Identity Theft Industry Awareness & Prevention Presented by: Julia A. Langston J.D. Director, Regulatory & Legal Affairs An industry training module of.

Identity Identity TheftTheft

Industry Awareness & PreventionIndustry Awareness & Prevention

Presented by:Julia A. Langston J.D.

Director, Regulatory & Legal Affairs

An industry training module of First Advantage-SafeRent Inc. 2005An industry training module of First Advantage-SafeRent Inc. 2005

OverviewOverview Define Identity TheftDefine Identity Theft Identify Risks and ExposureIdentify Risks and Exposure Prudent PracticesPrudent Practices Business ObligationsBusiness Obligations Laws Combating Identity Laws Combating Identity

TheftTheft Review and ResourcesReview and Resources

Section ISection IUnderstanding Identity TheftUnderstanding Identity Theft

Identity Theft IQ TestIdentity Theft IQ Test Understanding Identity Understanding Identity

TheftTheft Impacts and RepercussionsImpacts and Repercussions

Identity Theft Identity Theft I.Q.I.Q.

Please take 5 minutes to take thePlease take 5 minutes to take the

Property Managers I.D. Theft I.Q. Property Managers I.D. Theft I.Q. TestTest

included with your supplemental included with your supplemental materials. materials.

Identity TheftIdentity Theft : : Compromising an individual’s, an entity’s, orCompromising an individual’s, an entity’s, or

an organization’s personal or operational information, with thean organization’s personal or operational information, with the

intention of using that information or data to commit fraud, intention of using that information or data to commit fraud,

theft or gain access to additional information, such as, but not theft or gain access to additional information, such as, but not

limited to, an entity’s or organization’s resources or their limited to, an entity’s or organization’s resources or their

operational activities that can be used to further the scope and operational activities that can be used to further the scope and

breadth of the identity theft related crime.breadth of the identity theft related crime.

Discussion: Discussion: Understanding Identity TheftUnderstanding Identity Theft Identity theft as it relates to consumers.Identity theft as it relates to consumers. Identity theft as it relates to property Identity theft as it relates to property

management companies and the multi-management companies and the multi-family housing industry as a whole. family housing industry as a whole.

The evolution of identity theft today.The evolution of identity theft today.

ConsiderationsConsiderations

Identity thieves aren’t always easy to Identity thieves aren’t always easy to detect or easily identified. detect or easily identified.

Why? Why?

Means and methods employed by Means and methods employed by identity thieves are not always easy identity thieves are not always easy to recognize.to recognize. Why? Why?

Profiling the Profiling the Identity Identity

ThiefThief Key characteristics to keep in mindKey characteristics to keep in mind

Information gaps, inconsistencies Information gaps, inconsistencies and other tell tale signs and other tell tale signs

Ploys, plots and dupes used by many Ploys, plots and dupes used by many thievesthieves

Never be overly confident and always be on Never be overly confident and always be on guard!guard!

Impacts & Impacts & RepercussionsRepercussions

How the Industry as a How the Industry as a whole is impacted.whole is impacted.

How your business may How your business may be impacted.be impacted.

Examples of recent Examples of recent events. events.

Other considerations.Other considerations.

Section IISection IIIdentifying Risks & Identifying Risks &

ExposureExposure

Identifying RiskIdentifying Risk ExamplesExamples Implications of Implications of

ExposureExposure

Identifying RiskIdentifying Risk Where are vulnerabilities today? Where are vulnerabilities today?

Addressing both internal and Addressing both internal and external risks.external risks.

Potential exposure you may not Potential exposure you may not have considered or even have considered or even identified.identified.

The never ending process and The never ending process and task of identifying risk. task of identifying risk.

