Protecting Your Employees from Identity Theft
Gary Clayton | February 14, 2004
Theft of information by employees is the top cause of identity fraud. Conducting an audit of how personnel information is stored and used can reveal gaps in controls.
Picture an identity thief. What image comes to mind? When asked to visualize identity theft in action, many people tend to think of a mischievous hacker trying to break into a server full of customer information, or an evil criminal lurking by the dumpster just waiting for an unshredded credit card bill or other personal document to come their way.
Surprising to many, identity theft as the result of employee information stolen in the workplace by a fellow employee is a much more likely case. Information collected through job applications, maintained in personnel files, or used to administer healthcare benefits is more susceptible to theft then information provided by customers to purchase products and services. In the mad scramble to ensure customer information affecting the bottom line is secured, properly guarding employee data sources is almost an afterthought. Employee records are therefore an attractive target for thieves—who may very well work in the cubicle down the hall.
The higher risk associated with personnel data theft is beginning to be more heavily researched and documented. The Federal Trade Commission (FTC) has found that in cases of business record theft, 90 percent of cases pertain to employee information, versus 10 percent for consumer information. Additionally, a 2002 study by the credit information provider TransUnion found that the top cause of identity fraud is the theft of information by employees; outranking the theft of credit cards, purses, and other personal items.
Methods of Stealing Identities
Once inside a company, identity thieves appear to have a fairly easy time obtaining enough information about employees to rent apartments, buy cars, and apply for credit cards. And these perpetrators do not necessarily have to be in highly trusted management positions in the company to have access to information that may be very sensitive, such as Social Security numbers. Regular access to human resources computer systems and manual files provides more than enough information to complete a fraudulent credit application.
One of the most common methods to obtain access to employee data files is to seek employment as a temporary worker. These positions last just long enough to grab the data and disappear, hopefully forgotten. The applicants are unknown to the company and are given access to company systems without the background checks or other controls used in hiring permanent employees. For example, in a case in 2002, two temporary workers at Children's Hospital of Arkansas were charged with the theft of employee records. These individuals were found to be part of a larger identity theft ring.
Other perpetrators in employee data theft cases include disgruntled former employees who leave the company intending to do harm, or current employees with access to electronic and manual files that are left unsupervised for long periods of time. Even cleaning crews have been found to rummage through desks and trashcans after hours, searching for receipts, bills, and other information. Employees at third-party vendors providing services relating to the human resource function also pose a threat.
Addressing the Issue
It is the corporation's responsibility to protect employee information from thieves, as there is little that employees can do to protect their own personnel records—especially from fellow employees. And many organizations may find it in their own best interests to take precautions by establishing adequate controls. The Identity Theft Resource Center found in their 2003 study that victims of identity theft spend an average of 600 hours trying to clear their names and correct their credit reports. It is doubtful that the amount of work associated with identity theft would all be completed in nonbusiness hours. In addition, the emotional toll of having one's identity stolen provides a cumbersome distraction for workers, dealing with the frustration and personal violation felt by many victims trying to reclaim their lives.
The unsavory fallout of not protecting employee information may provide incentive for some organizations to take a closer look at their personnel data protection efforts. In addition to negative media attention, companies found to be negligent in securing employee information may be held responsible for any damages incurred through identity theft. Just recently, 14 former employees of the pharmaceutical company Ligand reached a confidential settlement after Ligand's negligence in securing personnel records led to a lab technician stealing and then selling enough personal information to lead to identity theft.
However, putting adequate protection in place for personnel data may not be optional for much longer. In response to this growing problem, as well as demands made by victim's rights groups, state governments have begun assessing the need for requirements for organizations to adequately protect their employees' data. Georgia and Wisconsin have taken the first step, requiring companies to destroy documents containing the personal information of their employees while California companies are barred from using Social Security numbers for purposes other then administrative functions or uses required by law. It is likely that over time, many more states will follow suit in their requirements for the protection of employee information.
Taking Steps To Protect
Many organizations are beginning to take notice of the issue and are finding ways to identify and correct their weaknesses. Conducting an audit of how personnel information is stored and used is a way to take a comprehensive look at gaps in controls. Just last year, the governor of Illinois requested a review of personnel information after a worker in the Human Services Division of the Illinois government stole thousands of Social Security numbers and charged hundreds of thousands of dollars in employees' names. The results of the review will be used to analyze and make changes at many of the government's agencies.
Organizations can take several other steps to protect the confidentiality of their employees' information, including the following.
- Conduct background and criminal checks on prospective employees who will have access to personal information
- Only hire temporary workers that have had background checks
- Restrict access to personal information to those employees with a business need-to-know
- Closely manage temporary workers' activities
- Provide cross-cutting shredders for employees to dispose of personal, customer, and fellow employee information
- Use numbers other than Social Security numbers to identify employees in the computer systems
- Require health plans to use numbers other than Social Security numbers to identify plan participants
- Train staff with access to personal information about keeping that information secure
- Keep personal information in locked file cabinets and password protected computer files
Appropriate system and manual file access controls in the human resources department can mitigate some of the risks posed by identity thieves. Of greater importance, the ability to quickly identify when a breach has occurred and alert those individuals whose information may have been viewed will limit the amount of damage to the victim. In the event that personnel information was compromised, immediate notification of the affected employees is crucial to minimize losses for both the employee and the organization.
Conclusion
It is of utmost importance for companies to take a proactive approach to the identity theft of their employees. Raising awareness, especially among those with access to personal information will create an environment of monitoring where employees are easily alerted to suspicious activity. An environment of awareness and procedures and proper oversight and controls in place will protect the most sensitive of employee information, which could lead to an ill-meaning party to assume their identity and do them harm.
Opinions expressed in Expert Commentary articles are those of the author and are not necessarily held by the author's employer or IRMI. Expert Commentary articles and other IRMI Online content do not purport to provide legal, accounting, or other professional advice or opinion. If such advice is needed, consult with your attorney, accountant, or other qualified adviser.
