc. 2005An industry training module of First Advantage-SafeRent Inc. 2005
OverviewOverview Define Identity TheftDefine Identity Theft Identify Risks and ExposureIdentify Risks and Exposure Prudent PracticesPrudent Practices Business ObligationsBusiness Obligations Laws Combating Identity Laws Combating Identity
TheftTheft Review and ResourcesReview and Resources
Section ISection IUnderstanding Identity TheftUnderstanding Identity Theft
Identity Theft IQ TestIdentity Theft IQ Test Understanding Identity Understanding Identity
TheftTheft Impacts and RepercussionsImpacts and Repercussions
Identity Theft Identity Theft I.Q.I.Q.
Please take 5 minutes to take thePlease take 5 minutes to take the
Property Managers I.D. Theft I.Q. Property Managers I.D. Theft I.Q. TestTest
included with your supplemental included with your supplemental materials. materials.
Identity TheftIdentity Theft : : Compromising an individual’s, an entity’s, orCompromising an individual’s, an entity’s, or
an organization’s personal or operational information, with thean organization’s personal or operational information, with the
intention of using that information or data to commit fraud, intention of using that information or data to commit fraud,
theft or gain access to additional information, such as, but not theft or gain access to additional information, such as, but not
limited to, an entity’s or organization’s resources or their limited to, an entity’s or organization’s resources or their
operational activities that can be used to further the scope and operational activities that can be used to further the scope and
breadth of the identity theft related crime.breadth of the identity theft related crime.
Discussion: Discussion: Understanding Identity TheftUnderstanding Identity Theft Identity theft as it relates to consumers.Identity theft as it relates to consumers. Identity theft as it relates to property Identity theft as it relates to property
management companies and the multi-management companies and the multi-family housing industry as a whole. family housing industry as a whole.
The evolution of identity theft today.The evolution of identity theft today.
ConsiderationsConsiderations
Identity thieves aren’t always easy to Identity thieves aren’t always easy to detect or easily identified. detect or easily identified.
Why? Why?
Means and methods employed by Means and methods employed by identity thieves are not always easy identity thieves are not always easy to recognize.to recognize. Why? Why?
Profiling the Profiling the Identity Identity
ThiefThief Key characteristics to keep in mindKey characteristics to keep in mind
Information gaps, inconsistencies Information gaps, inconsistencies and other tell tale signs and other tell tale signs
Ploys, plots and dupes used by many Ploys, plots and dupes used by many thievesthieves
Never be overly confident and always be on Never be overly confident and always be on guard!guard!
Impacts & Impacts & RepercussionsRepercussions
How the Industry as a How the Industry as a whole is impacted.whole is impacted.
How your business may How your business may be impacted.be impacted.
Examples of recent Examples of recent events. events.
Other considerations.Other considerations.
Section IISection IIIdentifying Risks & Identifying Risks &
ExposureExposure
Identifying RiskIdentifying Risk ExamplesExamples Implications of Implications of
ExposureExposure
Identifying RiskIdentifying Risk Where are vulnerabilities today? Where are vulnerabilities today?
Addressing both internal and Addressing both internal and external risks.external risks.
Potential exposure you may not Potential exposure you may not have considered or even have considered or even identified.identified.
The never ending process and The never ending process and task of identifying risk. task of identifying risk.
Industry Related Industry Related ExamplesExamples
Data SafeguardsData Safeguards Physical and electronic securityPhysical and electronic security Handling of identity theft Handling of identity theft
allegationsallegations End user verificationEnd user verification Disposal protocolsDisposal protocols Handling Fraud and Active Duty Handling Fraud and Active Duty
AlertsAlerts Increased user & furnisher duties Increased user & furnisher duties
and obligationsand obligations Document auditsDocument audits FTC regulations that require FTC regulations that require
increased accountabilityincreased accountability
When the consumer When the consumer comes to you:comes to you:
FTC rule obligates businesses to FTC rule obligates businesses to provideprovide
transaction information where an ID transaction information where an ID theft theft
victim can point to evidence ofvictim can point to evidence ofunauthorized transaction about them.unauthorized transaction about them.