Industry Related Industry Related ExamplesExamples

Data SafeguardsData Safeguards Physical and electronic securityPhysical and electronic security Handling of identity theft Handling of identity theft

allegationsallegations End user verificationEnd user verification Disposal protocolsDisposal protocols Handling Fraud and Active Duty Handling Fraud and Active Duty

AlertsAlerts Increased user & furnisher duties Increased user & furnisher duties

and obligationsand obligations Document auditsDocument audits FTC regulations that require FTC regulations that require

increased accountabilityincreased accountability

When the consumer When the consumer comes to you:comes to you:

FTC rule obligates businesses to FTC rule obligates businesses to provideprovide

transaction information where an ID transaction information where an ID theft theft

victim can point to evidence ofvictim can point to evidence ofunauthorized transaction about them.unauthorized transaction about them.

Safeguarding PracticesSafeguarding PracticesFTC rule requires “reasonable” measures to secure FTC rule requires “reasonable” measures to secure

andand

dispose of consumer information: dispose of consumer information:

a)a) Physical access safeguards – lock and key; Physical access safeguards – lock and key; shredding and properly disposing of sensitive shredding and properly disposing of sensitive documents. documents.

b)b) Electronic access safeguards – limiting Electronic access safeguards – limiting password access; utilizing data encryption; password access; utilizing data encryption; rendering retired storage media unreadable.rendering retired storage media unreadable.

d)d) Internal security – comprehensive pre-Internal security – comprehensive pre-employment screening, limit in office visibility employment screening, limit in office visibility of consumer information.of consumer information.

Safeguarding Practices Safeguarding Practices (cont.)(cont.)

Business agreements typically require certain assurances about Business agreements typically require certain assurances about passwords and security of systems used to obtain data.passwords and security of systems used to obtain data.

Apartment firms can potentially be liable for unauthorized Apartment firms can potentially be liable for unauthorized employee activity.employee activity.

Change passwords frequently and use non-dictionary words. Change passwords frequently and use non-dictionary words. The most effective passwords do not contain the login or user The most effective passwords do not contain the login or user id; are eight or more characters in length; and utilize upper and id; are eight or more characters in length; and utilize upper and lower case letters, special characters, and numbers. lower case letters, special characters, and numbers.

End users are responsible for keeping their log on information End users are responsible for keeping their log on information secure. Unauthorized use of a resident screening account secure. Unauthorized use of a resident screening account should be immediately reported to the service provider.should be immediately reported to the service provider.

Safeguarding Practices (cont.)Safeguarding Practices (cont.) Virus protection software should be updated frequently. Virus protection software should be updated frequently.

Apply software security patches and updates on a regular Apply software security patches and updates on a regular basis.basis.

Do not download files from strangers or click on hyperlinks Do not download files from strangers or click on hyperlinks from people you don’t know.from people you don’t know.

Use a firewall, especially if have you a high-speed or “always Use a firewall, especially if have you a high-speed or “always on” connection to the Internet.on” connection to the Internet.

Users should understand the proper use and application of Users should understand the proper use and application of Secure Sockets Layer (SSL) encryption. Sensitive information Secure Sockets Layer (SSL) encryption. Sensitive information such as credit card and social security numbers should be such as credit card and social security numbers should be secured with SSL when traversing a public network such as secured with SSL when traversing a public network such as the Internet. The gold lock located at the bottom of the the Internet. The gold lock located at the bottom of the Internet browser window indicates an SSL secured session.Internet browser window indicates an SSL secured session.

MULTIFAMILY TIPMULTIFAMILY TIP::

Review record practices in light of Review record practices in light of new new

safeguarding rule, especially those safeguarding rule, especially those

records that are kept onsite, are records that are kept onsite, are activelyactively

accessed, or are part of a property accessed, or are part of a property or aor a

management company transfer.management company transfer.

Broader Screening Broader Screening RequirementsRequirements

Some multifamily investor agreements (institutional Some multifamily investor agreements (institutional capital) capital)

require screening against broader list of known and require screening against broader list of known and

suspected domestic and international law violators.suspected domestic and international law violators.

Department of CommerceDepartment of Commerce Department of StateDepartment of State FBI Most WantedFBI Most Wanted OthersOthers

Industry StrategiesIndustry Strategies

Strategies and products Strategies and products used by the industry to used by the industry to combat and prevent combat and prevent identity theft.identity theft.

