Businesses are on the front lines in the battle against identity theft, and they face significant challenges in protecting sensitive information from identity thieves. The downside of not doing enough to protect against identity theft is far worse than the costs of taking proper steps to protect sensitive information. Businesses who fail to adequately protect against identity theft may see their customers leave, may lose money, and may become targets of lawsuits.

Businesses inevitably have access to personally identifying information from their customers, employees, and vendors, including names and addresses, social security numbers, credit card numbers, or other account numbers. It is critical that businesses keep this information out of the hands of identity thieves.

How can businesses protect against identity theft?

Shred documents before disposing of them. 

Arizona law requires certain documents be disposed of properly. When in doubt, shred. . . 

If you don't need it, don't ask for it. 

Criminals can't steal customer information from you if you don't have it. Businesses should only collect such personal information as is necessary. And if you find that you collect personal information and don't use it, stop collecting it.

Don't use an employee's social security number as the employee's employee number.

If you need to assign a number to an employee, generate a random number. Don't expose your empoyees to unnecessary risk by using their social security number. 

Take advantage of the Social Security Administration's social security number identification program.

The United State's Social Security Administration offers a free program that allows employers to verify a social security number provided by an employee. This service can also by accessed via telepohone at 1-800-772-6270 - weekdays from 5:00 a.m. to 5:00 p.m. Mountain Time.

Work with law enforcement.

Law enforcement should be considered your friend, not your adversary. Law enforcement agencies offer valuable programs to combat identity theft. Take advantage of the help offered by the experts in this area.

Take advantage of existing technology to safeguard electronic information.

Use firewalls, adware/spyware detection software, virus protection software, and other tools to prevent hackers and other criminals from getting into your internal computer system to rip off information. Don't forget that you can be hacked both internally or externally, and use passwords for gaining access to your computer system. When employees leave or are fired, end their access promptly. Be careful sending information in emails and use encryption when necessary. 

Select only contractors and business partners who adhere to acceptable ethical standards in sharing customer information.

If you know a contractor or vendor is going to sell your customer's information, find another vendor or business partner. Steer clear of businesses that fail to use technology to safeguard information or who have been poor stewards of information in the past. Caveat: The mere fact that a business has had information stolen in the past does not necessarily mean that they are a bad keeper of customer information. Just as with individuals, it's possible for scrupulous companies to simply have bad luck. 

Develop a privacy policy.

Develop and disseminate a privacy policy so that employees of your business know exactly what is expected of them with regards to personal information, and your customers know up front how their personal information will be treated. Redistribute this policy periodically, and train employees, if necessary. 

Keep sensitive customer information in locked offices, desks and cabinets. Don't make yourself an easy target for an enterprising burglar/identity thief.

Do not neglect to properly discard electronic data.

This is often overlooked by businesses. It is every bit as important to properly dispose of electronic documents as hard copies. Hitting the "delete" button usually is not sufficient for disposing of an electronic file or document. When you dispose of hard drives, the sensitive information on them will remain and can be retrieved unless properly removed. There are enterprising criminals out there right now trolling for discarded hard drives.

It is critical that employees be trained in the steps they must take to secure information. You can consult your legal counsel about requiring employees to sign confidentiality or non-disclosure agreements. We recommend that you tell employees that if they steal someone's identity or actively assist someone else in doing that, they will be prosecuted. Also, if an employee does not need access to sensitive information to do a job, access should not be granted.

Eliminate potential problems by screening potential employees. 

You should give consideration to doing background checks on all of your employees. If you hire temporary workers, ask the agency about what they do to ensure that they are providing you with law-abiding employees. If you are unsatisfied, find someone else. 

Consider a drug testing program.

A drug testing program can help you weed out addicts whose drug habit might make them poor employees and make them more likely to steal your customer's identity. The link between identity theft and illegal drug use is well established. Many identity thieves steal identities to support illegal drug habits. When you have identified a drug user, you have also identified a prime candidate to commit identity theft. 

Before instituting such a program, it is highly recommended that you consult with legal counsel. There are also resources available from the Department of Labor.

Develop a crisis management plan.

If the identity thieves find you, don't be caught flat-footed. Have a plan of action already in place.