CLEMSON UNIVERSITY RED FLAG RULES TRAINING DETECTING PREVENTING

CLEMSON UNIVERSITY RED FLAG RULES TRAINING DETECTING, PREVENTING AND MITIGATING IDENTITY THEFT

GOALS OF RED FLAG TRAINING Ø To define commonly used terms related to Identity Theft Ø To explain the federal rules intended to identify Identity Theft Ø To assist you in developing unit-specific procedures that will comply with the Identity Theft Prevention Program approved by the Board of Trustees

IDENTITY THEFT – RED FLAGS Ø A pattern, practice, or specific activity that indicates the possible existence of identity theft

IDENTIFYING RED FLAGS A Red Flag, or any situation closely resembling one, should be investigated for verification

FIVE CATEGORIES OF POTENTIAL INDICATORS OF FRAUD 1. 2. 3. 4. 5. Alerts, Notifications, and Warnings from a Credit Reporting Company Suspicious Documents Suspicious Personal Identifying Information Suspicious Account Activity Notice from Customers and Other Sources

ALERTS, NOTIFICATIONS, AND WARNINGS FROM A CREDIT REPORTING COMPANY Ø Ø Fraud or active duty alert on a credit report. Notice of a credit freeze in response to a request for a credit report Notice of an address discrepancy A credit report pattern inconsistent with person’s history: Ø Large increase in volume of inquiries Ø Unusual number of recently established credit Ø Account that was closed because of an abuse of account privileges

SUSPICIOUS DOCUMENTS Ø Ø Identification that looks altered or forged. The person presenting the identification doesn’t look like the photo or match the physical description Information on the identification that differs from what the person presenting the identification is telling you or doesn’t match with other information, like a signature card or recent check An application that looks like it’s been altered, forged, or torn up and reassembled

SUSPICIOUS PERSONAL IDENTIFYING INFORMATION Ø Ø Ø Inconsistencies with other known information Inconsistencies in information the customer has given An address, phone number or other personal information that’s been used on a known fraudulent account An address or phone number that does not go to a legitimate contact A Social Security number, phone number or address that has been used by many others to open accounts Cannot answer challenge questions

SUSPICIOUS ACCOUNT ACTIVITY Ø Ø Ø After change of address new interest in new accounts or lines of credit New account being used in ways associated with fraud An account used in ways inconsistent with established patterns A sudden increase in activity in an account that had been inactive for a long time Mail being returned repeatedly as undeliverable although transactions continue to be conducted

NOTICE FROM OTHER SOURCES Ø Notification by customers of abnormalities on account Ø Law enforcement is notified Ø Notification of theft of personal data Ø Any other notification of fraud or fraudulent accounts

SECURING CLEMSON FROM OTHER FRAUD ATTEMPTS Ø The Red Flag Rules address external threats, but preventing internal threats are not addressed Is your area “data-rich” Ø Do you know where all your data is Ø Is access to the data strictly controlled Ø Do you have both orientation and termination procedures related to data Ø Ø Not all internal threats are malicious but just casual error

SECURITY Ø Here is how to avoid becoming an ID Theft statistic Ø Ø Ø Store restricted information on secure servers, not on workstations Password protect your computer and set your screensaver to come on automatically Avoid providing restricted data over the telephone or by email Cross-shred all restricted data documents before throwing them away Keep conversations quiet-make sure they cannot be overheard when exchanging restricted data

RESPONDING TO RED FLAGS Ø Report known and suspected fraudulent activity immediately to your direct supervisor Ø This protects both Clemson’s customers and the University from damages and loss: 1. 2. 3. Report Red Flag incident to your supervisor Either the Employee or supervisor, when alerted of a Red Flag, must complete and submit Notification of Possible Privacy Breach form Upon resolution of the incident, the reporting supervisor will create a report outlining the incident which in-turn will be submitted to the Program Administrator

MORE INTERNAL INFORMATION Ø CFO Website Ø Red Flags Website

MORE EXTERNAL INFORMATION Ø Red Flags Website Ø FTC ID Theft Site Ø SC Department of Consumer Affairs

NEED MORE HELP Ø Contact Tonique Dennis or Cathy Freeman Ø 656 -0745 Ø CUredflags@lists. clemson. edu Ø

RED FLAG RULES QUIZ

RED FLAG RULES QUESTION 1 Ø Is the Red Flags program a Way to identify fraudulent patterns b) Way to practice secure ways of conducting business pertaining to financially security c) Specific activity that indicated the possible existence of ID theft d) All of the above a)

