The Gramm-Leach-Bliley Act (GLBA) protects against the misuse of private, non-public personal information and requires financial institutions to explain their information-sharing practices and safeguard sensitive data. GLBA, also known as Regulation P, applies only to consumers and does not apply to companies or individuals that obtain financial products and services for business, commercial, or agricultural purposes. See the Regulation P article for an in depth look at GLBA.

BEFORE you can release information to an individual claiming to be a client, you must first verify their identity. You can always base identity upon your personal knowledge or if the caller provides you with the Inquiry Identification (ID) Code (IID) listed on their CIF record as well as the last 4 of their Tax Identification Number (TIN).

In other cases, to ensure that you are speaking with the client, the caller MUST be able to give you at least 3 of the identifiers listed for the type of account in question. One of the identifiers requested should ALWAYS be the TIN (social security number for consumers), since someone who finds a checkbook or steals a check would not know that information, and we should be very suspicious of any caller who cannot supply their TIN. Many clients are wary of giving you their entire TIN# so the last 4 digits with 2 additional identifiers are sufficient.

There are a few ways to identify a client over the telephone. 

Once you have properly identified the caller as our client, you may answer their question or give them the information they are requesting about their account. Remember that you can only give information using this method to the client if they are a signer on the account (as confirmed by our account records). 

The Client Service Center (CSC) has the capability to send a mobile security code to clients that do not remember their Inquiry Identification (ID) Code (IID). This is done when the client can give their account number or last 4 but cannot provide their inquiry ID code. This mobile security code is authorized as a form of identification unique to the Client Service Center as it requires the client to have their mobile device in their possession in order to read the security code back to the CSC associate. 

In the event the client cannot respond with the correct mobile code, the client may be able to authenticate using one of the earlier mentioned identifiers or by visiting an office.

If you are authorized by your supervisor to release information to clients, you are responsible for understanding the established identity verification guidelines. You are not to release ANY information unless you are specifically authorized to do so by your supervisor. 

No person is to be so authorized until they have received the appropriate training.

Read through the accordions below to learn about what information can be released to each of these groups or in these specific situations.

If the client does not have access to a fax machine and cannot come into the bank, but they do have access to e-mail, you can utilize an e-mail authorization form to release information.  You can use 1 of the following methods to have the client receive and return the authorization form.

• Send a secured e-mail authorization through CCB’s Online Banking.
• If the client does not have Online Banking, the CCB associate must follow the steps below to obtain a valid e-mail authorization:
  1. Verify the client’s identity using the Identity Verification Guidelines tab.
  2. Ask the client for the e-mail address they wish us to use.
  3. Send the E-mail Authorization Form to the client at the specified email address.
  4. Ask the client to reply to that email and authorize the release of information.
  5. Print the entire e-mail correspondence.
  6. Write on the printed e-mail that you spoke to the caller, verified their identity, and obtained the authorization by e-mail. Write your name by the information.
• Identify the client using their Inquiry Identification Code (IIC), and use the e-mail address on their CIF to obtain the authorization. Once the client has replied with the authorization, follow steps 5 and 6 above.

An email sent within the bank from associate to associate is secure because it is transmitted over our network; however, email sent outside of the bank is not secure because it is transmitted over the Internet. Sensitive client or bank information (for example: account numbers, tax ID numbers, balance information) in e-mails that leave the bank are automatically encrypted by Egress if the associate is authorized to send this information by e-mail. The e-mail will be blocked if the associate is not authorized. Contact the Chief Information Security Officer or your supervisor if you do not have the ability to send encrypted e-mail. If you would like to know more about Egress see Egress E-mail Encryption.

For Business Accounts

GLBA/Regulation P applies to consumer accounts only. Therefore, if an individual, merchant, or another financial institution calls to verify funds for a business account, the associate may respond to the inquiry but must limit their response to 1 of the following: 

• “Yes, the check would pay at this moment.” 
• “No, the check would not pay at this moment.” 
• “That account is closed.” 

If there are messages on the client’s CIF indicating that the check is fraudulent and you have identified the caller as legitimately having a check (see procedures below), you may state, 

• “That check may not be a valid check.”

