Identity theft is the fastest growing crime in the United States, according to the Federal Trade Commission (FTC). The odds of having an identity stolen are comparable to having a piece of personal property stolen—pretty amazing for a crime that was nearly nonexistent in the late 1970s. This crime has grown so rapidly that nearly every person in the United States has experienced some type of identity theft or personally knows an identity theft victim.
This challenge facing individuals and families needs to be tackled with a comprehensive personal risk management approach. Risk management is, by definition, a system for treating pure risk—identification and analysis of exposures, selection of appropriate risk management techniques to handle exposures, implementation of chosen techniques, and monitoring results.
A key step in this process is to define and analyze the loss exposure. Identity theft or fraud generally involves the taking of another's identity. Why? There are many reasons, such as to use the other person's credit or to hide the perpetrator's own identity. This first step also involves a close examination of a person's loss exposure level. For example, a person with numerous credit cards has a higher loss exposure than a person with only one credit card. Reviewing the multiple ways that identity theft occurs also facilitates the analysis of the exposure.
There is no consensus among law enforcement agencies, governmental bodies, banks, insurance companies, and security professionals concerning this burgeoning problem. Reviewing this issue from various angles with a risk management approach is essential in developing solutions. This article focuses on the identification and analysis of the identity theft loss exposure. Part two will deal with risk control techniques, and part three will discuss available insurance and protection plans, current laws, and the need for reform.
Identifying and Analyzing the Identity Theft Loss Exposure
Not only is identity theft the fastest growing crime in the United States, it is one of the fastest changing as well. Criminals keep developing new ways to steal an innocent person's identity.Statistics
The FTC conducted a 5-year study revealing that approximately 27.3 million Americans experienced identity theft during this timeframe. Javelin Strategy and Research published a survey in 2005 indicating that within the last 12 months, 9.3 million American adults were victims of identity fraud, resulting in an annual cost to the individuals, businesses, and government of $52.6 billion.
Another FTC study published in 2005 indicated a 52 percent increase in the number of identity thefts reported to this agency between 2002 and 2004. Credit card, phone, and bank fraud were some of the most common complaints. The percentage of complaints about electronic fund transfer-related identity theft more than doubled between 2002 and 2004. According to the FTC survey, victims reported $5 billion in annual out-of-pocket expenses. The survey also indicated that individual victims lost an average of $1,280 in identity theft cases. Sixty-seven percent of these victims reported that existing credit card accounts were misused, and 19 percent reported abuse of checking or savings accounts.
In July 2005, the Chubb Group of Insurance Companies released the results of its survey of 1,850 Americans, revealing that 20 percent of respondents had been victims of identity theft. Ninety-five percent reported being concerned about the possibility that someone might fraudulently impersonate them to ruin their credit, a statistic that rose almost 20 percent from 2000. In addition, 87 percent believe companies fail to adequately protect their customers' confidential information and should be required to pay to restore consumers' credit ratings.
According to a study conducted by the Identity Theft Resource Center, fraudulent charges now average more than $90,000 per name used, and the average time victims spend to clear their name is approximately 600 hours, a 250 percent increase over previous studies. In addition, victims may be unable to get jobs, buy houses, or obtain passports until the problem is resolved.
The FTC survey revealed that 51 percent of the victims knew how their personal information was obtained. Nearly 25 percent claimed that the identity theft involved lost or stolen credit cards, checkbooks, or social security cards. Many of these incidents, over 400,000 in one year alone, involved stolen mail. According to the Social Security Administration (SSA) Inspector General's analysis of their Fraud Hotline data, more than 80 percent of SSN misuse allegations arose from identity theft.
In a June 6, 2005, Dallas Morning News article, Privacy Rights Clearinghouse Director Beth Givens said that this crime has grown so rapidly that it now "passes the someone-you-know test." She indicates that "most people have been a victim or know somebody who has been a victim."
These studies indicate a crime that is spinning out of control. One of the key reasons behind this disturbing phenomenon is the stunning growth of information technology. Computers allow immediate access to records and information from a remote location. So, not only is more data available faster, but the crime can often be committed by anyone with a home computer and the thief is unlikely to be caught. The Gartner Group, a research organization, speculates that fewer than 1 in 700 identity crimes lead to a conviction.