RED FLAG RULES QUESTION 1 Ø Is the Red Flags program a Way to identify fraudulent patterns b) Way to practice secure ways of conducting business pertaining to financial security c) Specific activity that indicated the possible existence of ID theft d) All of the above a)

RED FLAG RULES QUESTION 1 Ø Is the Red Flags program a Way to identify fraudulent patterns b) Way to practice secure ways of conducting business pertaining to financial security c) Specific activity that indicated the possible existence of ID theft d) All of the above a) ØAnswer: Ø(D) All of the above. ØThe Red Flags program gives us a way to identify, mitigate and prevent fraud from happening. NEXT QUESTION

RED FLAG RULES QUESTION 1 Ø Is the Red Flags program a Way to identify fraudulent patterns b) Way to practice secure ways of conducting business pertaining to financial security c) Specific activity that indicated the possible existence of ID theft d) All of the above a) ØAnswer: Ø(D) All of the above. ØThe Red Flags program gives us a way to identify, mitigate and prevent fraud from happening. NEXT QUESTION

RED FLAG RULES QUESTION 1 Ø Is the Red Flags program a Way to identify fraudulent patterns b) Way to practice secure ways of conducting business pertaining to financial security c) Specific activity that indicated the possible existence of ID theft d) All of the above a) ØAnswer: Ø(D) All of the above. ØThe Red Flags program gives us a way to identify, mitigate and prevent fraud from happening. NEXT QUESTION

RED FLAG RULES QUESTION 1 Ø Is the Red Flags program a Way to identify fraudulent patterns b) Way to practice secure ways of conducting business pertaining to financial security c) Specific activity that indicated the possible existence of ID theft d) All of the above a) Ø Ø Answer: (D) All of the above. Ø The Red Flags program gives us a way to identify, mitigate and prevent fraud from happening. NEXT QUESTION

RED FLAG RULES QUESTION 2 Which is an indicator of a Red Flag a) Alerts, Notifications, and Warnings from a Credit Reporting Company b) Suspicious Documents c) Suspicious Personal Identifying Information d) Suspicious Account Activity e) Notice from Customers and Other Sources f) All of the above Ø

RED FLAG RULES QUESTION 2 Which is an indicator of a Red Flag a) Alerts, Notifications, and Warnings from a Credit Reporting Company b) Suspicious Documents c) Suspicious Personal Identifying Information d) Suspicious Account Activity e) Notice from Customers and Other Sources f) All of the above Ø ØAnswer: Ø(F) All of the above. ØAll are categories of Red Flags NEXT QUESTION

RED FLAG RULES QUESTION 2 Which is an indicator of a Red Flag a) Alerts, Notifications, and Warnings from a Credit Reporting Company b) Suspicious Documents c) Suspicious Personal Identifying Information d) Suspicious Account Activity e) Notice from Customers and Other Sources f) All of the above Ø ØAnswer: Ø(F) All of the above. ØAll are categories of Red Flags NEXT QUESTION

RED FLAG RULES QUESTION 2 Which is an indicator of a Red Flag a) Alerts, Notifications, and Warnings from a Credit Reporting Company b) Suspicious Documents Ø c) Suspicious Personal Identifying Information d) Suspicious Account Activity Notice from Customers and Other Sources All of the above e) f) ØAnswer: Ø(F) All of the above. ØAll are categories of Red Flags NEXT QUESTION

RED FLAG RULES QUESTION 2 Which is an indicator of a Red Flag a) Alerts, Notifications, and Warnings from a Credit Reporting Company b) Suspicious Documents c) Suspicious Personal Identifying Information d) Suspicious Account Activity e) Notice from Customers and Other Sources f) All of the above Ø ØAnswer: Ø(F) All of the above. ØAll are categories of Red Flags NEXT QUESTION

RED FLAG RULES QUESTION 2 Which is an indicator of a Red Flag a) Alerts, Notifications, and Warnings from a Credit Reporting Company b) Suspicious Documents c) Suspicious Personal Identifying Information d) Suspicious Account Activity e) Notice from Customers and Other Sources f) All of the above Ø ØAnswer: Ø(F) All of the above. ØAll are categories of Red Flags NEXT QUESTION

