Policy Statement

Ramapo College takes the possibility of identity theft seriously and in full compliance with the Red Flag Rule* has developed and implemented an Identity Theft Prevention Program.

Reason for Policy

The purpose of the policy is to establish an Identity Theft Prevention Program designed to reasonably detect, prevent and mitigate identity theft in connection with the opening of a covered account or an existing covered account and to provide for continued administration of the Program. This Policy is in conformance with *The Financial Institution Regulators, including the Federal Trade Commission have issued a final rule (The Red Flag Rule) under Sections 114 and 315 of the Fair and Accurate credit Transactions Act of 2003

To Whom Does the Policy Apply

Bursar, Financial Aid, Human Resources, ITS

Related Documents

Procedure

Contacts

Vice President for Administration and Finance
(201) 684-7621

The Financial Institution Regulators, including the Federal Trade Commission have issued a final rule (the Red Flag Rule) under sections 114 and 315 of the Fair and Accurate Credit Transactions Act of 2003. The Red Flag Rule requires the institutions that hold “covered accounts” (accounts for which a person makes repeat payments) to develop and implement an identity theft prevention program for new and existing accounts.

Ramapo College takes the possibility of identity theft seriously and in full compliance with the Red Flag Rule, has developed and implemented an Identity Theft Program Prevention Program. After consideration of the size of the College’s operations and account systems, and the nature and scope of the College’s activities, the Board of Trustees determined that this Program was appropriate for Ramapo College, and therefore approved this Program on February 23, 2009.

Definitions

Identify theft means fraud committed or attempted using the identifying information of another person without authority.

Covered Account means an account that a creditor offers or maintains, primarily for personal, family, or household purposes that involves or is designed to permit multiple payments or transactions. These accounts include all student accounts or loans that are administered by the College.

Red Flag means a pattern, practice or specific activity that indicates the possible existence of identity theft.

Program Administrator is the group or individual designated with the primary responsibility for oversight of the program.

Identifying Information means any name or number that may be used in conjunction with any other information to identify a specific person including: name, address, telephone number, social security number, date of birth, driver’s license or identification number, alien registration number, passport number, employer or taxpayer identification number, student identification number, Internet Protocol address or routing code.

Purpose

The purpose of this policy is to establish an Identity Theft Prevention Program designed to reasonably detect, prevent and mitigate identity theft in connection with the opening of a covered account or an existing covered account and to provide for continued administration of the Program. The Program shall include reasonable policies and procedures to:

1. Identify relevant Red Flags for new and existing covered accounts it offers or maintains and incorporate those Red Flags into the program;
2. Detect red flags that have been incorporated into the Program;
3. Respond appropriately to any red flags that are detected to prevent and mitigate identity theft; and
4. Ensure the Program is updated periodically to reflect changes in risks to students and to the safety and soundness of the creditor from identity theft.

The Program shall, as appropriate, incorporate existing policies and procedures that control reasonably foreseeable risks.

Covered Accounts

Ramapo College has identified two types of accounts, one of which is covered accounts administered by the College and one type of account that is administered by a service provider.

The College covered account is the tuition payment plan which allows students to pay their bills over a series of installments.

The service provider covered account is the Perkins Loan Program administered by Campus Partners; refer to “Oversight of Service Provider Arrangements.”

Identification of Relevant Red Flags

The Program shall include relevant red flags from the following categories as appropriate:

1. Alerts, notifications, or other warnings received from consumer reporting agencies or service providers, such as fraud detection services;
   1. Report of fraud accompanying a credit report.
   2. Notice or report from a credit agency of a credit freeze on an applicant.
   3. Notice or report from a credit agency on an active duty alert for an applicant.
   4. Receipt or notice of address discrepancy in response to a credit report request.
   5. Indication from a credit report of activity that is inconsistent with an applicant’s usual pattern or activity.
2. The presentation of suspicious documents;
   1. Identification document that appears altered or forged.
   2. Identification document on which a person’s photograph or physical description is not consistent with the person presenting the document.
   3. Other document with information that is not consistent with existing student information.
   4. Application for service that appears to have been altered or forged.
3. The presentation of suspicious personal identifying information;
   1. Identifying information that is inconsistent with other information such as inconsistent birth dates, address not matching address on a loan application or photograph or physical description on the identification is not consistent with the appearance of the student presenting the identification.
   2. Identifying information presented that is consistent with fraudulent activity such as in invalid phone number or fictitious billing address, social security number presented that is the same as one given by another student, an address or phone number that is the same as that of another person.
   3. A person fails to provide complete personal identifying information on an application when reminded to do.
4. The unusual use of, or other suspicious activity related to, a covered account;
   1. Change of address for an account followed by a request to change the student’s last name.
   2. Payment stops on an otherwise consistently up-to-date account.
   3. Account used in a way that is not consistent with prior use.
   4. Mail sent to the student is repeatedly returned as undeliverable.
   5. Notice to the College that the student is not receiving mail sent by the College.
   6. Notice to the College that an account has unauthorized activity.
   7. Breach of the College’s computer system security.
   8. Unauthorized access to or use of student account information.
5. A request made from a non-College issued E-mail account;
6. A request to mail something to an address not listed on file;
7. Notice from a student, victims of identity theft, law enforcement authorities, or other persons regarding possible identity theft in connection with covered accounts.