Technology has clearly eliminated, to a large extent, an individual's privacy. Consider, for example, that over 600 US insurance companies can access a person's medical records via a central database.Loss Exposure Assessment
An individual's exposure to identity theft must be assessed to be properly handled. Individuals who allow numerous people access to their homes, such as housekeepers, gardeners, security personnel, and nannies, are particularly susceptible. Those who spend hours on the computer are also vulnerable, particularly young adults and teens who are more likely to divulge personal information over the Web. Business Week reported that one website designed for college students, with over 2.5 million users from 650 schools, posted personal information including the students' full names, hometowns, and class schedules. In fact, 35 percent of members even listed their cell numbers, which thieves can use in lieu of Social Security numbers to access personal records.
Senior citizens are also at higher risk. Numerous cases involve elderly and incapacitated persons victimized by caretakers, who are often members of their own family. One study [Welsh] indicated that a family member is the perpetrator of approximately 10 percent of all identity thefts. This same research also indicated that people in large cities are at greater risk. Also, having a common name can add to a person's vulnerability. People with family names such as Smith, Williams, and Johnson and those with common first names are at greater risk.Types of Identity Theft
There are several ways to categorize identity theft. According to the Identity Theft Resource Center, there are three major types of identity theft.
- Financial—involves the criminal's use of personal information, such as an SSN to establish new credit lines in the victim's name.
- Criminal—occurs when a thief gives the victim's personal identifying information rather than the thief's own information to law enforcement personnel. This event often results in major legal and criminal problems for the unsuspecting victim.
- Identity cloning—using the victim's information to establish a new persona for the thief. Identity cloning can also include financial and criminal identity theft.
In contrast, the Better Business Bureau delineates the types of identity theft based on what is stolen. These types include the following.
- Social Security Number (SSN)—this identifier is the most important piece of an individual's personal information because the SSN is the primary number for tracking and monitoring employment, tax reporting, and credit history.
- Credit cards—thieves steal credit cards in many ways, ranging from the stealing of a wallet to illegally gaining computer access to an unprotected card number.
- Check fraud—thieves can drain a person's checking account by stealing checks and forging the victim's signature or by developing counterfeit checks using a home computer and a state-of-the-art printer.
- Cellular telephone service—criminals can establish cellular telephone service in the victim's name and make unauthorized calls that appear to emanate from, and are charged to, that person's cell phone.
Criminals use a variety of methods to steal identities. Contrary to popular belief, the majority of identity crimes are not performed by computer pros. Instead, low tech methods are used. Some of the most common methods include the following.
- Theft of a wallet or purse—access to a checkbook alone can provide a competent thief with the means to acquire driver's licenses and birth certificates, even without having the victims' SSNs.
- Shoulder surfing—involves looking over a person's shoulder to see his/her phone credit card number and PIN, for example. More sophisticated versions utilize a video camera with a zoom lens to record the punching of the numbers. Commonly done in public places, such as train stations, and around ATM machines.
- Postal theft—Many house mailboxes contain small red flags that, when raised, tell the postal worker that there is outgoing mail. They also serve as a dangerous invitation to criminals to abscond with the victim's mail. Thieves often look for the unsuspecting person's written checks and then perform a process known as "check washing," where the name of the payee and the check amount are removed and the check rewritten to the thief. Incoming mail to standard residential mailboxes is also at risk, since thieves can steal boxes of checks and credit card bills. These types of records allow criminals to easily gain control over a person's accounts and assume his or her identity.
- Dumpster diving—involves a criminal foraging through trash bins and dumpsters looking for unshredded credit card and loan applications, canceled checks, and documents containing SSNs. Simply changing the address on a credit card application can result in in a treasure trove for the thief and often takes weeks or months for the unsuspecting individual to realize what happened.
- Skimming—criminals may utilize skimmers, which are devices that read the magnetized strip from a credit card or bank card for account numbers, balances, and verification codes. The thief, such as a sales clerk or waitperson, first reads the credit card through the regular card reader and then through the skimmer without the customer's knowledge. This data is later downloaded onto the thief's personal computer.
- Accessing computer records—Personal identification information is increasingly accessible through the Internet as more people conduct transactions via computer. Internet-based companies do not always properly secure or encrypt this vital information. In many cases, dishonest employees gain access to this information for illegal purposes, especially employees of financial institutions.