RED FLAG RULES QUESTION 2 Which is an indicator of a Red Flag a) Alerts, Notifications, and Warnings from a Credit Reporting Company b) Suspicious Documents c) Suspicious Personal Identifying Information d) Suspicious Account Activity e) Notice from Customers and Other Sources f) All of the above Ø ØAnswer: Ø(F) All of the above. ØAll are categories of Red Flags NEXT QUESTION

RED FLAG RULES QUESTION 3 Ø Personal Identifying Information includes: Any number or name b) Any number or name used alone or in conjunction with other information c) Any number or name that may be used alone or in conjunction with other information to identify a specific individual a)

RED FLAG RULES QUESTION 3 Ø Personal Identifying Information includes: Any number or name b) Any number or name used alone or in conjunction with other information c) Any number or name that may be used alone or in conjunction with other information to identify a specific individual a) ØAnswer Ø(C) ØAlthough C contains parts of A and B, PII is defined by information used in conjunction to identify a specific Individual NEXT QUESTION

RED FLAG RULES QUESTION 3 Ø Personal Identifying Information includes: Any number or name b) Any number or name used alone or in conjunction with other information c) Any number or name that may be used alone or in conjunction with other information to identify a specific individual a) ØAnswer Ø(C) ØAlthough C contains parts of A and B, PII is defined by information used in conjunction to identify a specific Individual NEXT QUESTION

RED FLAG RULES QUESTION 3 Ø Personal Identifying Information includes: Any number or name b) Any number or name used alone or in conjunction with other information c) Any number or name that may be used alone or in conjunction with other information to identify a specific individual a) ØAnswer Ø(C) ØAlthough C contains parts of A and B, PII is defined by information used in conjunction to identify a specific Individual NEXT QUESTION

RED FLAG RULES QUESTION 4 Ø Which is an example of a suspicious document? A drivers licenses that matches other information that is known b) An insurance number and card to match c) An apparent altered drivers licenses a)

RED FLAG RULES QUESTION 4 Ø Which is an example of a suspicious document? A drivers licenses that matches other information that is known b) An insurance number and card to match c) An apparent altered drivers licenses a) ØAnswer Ø(C) ØSuspicious documents can be any record that appears forged, misprinted, or altered. NEXT QUESTION

RED FLAG RULES QUESTION 4 Ø Which is an example of a suspicious document? A drivers licenses that matches other information that is known b) An insurance number and card to match c) An apparent altered drivers licenses a) ØAnswer Ø(C) ØSuspicious documents can be any record that appears forged, misprinted, or altered NEXT QUESTION

RED FLAG RULES QUESTION 4 Ø Which is an example of a suspicious document? A drivers licenses that matches other information that is known b) An insurance number and card to match c) An apparent altered drivers licenses a) ØAnswer Ø(C) ØSuspicious documents can be any record that appears forged, misprinted, or altered NEXT QUESTION

RED FLAG RULES QUESTION 5 Ø After you have identified Red Flags that are likely to occur within your department or office, what do you do next? Set up procedures to detect those red flags in your day -to-day operations b) Train all employees in the procedures c) Periodically review your list of red flags to be sure they are still relevant d) All of the above a)

RED FLAG RULES QUESTION 5 Ø After you have identified Red Flags that are likely to occur within your department or office, what do you do next? Set up procedures to detect those red flags in your day-to-day operations b) Train all employees in the procedures c) Periodically review your list of red flags to be sure they are still relevant d) All of the above a) ØAnswer Ø(D) All of the above ØWhen types of Red Flags have been identified departmentally; procedures, training and review must be put in place. NEXT QUESTION

RED FLAG RULES QUESTION 5 Ø After you have identified Red Flags that are likely to occur within your department or office, what do you do next? Set up procedures to detect those red flags in your day -to-day operations b) Train all employees in the procedures c) Periodically review your list of red flags to be sure they are still relevant d) All of the above a) ØAnswer Ø(D) All of the above ØWhen types of Red Flags have been identified departmentally; procedures, training and review must be put in place. NEXT QUESTION

RED FLAG RULES QUESTION 5 Ø After you have identified Red Flags that are likely to occur within your department or office, what do you do next? Set up procedures to detect those red flags in your day -to-day operations b) Train all employees in the procedures c) Periodically review your list of red flags to be sure they are still relevant d) All of the above a) ØAnswer Ø(D) All of the above ØWhen types of Red Flags have been identified departmentally; procedures, training and review must be put in place. NEXT QUESTION

