Identity Theft Part 1: The Business Owner’s Responsibility

Tracy Johnson for Business.gov

Nobody wants to think about the possibility of having their company - or, their company’s information - struck by identity thieves. Yet, identity theft is a reality.

As a business owner, it’s imperative to know what your role is if your company is successfully targeted and a customer’s identity is compromised. What are your legal responsibilities? What information - and how much information - do you provide to the law enforcement community?

There are a range of places you can turn for this information. The Small Business Administration’s Business.gov site provides a series of pages dedicated to this topic. You can also find a similar listing of information on the Federal Trade Commission (FTC) site.

Below, I’ve mapped out the basics to help point you in the right direction.

The Rules and Regulations

There is federal legislation called the Fair Credit Reporting Act (FCRA) that spells out rights for victims of identity theft, as well as responsibilities for businesses. At its most basic level, the FCRA requires you to provide a copy of the transaction record in question if one of your customers is a victim of identity theft as a result of personal information your business has collected. That record may be an invoice, a credit application, an account statement, or any document that may provide evidence about the theft.

You must provide this record, free of charge, within 30 days of receiving a request.

That said, you have the right to ensure you’re handing over information to actual authorities. Specifically, that request must be submitted to you in writing. Don’t fall victim to identity theft through a scam claiming that your business has already fallen victim.

You also have the right to ask questions. You may ask victims and/or authorities to provide proof of identity and a police report. If you cannot verify the requestor or if the claim seems to be a misrepresentation, you have the right to refuse in good faith.

More on the rules and regulations of turning over records can be found on the FTC website here.

What to Do In Case of Identity Theft

Let’s say it happens - let’s say customer information (social security number, credit card number, account number) is compromised. The first step is to contact local law authorities.

The next step, according to the FTC, is to notify other businesses that may be impacted. If account or credit card numbers have been stolen from your possession, you must contact the financial institution or credit card company affected - primarily so these organizations can monitor the accounts for fraudulent activity.

If names and social security numbers were compromised the FTC suggests you contact the major credit bureaus for next-step advice. If the compromise affects a large group of people, the FTC further suggests that you let the credit bureaus know if you are advising that your customers request fraud alerts for their files. Letting the credit bureaus know will help your customers.

For more information on which credit bureaus to contact and when can be found on the FTC website here: http://www.ftc.gov/bcp/edu/pubs/business/idtheft/bus59.htm

And, finally, if names and social security numbers have been compromised, the FTC advises that you notify the individuals affected. Be aware, however, this can be very tricky. The FTC provides guidance and guidelines on its website here:

http://www.ftc.gov/bcp/edu/pubs/business/idtheft/bus59.htm

Conclusion

Identity theft is a reality. And, your business may be targeted. I’ve provided places to go to find out your roles and responsibilities, like Business.gov and the FTC. In my next post, Identity Theft Part 2, I’ll provide advice on how to protect yourself against identity theft before it happens.

Tracy Johnson is a Senior Manager with ENC Marketing & Communications. She has the pleasure juggling a variety of clients from both the Information Technology and U.S. Government worlds. She brings a fresh perspective to problem solving for clients often integrating interactive marketing solutions with traditional communication methods. One of her top current clients is the Business Gateway Initiative, where she and the BG team provide marketing and outreach services for Business.gov.