"Hacking" is also becoming a more common technique used to commit identity theft. A hacker can easily slip by security and password barriers to access a server where all types of personal information can be copied. On June 18, 2005, MasterCard International reported that more than 40 million credit card accounts of all brands were exposed to fraud through a computer security breach, perhaps the largest case of stolen consumer data at that time. According to the Privacy Rights Clearinghouse, other companies and universities have exposed personal information about clients or students to thieves. Some of the breach incidents besides hacking include lost backup tapes, passwords compromised, stolen laptops and desktop computers, and dishonest insider actions. The Dallas Morning News reported that during the first half of 2005, nearly 50 companies or universities announced cases of mass exposure of financial information, resulting in an estimated 50 million identities compromised. This stolen information is then often sold.
"Phishing" is a more recent phenomenon in the cyber crime arena. With this scam, identity thieves attempt to make Internet users believe they are receiving legitimate emails or are connected to a secure website when in fact they are not. Banks customers are frequent targets. The latest phishing mutation, "pharming," is an even greater threat. Pharming is basically domain spoofing, where a bogus website looks like a legitimate one. Accessed from email or a fake link, these counterfeit sites request identification information which the unsuspecting victim enters believing it to be safe.
And finally, one of the most common—but commonly overlooked—identity theft villain is a member of the victim's own family. Dishonest family members rely on the premise that they will not get caught, and if they do, they believe the affected family member will not press charges. In many cases, this is a correct assumption. Tragically, these thieves often steal the identity or financial information from the most vulnerable in their families, such as elderly parents or grandparents.
See Part 2 and Part 3 of this article.
Allen, George B. The Fraud Identification Handbook. 1st ed. Highlands Ranch, Colorado: Preventive Press, 1999, p. 57.
Arata, Michael. Preventing Identity Theft for Dummies. Hoboken, New Jersey: Wiley Publishing, 2004, p. 107.
Augstums, Ieva. "Demand for Stolen Data Puts Risk in Every Swipe." Dallas Morning News, June 23, 2005: 1A, 2A.
Better Business Bureau. Identity Theft. 2004. Available from URL: www.bbb.org [June 18, 2005].
Beucke, Dan and Jessica Thacher. "The Young are Wide Open for Cyber Thieves." Business Week, no. 3935 (May 30, 2005).
Claimsguide.com. "Survey: One in Five Americans Have Been Victims of Identity Fraud." July 2005. Available from URL: http://www.claimsguides.com [July 11, 2005].
Dash, Eric and Tom Zeller Jr. "Millions of Credit Cards at Risk of Fraud." New York Times, June 18, 2005: 1A.
Federal Trade Commission. "FTC Releases Survey of Identity Theft in US 27.3 Million Victims in Past 5 Years, Billions in Losses for Businesses and Consumers." Sept. 2003. [June 12, 2005].
Federal Trade Commission. National and State Trends in Fraud and Identity Theft: January-December, 2004. Feb. 2005. Available from URL: http://www.ftc.gov [June 12, 2005].
Frank, Mari J. From Victim to Victor. Laguna Niguel, California: Porpoise Press, 1998.
Garmhausen, Steve. "As Phishers Refocus, Small Banks Regroup." American Banker 170 (May 3, 2005): 84.
Harrison, Crayton. "By Hooks or Crooks." Dallas Morning News, June 6, 2005: 1D.
Identity Theft Resource Center. Identity Theft: The Aftermath 2003. Sept. 2003. Available from URL: http://www.idtheftcenter.org/ [June 15, 2005].
International Risk Management Institute. Glossary of Insurance and Risk Management Terms. 9th ed. Dallas, Texas: 2004.
Javelin Strategy and Research. 2005 Identity Fraud Survey Report. Jan. 2005.
Jones, Karen. "Pharming Your Identity." PC Magazine 24 (May 8, 2005): 20.
Levy, Steven and Brad Stone. "Grand Theft Identity." Newsweek CXLVI (July 4, 2005):1.
Lewis, Peter. "Taking a Bite Out of Identity Theft." Fortune. 151 (May 2, 2005): 9.
May, Johnny. Johnny May's Guide to Preventing Identity Theft. Bloomfield Hills, Michigan: Security Resources Unlimited, LLC, 2004.
Privacy Rights Clearinghouse. "Fact Sheet 17: Reducing the Risk of Identity Theft." San Diego, California: Privacy Rights Clearinghouse, 2003.
Silver Lake Editors. Identity Theft. 1st ed. Los Angeles: Silver Lake Editors, 2004.
Weisman, Steve. 50 Ways to Protect Your Identity and Your Credit. Upper Saddle River, New Jersey: Prentice Hall, 2005.
Welsh, Amanda. The Identity Theft Protection Guide. New York: St. Martin's Griffin, 2004.