Detection of Red Flags

The Program shall address the detection of red flags in connection with the opening of covered accounts and existing covered accounts, such as by:

1. Obtaining identifying information such as name, date of birth, home address or other identification, and verifying the identity of a person opening a covered account; and
2. Authenticating the identification of students if they request information either in person, via telephone or e-mail. Verifying the validity of change of billing address requests and in banking information for billing and payment purposes in the case of existing covered accounts.

In order to detect any of the Red Fags identified above for an employment position for which a background or credit report is sought, the College will require written verification from any applicant that the address provided by the applicant is accurate and in the event that notice of an address discrepancy is received, verify that the background and/or credit report pertains to the applicant for whom the requested report was made and report to the reporting agency an address for the applicant that the College has reasonably confirmed is accurate.

Response

The Program shall provide for appropriate responses to detected red flags to prevent and mitigate identity theft. The appropriate responses to the relevant red flags are as follows:

1. Monitor a covered account for evidence of identity theft;
2. Deny access to the covered account until other information is available to eliminate the red flag, or close the existing covered account;
3. Contact the student and/or provide student with new student identification number;
4. Change any passwords, security codes or other security devices that permit access to a covered account;
5. Reopen a covered account with a new account number or not open a new covered account;
6. Notify program administrator for determination of the appropriate step(s) to take;
7. Notify law enforcement; or
8. Determine no response is warranted under the particular circumstances.

Protecting Identifying Information

The College will take the following steps with respect to its internal operating procedures to protect identifying information:

1. Ensure the College’s website is secure or provide clear notice that the website is not secure;
2. Ensure complete and secure destruction of paper documents and computer files containing identifying information when such documents or files are no longer needed;
3. Ensure that office computers with access to covered account information are password protected;
4. Avoid use of social security numbers and allow access to social security numbers to very limited number of staff that have been approved by the Red Flag Committee;
5. Ensure computer virus protection is up to date;
6. Require and keep only the kind of information that is necessary for College purposes.

Oversight of the Program

Responsibility for developing, implementing and updating this program lies with the Red Flag Committee for the College. The Committee is chaired by the Chief Planning Officer and the remainder of the Committee is comprised of the unit directors for those areas that have direct access to identifying information. The Program Administrator in conjunction with the Committee will be responsible for the Program and oversight of the Program shall include:

1. Assignment of specific responsibility for implementation of the Program and ensuring appropriate training of College’s staff in the detection of Red Flags, and the responsive steps to be taken when a Red Flag is detected;
2. Reviewing any staff reports regarding the detection of Red Flags and the steps for preventing and mitigating Identity Theft;
3. Determining which steps of prevention and mitigation should be taken in particular circumstances;
4. Review of reports prepared by staff regarding compliance; and
5. Approval of material changes to the Program as necessary to address changing risks of identity theft.
6. Committee will review all requests by staff requesting access to the Social Security Numbers of either students or staff members and make recommendation to the Program Administrator on access.

Staff Training and Reports

College staff responsible for implementing the Program shall be trained either by or under the direction of the Program Administrator in the detection of Red Flags and the responsive steps to be taken when a Red Flag is detected.

1. College staff will be trained as necessary to effectively implement the Program;
2. College staff is expected to notify the Program Administrator once they become aware of an incident of identity theft or of the College’s failure to comply with this program.

Reports shall be prepared as follows:

1. The Program Administrator will report to the President’s Cabinet at least annually on compliance by the College with the Program.
2. The report shall address material matters related to the Program and evaluate issues such as:

1. The effectiveness of the policies and procedures in addressing the risk of identity theft in connection with the opening of covered accounts and with respect to existing covered accounts;
2. Service provider agreements;
3. Significant incidents involving identity theft and management’s response; and
4. Recommendations for material changes to the Program.

Oversight of Service Provider Arrangements

The College shall take steps to ensure that the activity of a service provider is conducted in accordance with reasonable policies and procedures designed to detect, prevent and mitigate the risk of identity theft whenever the organization engages a service provider to perform an activity in connection with one or more covered accounts.

1. Require that service providers have such policies and procedures in place;
2. Require that service providers review the College’s Program and report any Red Flag to the College employee with primary oversight of the service provider relationship.

Updating the Program

The Program shall be reviewed and updated periodically by the Committee to reflect changes in risks to students or to the safety and soundness of the College from identity theft based on factors such as:

1. The experiences of the organization with identity theft;
2. Changes in methods of identity theft;
3. Changes in methods to detect, prevent and mitigate identity theft;
4. Changes in the types of accounts that the organization offers or maintains;
5. Changes in the College’s business arrangements with other entities.