Risks of Potential Identity Theft in the Use of Stored-Value and Payroll Deduct
FIN-ACC-580
About This Policy
- Effective Date:
- 06-01-2009
- Date of Last Review/Update:
- 06-01-2009
- Responsible University Office:
- Office of the University Controller
- Responsible University Administrator:
- Vice President and Chief Financial Officer
- Policy Contact:
Anna Jensen
Associate Vice President and University Controller
Office of the University Controller
anjensen@iu.edu
- Policy Feedback:
- If you have comments or questions about this policy, let us know with the policy feedback form.
Policy Statement
The University shall provide an automatic email response to an Account Card Holder at any time that his or her address is changed within the University’s electronic system.
Each Account Card office shall reference and implement relevant provisions of the University’s Identity Theft Prevention Program when responding to requests by Account Card Holders for additional or replacement cards.
Reason for Policy
One of the Federal Trade Commission’s (FTC) regulations implementing the new “Red Flag” rules, specifically 16 C.F.R. Part 681.3, applies to creditors and financial institutions that issue debit or credit cards. The regulation requires such card issuers to establish and implement reasonable policies and procedures to assess the validity of a change of address if and when the issuer receives notification of a change of address for a consumer’s debit or credit account, and within a short period of time afterwards, also receives a request for an additional or replacement card for the same account. The regulation also provides that the card issuer may satisfy the regulation by notifying the cardholder of a change in address, and providing the cardholder a reasonable means of promptly reporting incorrect address changes, at any time prior to the time the card issuer receives a request for an additional or replacement card.
There are several types of accounts provided by the University that the FTC suggests fall subject to this regulation, specifically stored-value accounts and payroll deduct accounts for the purchase of goods and services on and off-campus, and payroll debit cards used by a limited number of University employees. Each of these accounts is described below.
Registered students, employees, and certain other individuals affiliated with the Bloomington, Indianapolis and Southeast campuses have the option of using their campus ID cards as stored-value accounts for the purchase of goods and services both on and off-campus. The accounts are funded by cash or credit card deposits made by the account holder; no cash advances or withdrawals are permitted with these stored-value accounts. In addition, the Indianapolis and Southeast campuses offer employees a payroll deduct account option. The payroll deduct accounts allow employees to make purchases on and off-campus using their campus ID cards, and the purchases are deducted from the employees’ paycheck subject to the employees’ pre-designated spending limits. For purposes of this policy, all campus ID cards used to hold stored-value accounts or payroll deduct accounts will be referred to as “Account Cards” and the users of Account Cards will be referred to “Account Card Holders.”
While the University does not consider the FTC’s regulation above to be govern the use of stored-value accounts on its campuses, the policy stated herein shall satisfy any compliance obligation the University may have pursuant to 16 C.F.R. Part 681.3 for all Account Cards.
Procedures
At any time that an Account Card Holder’s address is changed within the SIS/Peoplesoft system, an automatic email notification will be sent to the Holder’s University email account alerting him or her of the change and providing instruction in the event the address change was not authorized. This automatic notification will be implemented in early 2009.
When responding to requests by Account Card Holders for additional or replacement Account Cards, the Account Card office shall refer to and implement the relevant provisions of the University’s Identity Theft Prevention Program to ensure that the risks of identity theft are minimized.
In the event an Account Card Office believes that an account holder has been a victim of identity theft, it shall work with the individual to prevent the theft from affecting the employee’s Campus ID Card as well as any Account Card involved. When appropriate, the office shall also advise the individual to contact their campus police, UITS, the campus Bursar, as well as any financial institutions in which the employee may have financial accounts.
Finally, a small number of University employees opt to receive their payroll via a debit card issued by JP Morgan Chase. While recognizing that the University funds Payroll Cards through the payroll system, JP Morgan Chase is the issuer of these Payroll Cards. As such, any address changes or requests for reissue must be initiated by the cardholder directly with JP Morgan Chase. Indiana University is unable to change addresses for cardholders or initiate a reissue on an employee’s behalf.