RED FLAG RULES QUESTION 5 Ø After you have identified Red Flags that are likely to occur within your department or office, what do you do next? Set up procedures to detect those red flags in your day -to-day operations b) Train all employees in the procedures c) Periodically review your list of red flags to be sure they are still relevant d) All of the above a) ØAnswer Ø(D) All of the above ØWhen types of Red Flags have been identified departmentally; procedures, training and review must be put in place. NEXT QUESTION

RED FLAG RULES QUESTION 6 Ø The purpose of the Red Flag Rule program is to detect the warning signs of ID theft in day-to-day operations, take steps to prevent the crime and mitigate the damage it inflicts True False

RED FLAG RULES QUESTION 6 Ø The purpose of the Red Flag Rule program is to detect the warning signs of ID theft in day-to-day operations, take steps to prevent the crime and mitigate the damage it inflicts True False ØAnswer ØTrue The Red Flags Rule program will guide you in spotting, mitigating and assist you in preventing fraud from occurring NEXT QUESTION

RED FLAG RULES QUESTION 6 Ø The purpose of the Red Flag Rule program is to detect the warning signs of ID theft in day-to-day operations, take steps to prevent the crime and mitigate the damage it inflicts True False ØAnswer ØTrue The Red Flags Rule program will guide you in spotting, mitigating and assist you in preventing fraud from occurring NEXT QUESTION

RED FLAG RULES QUESTION 7 Ø External ID theft fraud attempts are the only threats to Clemson University True False

RED FLAG RULES QUESTION 7 Ø External ID theft fraud attempts are the only threats to Clemson University True False ØAnswer ØFalse Internal threats are also a possibility. internal threats are not all malicious, some are caused by causal error. NEXT QUESTION

RED FLAG RULES QUESTION 7 Ø External ID theft fraud attempts are the only threats to Clemson University True False ØAnswer ØFalse Internal threats are also a possibility. internal threats are not all malicious, some are caused by causal error. NEXT QUESTION

RED FLAG RULES QUESTION 8 Ø Which characteristics would make a department vulnerable to internal fraud? The “data-rich” area b) Where access to data is not strictly controlled c) Where orientation and termination procedures related to data are not in place d) All of the above a)

RED FLAG RULES QUESTION 8 Ø Which characteristics would make a department vulnerable to internal fraud? The “data-rich” area b) Where access to data is not strictly controlled c) Where orientation and termination procedures related to data are not in place d) All of the above a) ØAnswer Ø(D) All of the Above ØWhen these types of characteristics are present within a department or office, then the department becomes more attractive to internal and external fraudulent actions NEXT QUESTION

RED FLAG RULES QUESTION 8 Ø Which characteristics would make a department vulnerable to internal fraud? The “data-rich” area b) Where access to data is not strictly controlled c) Where orientation and termination procedures related to data are not in place d) All of the above a) ØAnswer Ø(D) All of the Above ØWhen these types of characteristics are present within a department or office, then the department becomes more attractive to internal and external fraudulent actions NEXT QUESTION

RED FLAG RULES QUESTION 8 Ø Which characteristics would make a department vulnerable to internal fraud? The “data-rich” area b) Where access to data is not strictly controlled c) Where orientation and termination procedures related to data are not in place d) All of the above a) ØAnswer Ø(D) All of the Above ØWhen these types of characteristics are present within a department or office, then the department becomes more attractive to internal and external fraudulent actions NEXT QUESTION

RED FLAG RULES QUESTION 8 Ø Which characteristics would make a department vulnerable to internal fraud? The “data-rich” area b) Where access to data is not strictly controlled c) Where orientation and termination procedures related to data are not in place d) All of the above a) ØAnswer Ø(D) All of the Above ØWhen these types of characteristics are present within a department or office, then the department becomes more attractive to internal and external fraudulent actions NEXT QUESTION

RED FLAG RULES QUESTION 9 Ø What is the necessary immediate action taken if fraud is suspected? Cancel the transaction b) Report incident to the immediate supervisor c) Determine the extent of liability d) Do nothing and wait to see e) Notify the customer that fraud has been attempted a)

RED FLAG RULES QUESTION 9 Ø What is the necessary immediate action taken if fraud is suspected? Cancel the transaction b) Report incident to the immediate supervisor c) Determine the extent of liability d) Do nothing and wait to see e) Notify the customer that fraud has been attempted a) ØAnswer Ø(B) ØThis needs to be done immediately to mitigate losses and risk. This action must be followed when fraud is suspected regardless if it actually occurs NEXT QUESTION

