Procedures for Identity Theft Prevention

These procedures supplement the Identity Theft Prevention Program (VIII.A.2). Refer to the policy for definitions and contacts. Defined terms are capitalized throughout the document.

Effective Date: July 15, 2019

Responding to Red Flags

The Program provides for appropriate responses to detected Red Flags to prevent and mitigate Identity Theft. The response will be commensurate with the degree of risk posed.

Appropriate responses to the detection of Red Flags include:

  • Monitor a Covered Account for evidence of Identity Theft.
  • Contact the Customer.
  • Change any passwords, security codes or other security devices that permit access to a Covered Account.
  • Reopen a Covered Account with a new account number.
  • Do not open a new Covered Account.
  • Close an existing Covered Account.
  • Request additional documentation to validate identity.
  • Handle per regulatory requirements under law if applicable.
  • Notify law enforcement or regulatory entity.
  • Determine no response is warranted under the particular circumstances.

Processing Consumer Reporting Address Discrepancies

Upon receipt of a Notice of Address Discrepancy from a consumer reporting agency indicating the address given by the Consumer differs from the address contained in the consumer report, the Assigned Resource will reasonably confirm that an address is accurate by any of the following means:

  • Verification of the address with the Consumer.
  • Review of the individual’s records.
  • Verification of the address through third-party sources.
  • Other reasonable means.

If an accurate address is confirmed, the Assigned Resource will furnish the Consumer’s address to the consumer reporting agency from which it received the Notice of Address Discrepancy if:

  1. Purdue University establishes a continuing relationship with the Consumer.
  2. Purdue University regularly and, in the ordinary course of business, furnishes information to the consumer agency.

Assessing Change of Address Requests Related to Card Activity

Upon receipt of a request for an additional or replacement University ID card within 30 days of a notification of an address change, the Assigned Resource will assess the validity of the request. An additional or replacement card will not be issued until the assessment has occurred. Validity of requests for duplicate or replacement cards will be established by:

  1. Providing written or electronic notification to the cardholder of the request for an additional or replacement card.
  2. Providing a cardholder a reasonable means of promptly reporting address changes.

The Assigned Resource will reasonably confirm that an address is accurate by any of the following means:

  • Verification of the address with the Consumer.
  • Review of the individual’s records.
  • Verification of the address through third party sources.
  • Other reasonable means.

Training

The following principles must be included in training materials for those areas maintaining activity relating to a Covered Account:

  • Identity Theft is a serious risk for Customers and businesses that use or maintain financial or demographic information. It is necessary for Purdue to seek methods to minimize potential impact to the institution and its clients and Customers.
  • Personally Identifiable Information should not be provided to individuals as a rule. Rather, this information should be maintained in order to confirm the identity of Purdue’s Customers.
  • Staff should not store Personally Identifiable Information unless necessary to perform a business function and should only store information in secured systems designated for those functions.
  • Identity Theft reports should be handled as priority incidents, and immediate steps should be taken to remediate resulting issues.