Identification Theft

Does your organization have a written identity theft prevention program in place? Such a program involves educating your customers and members about the importance of identification theft and letting the stakeholders in your business know that you share their concerns about this growing problem. By providing knowledge of how identification theft affects everyone and what your organization is doing to protect its members and customers, you help them understand the levels of security your institution provides.

According to the banking regulatory agencies that released "Identity Theft Red Flags" guidance at the end of October, leaders of financial institutions should expect to do more, not less, of this education in the next few years. With this in mind, how do you show your members and customers you also share their concerns and are doing all you can to address them?

A good place to start is by allowing your members and customers to choose how they receive information from your institution and by having a written privacy policy published on your website for anyone to see. By having choices available to your members and customers and publishing your privacy policy, you make your institution look proactive rather than reactive.

All institutions need to consider increased training in data protection responsibilities and should perform regular inspections to verify compliance with the training. Consideration should also be given to adding institution and customer data protection as an element of employee performance reviews.

Managers should be asked to assess their staff on compliance with these security policies. All email coming from an organization’s employees should re-emphasize the respective company’s anti-phishing and -spamming policies in a footer at the end of the email.

Make your protection of Customer data very clear. Customers who use your web site for their transactions want to know their data is safe. In a consumer survey, 88% of those who responded wanted to know if their data was secure, and 81% wanted to know if they could trust the site. The third most asked question was if the site has a good privacy policy.

Customers are looking for sites with security seals on them. These seals show that the site has been evaluated by an outside source and that it has passed inspection with proof of safety of their information. The seal also tells them you have a solid privacy policy, that your street address and phone numbers are readily available, and that your website has been checked for hacker safety. At your facility, you will want to show customers and members that their data is protected as a part of your normal everyday operations.

Some effective security precautions to prevent identity thefts in the office are:

• Place the paper shredders where customers can easily see them.
• Always store customer’s data out of view from others.
• Place privacy screens over all computer monitors, especially those in offices with windows.
• Never leave a computer screen unattended without first locking the screen with a password.
• Keep a tight check on sensitive customer data access, preferably on a "need-to-know" basis. All access to this type of data should be recorded with information such as who accessed the information and when they did so.
• Ensure that forms and applications do not ask for sensitive information that is not required.
• Be sure that access to all sensitive data is controlled and that you know where all sensitive material is stored within your facility.
• Ascertain that information about identity theft prevention is available through brochures, your company’s website and representatives of your institution at public speaking engagements.

(Look at the Federal Trade Commission’s website for a plethora of support materials, video, and brochures on Identity Theft prevention and reporting: www.FTC.gov).