For Consumer Accounts

If an individual, merchant, or another financial institution calls to verify funds for a consumer account, the following steps must be taken: 

1. Ask the caller for our client’s account number, the amount of the check, and the check number.
2. Look at the account history to verify that the check number corresponds to the sequence of check numbers recently paid on the account.
   1. DO NOT VERIFY FUNDS without checking to see if the number on the check is a number close to the range of recently paid check numbers.
   2. If the check number the caller gives you is within the expected range of numbers, proceed to the next step.
   3. If the check number is not within the expected range of check numbers, you must advise the caller to come to the office with the check.
3. Respond to the inquiry, but limit your response to one of the following: 
   • “Yes, the check would pay at this moment.” 
   • “No, the check would not pay at this moment.” 
   • “That account is closed.”
4. We cannot give any other information (for example: address, telephone number, date account closed) to the caller without written authorization from our client.

Remember, we can always release information to a client if they are a signer on the account AFTER we verify their identity following the Identity Verification Guidelines. Other than verifying funds, we cannot release information to anyone who is not a signer on an account without the client’s written authorization.

Note: A client’s account history may show 2 series of check numbers or check numbers from non- consecutive books of checks. In those instances you should look at more of the history to determine if the check number given by the caller appears to agree with the “pattern” of check numbers recently paid. For example: Some clients use two different series of check numbers on the same account (if for example husband and wife each carry a checkbook on the same account).

If you are speaking to a known business (for example: car dealership or another financial institution that you have a comfort level from prior business interactions) and the client is either refinancing our loan or paying off our loan to purchase another vehicle, do the following:

1. Ask the business for specific information about the client and the loan before you release the payoff. The business must provide you with one of the following which they should already have on an application from the client:
   • The client’s account number and collateral description
   • The client’s TIN and collateral description 
2. Verify the accuracy of this information by checking the information on the client's CIF.
3. After confirming, you may release a payoff quote to that business without written authorization from the client.

Do not release a payoff quote to anyone else without the client’s written authorization. Written authorization can be received by fax or e-mail.

• By fax: Must contain our client's signature. The signature should be verified unless it is received directly from a reputable merchant or another bank. 
• By e-mail: See the E-mail Authorizations tab. 

Client authorizations are to be kept for 30 days at the location where the authorization was received.

These procedures do not alter any existing GLBA procedures for clients who are not active duty military personnel, but are intended to recognize the special circumstances currently facing many military personnel and their families.

We have an obligation to all clients to protect the confidentiality of their non-public personal financial information. We have implemented procedures to ensure that we do not release information to unauthorized parties. Some of these procedures may be difficult when dealing with active duty military serving in a hostile territory; however, we cannot relax our efforts to ensure we have the client’s permission to release information to a 3rd party.

Identity and Information Release

Certain information is never to be released to any 3rd party. NEVER release the active duty military client’s Social Security Number or Deposit Account/Loan Number to any 3rd party UNLESS they have a confirmed power of attorney (POA) or specific written authority from the client. However, you may be requested and it may be OK to give the 3rd party information such as payment amounts; past due amounts; number of payments past due; or whether a particular check has cleared to assist the 3rd party in handling the active duty military client’s financial affairs. This type of information is acceptable to release after you follow the steps below to attempt to obtain the permission of the active duty military client.

Associates must use good judgment when the active duty military client cannot be reached and has not designated a POA to handle their affairs. Remember, the intent of these procedures is to provide assistance to the military client and their family while protecting the confidentiality of their information. If you have questions about these procedures or a specific situation does not fall within the above guidelines, please contact the Chief Information Security Officer.

In an attempt to prevent identity theft and protect client information, a confirmation letter is mailed to BOTH the old address and the new address to confirm that the client wishes to have their address changed. The JHA system automatically prepares the letters for distribution each time an address change is made to a client’s CIF record. Deposit Services is responsible for mailing the letters. Associates should notify the Chief Information Security Officer immediately if a client reports they have received a letter and has not requested an address change.

Pretext Telephone Calling Information

Pretext calling is a method of impersonation used by a caller to get a client’s nonpublic personally identifiable information. Pretext calling is associated with many of the reported cases of identity theft and is partly responsible for the billions of dollars lost each year from check fraud. Pretext calling was made illegal by the Gramm Leach Bailey Act.

Pretext callers use different ploys to get information. They often pretend to be clients, higher-level associates within the bank, officials at another bank, government regulators or law enforcement officers. Pretext callers use a number of approaches that work on the psychology and human nature of associates including intimidation and helplessness.
 

Capital City Bank associates are required to follow the established identification guidelines to avoid becoming a victim of pretext calling.