The Red Flags Are Flying!

by Terri Urbanek, Community Credit Union, La Crosse, Wisconsin

The deadline is approaching for state-chartered credit unions to comply with the Federal Trade Commission’s identity theft “Red Flags” rules. Here at Community Credit Union (CCU), employees have been testing the procedures that were put in place last fall to meet the requirements of the Fair and Accurate Credit Transactions (FACT) Act of 2003. This article discusses the process for address changes developed to help employees identify, detect and respond to patterns, practices or specific activities that may indicate identity theft.

Of all the areas the organization looked at, address changes touched the most departments. It is more than just return mail; it can also affect the delivery of plastics and PINs, the ability of a Member Service Representative to complete an application and more. All address changes at CCU are handled by our Call Center. Any address change request –face-to-face or not – is sent via an electronic form to the Call Center for verification and completion. This assures a consistent change process throughout the organization.

At CCU, address changes fall into two categories – face-to-face or not. Face-to-face is easier because we can ask for picture identification to help determine whether the person in front of you is the account owner. As we worked our way through the guidelines, we knew we wanted to move away from asking the standard “Can you tell me the last 4 digits of your social?” We don’t want to make the process too cumbersome for employees, so we use the CU*Base Gold system to help employees identify our members. Before an employee can begin to verify identity, they need to determine if the person has the right to change an address. At CCU, addresses can only be changed on memberships when the person requesting the change is the primary owner or a joint owner on all suffixes.

CCU settled on the following identification process: (all of these questions can be answered using information found on the CU*BASE Inquiry screen)

Verify the identity of the member by using any two of the six security questions, one of which must be choice a, b, or c:
a. If you have a nickname on an account, what is it?
b. Ask the caller to identify electronic services being used (ATM, Electronic Funds Transfer, Payroll ACH, Over Draft Protection) or whether there is a joint owner on an account.
c. What is your email address?
d. What is you mother’s maiden name?
e. What is your date of birth?
f. What are the last four digits of your social security?

If person calling fails the two questions, STOP. They will be required to come to the closest office for verification of identity. If the person is not local, they may send a letter with a signature requesting the account change or transaction. The request is then verified with the signature on file and a phone call to the number on the account.

Address Changes received from the Mail Teller:
At CCU we have designated a specific teller drawer as “mail teller”. All payments and deposits received in the mail are processed through this drawer. Address changes noted on a payment coupon, statement, or a note, with or without a signature, are sent to the Call Center via electronic form for processing. When the request includes a signature, the signed document remains with the MT items and it will be noted in the comment section of the electronic form. The Call Center completes and sends an address change letter to confirm the change and places a tracker on the account to indicate an address change notice was received in the mail, the date it was received, and that a verification letter was sent.

Return Mail

All return mail is opened in the Call Center for review of the contents of the envelope. Returned plastic, PINs, loan documents, new account information, and checks are forwarded to the Research Specialist for verification of authenticity of the account and processing. All other returned mail is handled by the Call Center. Letters are sent to the system address and to the new address indicated by the Post Office. Accounts are flagged as incorrect address and members have nine days to respond and verify the change. A tracker is placed on the account indicating what was returned, the date it was returned, and when the verification letters went out, this allows all employees to check for information if a member comes in and indicates they are not receiving mail. If no response is received, the account is frozen after 30 days to prevent cash withdrawals until the address is corrected.

While each credit union is unique in how it conducts business, we all follow the same rules. Address changes take up an enormous amount of support time and require tracking of the process to prove that the credit union is in compliance with the Red Flag requirements. Trackers on a members account are essential to the process. CCU continues to refine the process and look for more ways to make it efficient by using as much of the CU*BASE system as we can.