Safeguarding PracticesSafeguarding PracticesFTC rule requires “reasonable” measures to secure FTC rule requires “reasonable” measures to secure
andand
dispose of consumer information: dispose of consumer information:
a)a) Physical access safeguards – lock and key; Physical access safeguards – lock and key; shredding and properly disposing of sensitive shredding and properly disposing of sensitive documents. documents.
b)b) Electronic access safeguards – limiting Electronic access safeguards – limiting password access; utilizing data encryption; password access; utilizing data encryption; rendering retired storage media unreadable.rendering retired storage media unreadable.
d)d) Internal security – comprehensive pre-Internal security – comprehensive pre-employment screening, limit in office visibility employment screening, limit in office visibility of consumer information.of consumer information.
Safeguarding Practices Safeguarding Practices (cont.)(cont.)
Business agreements typically require certain assurances about Business agreements typically require certain assurances about passwords and security of systems used to obtain data.passwords and security of systems used to obtain data.
Apartment firms can potentially be liable for unauthorized Apartment firms can potentially be liable for unauthorized employee activity.employee activity.
Change passwords frequently and use non-dictionary words. Change passwords frequently and use non-dictionary words. The most effective passwords do not contain the login or user The most effective passwords do not contain the login or user id; are eight or more characters in length; and utilize upper and id; are eight or more characters in length; and utilize upper and lower case letters, special characters, and numbers. lower case letters, special characters, and numbers.
End users are responsible for keeping their log on information End users are responsible for keeping their log on information secure. Unauthorized use of a resident screening account secure. Unauthorized use of a resident screening account should be immediately reported to the service provider.should be immediately reported to the service provider.
Safeguarding Practices (cont.)Safeguarding Practices (cont.) Virus protection software should be updated frequently. Virus protection software should be updated frequently.
Apply software security patches and updates on a regular Apply software security patches and updates on a regular basis.basis.
Do not download files from strangers or click on hyperlinks Do not download files from strangers or click on hyperlinks from people you don’t know.from people you don’t know.
Use a firewall, especially if have you a high-speed or “always Use a firewall, especially if have you a high-speed or “always on” connection to the Internet.on” connection to the Internet.
Users should understand the proper use and application of Users should understand the proper use and application of Secure Sockets Layer (SSL) encryption. Sensitive information Secure Sockets Layer (SSL) encryption. Sensitive information such as credit card and social security numbers should be such as credit card and social security numbers should be secured with SSL when traversing a public network such as secured with SSL when traversing a public network such as the Internet. The gold lock located at the bottom of the the Internet. The gold lock located at the bottom of the Internet browser window indicates an SSL secured session.Internet browser window indicates an SSL secured session.
MULTIFAMILY TIPMULTIFAMILY TIP::
Review record practices in light of Review record practices in light of new new
safeguarding rule, especially those safeguarding rule, especially those
records that are kept onsite, are records that are kept onsite, are activelyactively
accessed, or are part of a property accessed, or are part of a property or aor a
management company transfer.management company transfer.
Broader Screening Broader Screening RequirementsRequirements
Some multifamily investor agreements (institutional Some multifamily investor agreements (institutional capital) capital)
require screening against broader list of known and require screening against broader list of known and
suspected domestic and international law violators.suspected domestic and international law violators.
Department of CommerceDepartment of Commerce Department of StateDepartment of State FBI Most WantedFBI Most Wanted OthersOthers
Industry StrategiesIndustry Strategies
Strategies and products Strategies and products used by the industry to used by the industry to combat and prevent combat and prevent identity theft.identity theft.
Other resources available Other resources available to assist your organization to assist your organization in preventing loss or in preventing loss or injury. injury.