RED FLAG RULES QUESTION 9 Ø What is the necessary immediate action taken if fraud is suspected? Cancel the transaction b) Report incident to the immediate supervisor c) Determine the extent of liability d) Do nothing and wait to see e) Notify the customer that fraud has been attempted a) ØAnswer Ø(B) ØThis needs to be done immediately to mitigate losses and risk. This action must be followed when fraud is suspected regardless if it actually occurs NEXT QUESTION

RED FLAG RULES QUESTION 9 Ø What is the necessary immediate action taken if fraud is suspected? a) b) c) d) e) Cancel the transaction Report incident to the immediate supervisor Determine the extent of liability Do nothing and wait to see Notify the customer that fraud has been attempted ØAnswer Ø(B) ØThis needs to be done immediately to mitigate losses and risk. This action must be followed when fraud is suspected regardless if it actually occurs NEXT QUESTION

RED FLAG RULES QUESTION 9 Ø What is the necessary immediate action taken if fraud is suspected? Cancel the transaction b) Report incident to the immediate supervisor c) Determine the extent of liability d) Do nothing and wait to see e) Notify the customer that fraud has been attempted a) ØAnswer Ø(B) ØThis needs to be done immediately to mitigate losses and risk. This action must be followed when fraud is suspected regardless if it actually occurs NEXT QUESTION

RED FLAG RULES QUESTION 9 Ø What is the necessary immediate action taken if fraud is suspected? Cancel the transaction b) Report incident to the immediate supervisor c) Determine the extent of liability d) Do nothing and wait to see e) Notify the customer that fraud has been attempted a) ØAnswer Ø(B) ØThis needs to be done immediately to mitigate losses and risk. This action must be followed when fraud is suspected regardless if it actually occurs NEXT QUESTION

RED FLAG RULES QUESTION 10 Ø What is the immediate action taken by the supervisor if they have been alerted of fraud? Complete and submit Notification of Possible Privacy Breach form b) Fully investigate incident c) Determine the extent of liability d) Do nothing and wait to see a)

RED FLAG RULES QUESTION 10 Ø What is the immediate action taken by the supervisor if they have been alerted of fraud? Complete and submit Notification of Possible Privacy Breach form b) Fully investigate incident c) Determine the extent of liability d) Do nothing and wait to see a) ØAnswer Ø(A) ØThis needs to be done immediately to mitigate losses and risk. Further investigation will be conducted by the Red Flags Administrator and Committee. NEXT SLIDE

RED FLAG RULES QUESTION 10 Ø What is the immediate action taken by the supervisor if they have been alerted of fraud? Complete and submit Notification of Possible Privacy Breach form b) Fully investigate incident c) Determine the extent of liability d) Do nothing and wait to see a) ØAnswer Ø(A) ØThis needs to be done immediately to mitigate losses and risk. Further investigation will be conducted by the Red Flags Administrator and Committee. NEXT SLIDE

RED FLAG RULES QUESTION 10 Ø What is the immediate action taken by the supervisor if they have been alerted of fraud? Complete and submit Notification of Possible Privacy Breach form b) Fully investigate incident c) Determine the extent of liability d) Do nothing and wait to see a) ØAnswer Ø(A) ØThis needs to be done immediately to mitigate losses and risk. Further investigation will be conducted by the Red Flags Administrator and Committee. NEXT SLIDE

RED FLAG RULES QUESTION 10 Ø What is the immediate action taken by the supervisor if they have been alerted of fraud? Complete and submit Notification of Possible Privacy Breach form b) Fully investigate incident c) Determine the extent of liability d) Do nothing and wait to see a) ØAnswer Ø(A) ØThis needs to be done immediately to mitigate losses and risk. Further investigation will be conducted by the Red Flags Administrator and Committee. NEXT SLIDE

NEED MORE HELP Ø Contact Tonique Dennis or Cathy Freeman Ø 656 -0745 Ø CUredflags@lists. clemson. edu Ø

CLEMSON UNIVERSITY RED FLAG RULES TRAINING DETECTING, PREVENTING AND MITIGATING IDENTITY THEFT

Ø To acknowledge that you have read and completed the online Red Flags Program training, continue to the website below. Ø Clemson. edu/esig