Other resources available Other resources available to assist your organization to assist your organization in preventing loss or in preventing loss or injury. injury.

Implications & Implications & ExposureExposure

Civil lawsuits and consumer Civil lawsuits and consumer actionaction

Complaints and agency Complaints and agency scrutiny scrutiny

Media attentionMedia attention Criminal liabilityCriminal liability Loss of revenue & Loss of revenue &

depreciationdepreciation FinesFines

Section IIISection III

Finding SolutionsFinding Solutions Establishing Policy Establishing Policy Duties and Obligations Duties and Obligations

Prudent Practices & Industry Prudent Practices & Industry

ObligationsObligations

Finding Finding SolutionsSolutions

Establishing standards Establishing standards Implementing new Implementing new

policies and procedurespolicies and procedures Staff trainingStaff training Keeping currentKeeping current Quality AssuranceQuality Assurance ConsequencesConsequences

Establishing Establishing PolicyPolicy

Consider the target of your policy. Consider the target of your policy.

Prepare separate policies that Prepare separate policies that address address

the identified risks both internally the identified risks both internally andand

externally to both prevent and to externally to both prevent and to

combat identity theft. combat identity theft.

Duties & Duties & ObligationsObligations

Safeguarding InformationSafeguarding Information Disposing of InformationDisposing of Information Document RetentionDocument Retention Physical and Virtual SecurityPhysical and Virtual Security Verification of IdentitiesVerification of Identities

Federal laws and regulationsFederal laws and regulations State laws State laws Watch for pending legislation Watch for pending legislation

that can impact the industrythat can impact the industry Other useful resourcesOther useful resources

Know the LawsKnow the Laws Section IVSection IV

DID YOU KNOW…DID YOU KNOW…

That identity theft and fraud has become a That identity theft and fraud has become a national problem in a few short years. The national problem in a few short years. The FTC’s recent estimate is close to FTC’s recent estimate is close to 50 50 billion dollarsbillion dollars in damages annually.in damages annually.

Federal LawsFederal Laws Consumer resourcesConsumer resources

Obligations you have Obligations you have as as

a property managera property manager

Industry ResourcesIndustry Resources

TERRORISM: EO TERRORISM: EO 1322413224

Presidential Executive Order Presidential Executive Order 13224 (2001) prohibits or 13224 (2001) prohibits or “blocks” leases with “blocks” leases with Specially Designated Specially Designated Nationals.Nationals.

OFAC list of SDNs regularly OFAC list of SDNs regularly updated, integrated with updated, integrated with commercial screening commercial screening services.services.

USA PATRIOT ACTUSA PATRIOT ACT

USA PATRIOT ActUSA PATRIOT Act requires authentication requires authentication by real estate closing by real estate closing professionals… professionals…

Includes leasing agents Includes leasing agents (?)(?)

Rule to comeRule to come

When the consumer When the consumer comes to you:comes to you:

FTC ID Theft AffidavitFTC ID Theft AffidavitThe FTC has developed a report that will enable a The FTC has developed a report that will enable a

consumer consumer to send information on the use of stolen ID using just oneto send information on the use of stolen ID using just onestandard form. It is to be used where a new account wasstandard form. It is to be used where a new account wasopened in the victim's name. They make it clear that if opened in the victim's name. They make it clear that if someone made unauthorized charges to an existing someone made unauthorized charges to an existing

account, account, the consumer should call the bank or company to find out the consumer should call the bank or company to find out what to do. The form can be located at:what to do. The form can be located at:

www.consumer.gov/idtheftwww.consumer.gov/idtheft or call (877) 438-4338.or call (877) 438-4338.

MULTIFAMILY TIPMULTIFAMILY TIP::

Property managers may want to consult Property managers may want to consult with counsel when an identity theftwith counsel when an identity theftvictim can point to evidence of an victim can point to evidence of an unauthorized transaction about them unauthorized transaction about them and where the property management and where the property management company can provide such information and company can provide such information and has further determined that the consumers’has further determined that the consumers’request is not frivolous.request is not frivolous.