Implications & Implications & ExposureExposure
Civil lawsuits and consumer Civil lawsuits and consumer actionaction
Complaints and agency Complaints and agency scrutiny scrutiny
Media attentionMedia attention Criminal liabilityCriminal liability Loss of revenue & Loss of revenue &
depreciationdepreciation FinesFines
Section IIISection III
Finding SolutionsFinding Solutions Establishing Policy Establishing Policy Duties and Obligations Duties and Obligations
Prudent Practices & Industry Prudent Practices & Industry
ObligationsObligations
Finding Finding SolutionsSolutions
Establishing standards Establishing standards Implementing new Implementing new
policies and procedurespolicies and procedures Staff trainingStaff training Keeping currentKeeping current Quality AssuranceQuality Assurance ConsequencesConsequences
Establishing Establishing PolicyPolicy
Consider the target of your policy. Consider the target of your policy.
Prepare separate policies that Prepare separate policies that address address
the identified risks both internally the identified risks both internally andand
externally to both prevent and to externally to both prevent and to
combat identity theft. combat identity theft.
Duties & Duties & ObligationsObligations
Safeguarding InformationSafeguarding Information Disposing of InformationDisposing of Information Document RetentionDocument Retention Physical and Virtual SecurityPhysical and Virtual Security Verification of IdentitiesVerification of Identities
Federal laws and regulationsFederal laws and regulations State laws State laws Watch for pending legislation Watch for pending legislation
that can impact the industrythat can impact the industry Other useful resourcesOther useful resources
Know the LawsKnow the Laws Section IVSection IV
DID YOU KNOW…DID YOU KNOW…
That identity theft and fraud has become a That identity theft and fraud has become a national problem in a few short years. The national problem in a few short years. The FTC’s recent estimate is close to FTC’s recent estimate is close to 50 50 billion dollarsbillion dollars in damages annually.in damages annually.
Federal LawsFederal Laws Consumer resourcesConsumer resources
Obligations you have Obligations you have as as
a property managera property manager
Industry ResourcesIndustry Resources
TERRORISM: EO TERRORISM: EO 1322413224
Presidential Executive Order Presidential Executive Order 13224 (2001) prohibits or 13224 (2001) prohibits or “blocks” leases with “blocks” leases with Specially Designated Specially Designated Nationals.Nationals.
OFAC list of SDNs regularly OFAC list of SDNs regularly updated, integrated with updated, integrated with commercial screening commercial screening services.services.
USA PATRIOT ACTUSA PATRIOT ACT
USA PATRIOT ActUSA PATRIOT Act requires authentication requires authentication by real estate closing by real estate closing professionals… professionals…
Includes leasing agents Includes leasing agents (?)(?)
Rule to comeRule to come
When the consumer When the consumer comes to you:comes to you:
FTC ID Theft AffidavitFTC ID Theft AffidavitThe FTC has developed a report that will enable a The FTC has developed a report that will enable a
consumer consumer to send information on the use of stolen ID using just oneto send information on the use of stolen ID using just onestandard form. It is to be used where a new account wasstandard form. It is to be used where a new account wasopened in the victim's name. They make it clear that if opened in the victim's name. They make it clear that if someone made unauthorized charges to an existing someone made unauthorized charges to an existing
account, account, the consumer should call the bank or company to find out the consumer should call the bank or company to find out what to do. The form can be located at:what to do. The form can be located at:
www.consumer.gov/idtheftwww.consumer.gov/idtheft or call (877) 438-4338.or call (877) 438-4338.
MULTIFAMILY TIPMULTIFAMILY TIP::
Property managers may want to consult Property managers may want to consult with counsel when an identity theftwith counsel when an identity theftvictim can point to evidence of an victim can point to evidence of an unauthorized transaction about them unauthorized transaction about them and where the property management and where the property management company can provide such information and company can provide such information and has further determined that the consumers’has further determined that the consumers’request is not frivolous.request is not frivolous.
