10.20.060 Detection, prevention and mitigation.
(a) Detection. In an effort to ensure proper detection of any red flags, all customers (consumers) must provide at least the following information with supporting documentation before any new covered account will be opened:
(1) Full name.
(2) Date of birth (individual).
(3) Address: a residential or business street address.
(i) For an individual who does not have a residential or business street address:
1. An Army Post Office (APO) or post office (PO) box number; or
2. The residential or business street address of a next of kin or other contact.
(ii) For an entity such as a corporation, partnership or trust, the address of:
1. Principal place of business;
2. Local office; or
3. Other physical location.
(4) Identification number:
(i) For a U.S. citizen, a taxpayer identification number or government issued photo ID; or
(ii) For a non-U.S. citizen, one or more of the following: a taxpayer identification number, passport number and country of issuance, alien identification card number and country of issuance or any other government issued document evidencing nationality or residence and bearing a photograph or similar safeguard.
Within a reasonable time of discovering that any of the foregoing information is missing from a covered account, the Commission will contact the account holder to obtain the missing information.
(b) Preventing and Mitigating Identity Theft. In the event a red flag is detected, the Commission will take reasonable steps to prevent the occurrence of identity theft, and to mitigate any harm caused thereby. In order to respond appropriately to the detection of a red flag the Commission shall consider any aggravating circumstances that may heighten the risk of identity theft. After assessing the degree of risk posed, the Commission will respond to the red flag in an appropriate manner which may include:
(1) Monitoring a covered account for evidence of identity theft;
(2) Contacting the customer;
(3) Changing any passwords, security codes or other security devices that permit access to a covered account;
(4) Reopening a covered account with a new account number;
(5) Not opening a new covered account;
(6) Closing an existing covered account;
(7) Refraining from collecting on a covered account or from selling a covered account to a debt collector;
(8) Notifying law enforcement; or
(9) Determining that no response is warranted under the particular circumstances. (GMO 09-01 § IV)