Red Flag Review and Updates

1. Red Flag Review and Updates Staff Meetings March 2009

2. Identity Theft means “A fraud committed or attempted using the identifying information of another person without authority. The Fact Act amended the FCRA and the rules are already in place. Red Flags are patterns, practices, or activities that indicate the possible existence of identity theft. We are responsible of detecting, preventing, and mitigating Identity Theft. QuickReview • Identity Theft means “A fraud committed or attempted using the identifying information of another person without authority. • The Fact Act amended the FCRA and the rules are already in place. • Red Flags are patterns, practices, or activities that indicate the possible existence of identity theft. • We are responsible of detecting, preventing, and mitigating Identity Theft.

3. At account opening When existing members apply for a new service When there is an address change Anytime you come in contact with the member, be aware! Use CIP Authenticate current members Verify change of address Checklists! Use them. They are located in the public folder (Under Red Flag) Detection

4. Detection • We now have a Red Flag Detection Response Worksheet. If you detect a RED FLAG, fill out this sheet and scan a copy to me and your manager.

5. What to include on the Detection Response Worksheet • RED FLAG DETECTION/RESPONSE RECORD • Date Red Flag Discovered/Observed: • Red Flag Description: • Account(s)/Service(s) Affected: • Member Affected: • Account Number:

6. New Step for Prevention • We will work towards a pin/password on ALL member accounts. • When a member phones in, verify a piece of personal information-such as the address or phone number AND a piece of identifying information-such as SSN, birth date, or the date of their last deposit. • Once you have done this, get a pin/password for the member’s account. Place it in a comment and in the security code on the account level.

7. PIN/Password Screen shot removed due to member sensitive information.

8. PIN/Password • This is also the password that you will use when initiating a wire transfer. • Please include in your wire emails that you checked or obtained a security code for the member’s account.

9. Depends on the circumstances If you conclude an account should not be opened due to a red flag, you must contact management and myself. Any significant incidence is documented in a logbook. The responses may change at any time due to changes in methods of ID theft Responses

10. Address Changes • Please make sure you are using the new address change form and checking the appropriate boxes. Office Use Only: * If IRA, please send copy to an IRA specialist to update IRA Direct. • You would checkmark the Verified ID box if you verified the member, example member changes their address at a teller window. • You would checkmark the Verified Signature box if you looked up the signature in optical.

11. Address Changes • We must have a signature to update an address. • Members can change their address online by using CU@Home-this is an electronic signature. X John Doe .

12. We may not issue an additional or replacement card if a request is received during the first 30 days after an address change WITHOUT assessing the validity of such a change. This can be done by: verifying the member changed their address in person Contacting the member in a means of communication previously on record (phone, message system, email) Other, but should be documented Address Changes and Card Orders

13. Red Flag Questions? This is a policy in progress-and always will be. The Red Flag policy will be continually updated as conditions surrounding ID Theft change and as we find what works best for BHFCU in preventing and responding to identity theft.