MULTIFAMILY TIPMULTIFAMILY TIP::
Because accuracy obligations have been placed on Because accuracy obligations have been placed on
furnishers have been enhanced under the Fair and furnishers have been enhanced under the Fair and
Accurate Credit Transactions Act. Accurate Credit Transactions Act.
Property managers who furnish any landlord/tenant Property managers who furnish any landlord/tenant
information to outside reporting agencies must make information to outside reporting agencies must make
sure the information provided is accurate and up to sure the information provided is accurate and up to
date. date.
State LawsState Laws
Ohio Identity Theft Laws. (Identity Ohio Identity Theft Laws. (Identity Theft Passport Program) Theft Passport Program)
New York Identity Theft Legislation.New York Identity Theft Legislation. California Identity Theft Laws. California Identity Theft Laws.
File Freezing File Freezing LawsLaws
Consumers opt to authorize Consumers opt to authorize release release
of their files with either a phone of their files with either a phone
call or a pre-set PIN before acall or a pre-set PIN before a
report may be released. report may be released.
CA, LA, TX have it. Many more CA, LA, TX have it. Many more
legislatures want it in 2005. legislatures want it in 2005.
Passed Passed a law to make it a crime to intentionally use another a law to make it a crime to intentionally use another person’s person’s
identifying information to fraudulently obtain credit, property or identifying information to fraudulently obtain credit, property or
services. services.
Then Then launchedlaunched an an Identity Theft Verification Passport Program Identity Theft Verification Passport Program to to
assist victims to identify fraudulent transactions, rehabilitate orassist victims to identify fraudulent transactions, rehabilitate or
restore their credit and good name. restore their credit and good name.
EstablishedEstablished a secure web site for law enforcement across Ohio to a secure web site for law enforcement across Ohio to
share identity theft related information. share identity theft related information.
Identity Theft Identity Theft Prevention in Prevention in
OhioOhio
Ohio Identity Theft Ohio Identity Theft PassportPassport
Pending LegislationPending Legislation
Limited use of SSN for identification in Limited use of SSN for identification in source data, especially criminal data. source data, especially criminal data. Increases the value of established criminal Increases the value of established criminal datahouses.datahouses.
In California: No L/T data available for 60 In California: No L/T data available for 60 days after case event (filing, dismissal, days after case event (filing, dismissal, etc.)etc.)
Section VSection V Module Review & Module Review &
ResourcesResources
Review of Topics DiscussedReview of Topics Discussed Questions and AnswersQuestions and Answers Available ResourcesAvailable Resources
RESOURCESRESOURCES National Multi Housing Council – National Multi Housing Council – www.nmhc.orgwww.nmhc.org
Apartment Associations – Apartment Associations – www.naahq.orgwww.naahq.org
Ohio’s Attorney General’s Office/Website - Ohio’s Attorney General’s Office/Website - http://www.ag.state.oh.ushttp://www.ag.state.oh.us
FTC Website – FTC Website – www.ftc.govwww.ftc.gov
FTC ID Theft Webpage -FTC ID Theft Webpage - www.consumer.gov/idtheftwww.consumer.gov/idtheft
U.S. Department of Housing and Urban U.S. Department of Housing and Urban Development Website – Development Website – www.hud.govwww.hud.gov
Free credit report – Free credit report – www.annualcreditreport.comwww.annualcreditreport.com
Real Estate Information Sharing and Analysis Real Estate Information Sharing and Analysis Center (ISAC) – Center (ISAC) – www.reisac.orgwww.reisac.org
Contact InformationContact Information
Julia A. LangstonJulia A. Langston
Director of Regulatory AffairsDirector of Regulatory Affairs
First Advantage-SafeRentFirst Advantage-SafeRent
[email protected]@fadvsaferent.com
301-881-3598 x1934301-881-3598 x1934