Preventing Identity Theft in Your Business

PREFACE

All companies that engage in financial transactions are bound by law to establish and enforce information security programs to prevent identity theft. Security “standards” are required by at least five federal laws, including the Fair Credit Reporting Act, the Federal Trade Commission’s Privacy Rule, the Banking Guidelines, the Health Insurance Portability and Accountability Act, and the Gramm-Leach-Bliley Safeguards Rule. But there are problems. Nowhere do any of these laws describe how to develop, maintain, and enforce an information security program. In effect, the laws fail to stipulate what constitutes an “information security program” or “standards” for security.

Granted, the laws do specify information technology (IT) security—the security of computers and networks. Indeed, the main theme at the September 2004 American Banking Association’s Identity Theft Symposium was “Technology to the Rescue.” Bankers were informed of online products and protections and advised to prevent identity theft by using tools such as encryption, authentication, and software programs that guard against email and other computer fraud. But computers do not steal identities.

Rather, recent studies indicate that at least 50 percent or more of identity thefts are committed inside the workplace by a dishonest few employees who steal the Social Security, credit card, banking, or other numbers from their coworkers and customers. Federal laws fail, however, to cover people within businesses ...