MULTIFAMILY TIPMULTIFAMILY TIP::

Because accuracy obligations have been placed on Because accuracy obligations have been placed on

furnishers have been enhanced under the Fair and furnishers have been enhanced under the Fair and

Accurate Credit Transactions Act. Accurate Credit Transactions Act.

Property managers who furnish any landlord/tenant Property managers who furnish any landlord/tenant

information to outside reporting agencies must make information to outside reporting agencies must make

sure the information provided is accurate and up to sure the information provided is accurate and up to

date. date.

State LawsState Laws

Ohio Identity Theft Laws. (Identity Ohio Identity Theft Laws. (Identity Theft Passport Program) Theft Passport Program)

New York Identity Theft Legislation.New York Identity Theft Legislation. California Identity Theft Laws. California Identity Theft Laws.

File Freezing File Freezing LawsLaws

Consumers opt to authorize Consumers opt to authorize release release

of their files with either a phone of their files with either a phone

call or a pre-set PIN before acall or a pre-set PIN before a

report may be released. report may be released.

CA, LA, TX have it. Many more CA, LA, TX have it. Many more

legislatures want it in 2005. legislatures want it in 2005.

Passed Passed a law to make it a crime to intentionally use another a law to make it a crime to intentionally use another person’s person’s

identifying information to fraudulently obtain credit, property or identifying information to fraudulently obtain credit, property or

services. services.

Then Then launchedlaunched an an Identity Theft Verification Passport Program Identity Theft Verification Passport Program to to

assist victims to identify fraudulent transactions, rehabilitate orassist victims to identify fraudulent transactions, rehabilitate or

restore their credit and good name. restore their credit and good name.

EstablishedEstablished a secure web site for law enforcement across Ohio to a secure web site for law enforcement across Ohio to

share identity theft related information. share identity theft related information.

Identity Theft Identity Theft Prevention in Prevention in

OhioOhio

Ohio Identity Theft Ohio Identity Theft PassportPassport

Pending LegislationPending Legislation

Limited use of SSN for identification in Limited use of SSN for identification in source data, especially criminal data. source data, especially criminal data. Increases the value of established criminal Increases the value of established criminal datahouses.datahouses.

In California: No L/T data available for 60 In California: No L/T data available for 60 days after case event (filing, dismissal, days after case event (filing, dismissal, etc.)etc.)

Section VSection V Module Review & Module Review &

ResourcesResources

Review of Topics DiscussedReview of Topics Discussed Questions and AnswersQuestions and Answers Available ResourcesAvailable Resources

RESOURCESRESOURCES National Multi Housing Council – National Multi Housing Council – www.nmhc.orgwww.nmhc.org

Apartment Associations – Apartment Associations – www.naahq.orgwww.naahq.org

Ohio’s Attorney General’s Office/Website - Ohio’s Attorney General’s Office/Website - http://www.ag.state.oh.ushttp://www.ag.state.oh.us

FTC Website – FTC Website – www.ftc.govwww.ftc.gov

FTC ID Theft Webpage -FTC ID Theft Webpage - www.consumer.gov/idtheftwww.consumer.gov/idtheft

U.S. Department of Housing and Urban U.S. Department of Housing and Urban Development Website – Development Website – www.hud.govwww.hud.gov

Free credit report – Free credit report – www.annualcreditreport.comwww.annualcreditreport.com

Real Estate Information Sharing and Analysis Real Estate Information Sharing and Analysis Center (ISAC) – Center (ISAC) – www.reisac.orgwww.reisac.org

Contact InformationContact Information

Julia A. LangstonJulia A. Langston

Director of Regulatory AffairsDirector of Regulatory Affairs

First Advantage-SafeRentFirst Advantage-SafeRent

[email protected]@fadvsaferent.com

301-881-3598 x1934301-881-3598 x1934