Identity Theft Not Down, It's Different, Expert Says

Javelin Strategy and Research, an independent research group, this week released a new report -- funded by Visa, Wells Fargo and Checkfree -- that found that in 2006, 8.4 million Americans were hit by identity fraud, a full half a million fewer than in 2005. The study, based on a phone survey of 5,000 American adults, found the total amount lost to identity theft fell 12%, from
$55.7 billion to $49.3 billion.

The study was widely reported in the media yesterday -- AP, Reuters, and UPI. But Chris Hoofnagle, an expert in data privacy laws who is also an attorney at the Berkeley Center for Law and Technology, says the study is dead wrong, both in its methodology and its conclusions.

Public polling on identity theft completely misses the biggest modern fraud issue–synthetic identity theft. In synthetic cases, the impostor creates an entirely new identity using information from many different victims. Since this synthetic identity is based on some real information, and sometimes upon artfully created credit histories, it can be used to apply for new credit accounts. This harms consumers because it creates subfiles at the CRAs, and the real owner of the SSN is sometimes targeted by collections efforts.[...]

Hoofnagle also argues that the survey -- which found that more than half of identity theft is perpetrated by a friend or family member -- is skewed because it undercounts identity theft that happens by remote attackers.

First, victims are obviously more likely to know the identity of the victim when it is a family member/friend. They’re much less likely to know when someone far away from them committed the crime (such as the many well documented cases of outsourced data being sold to thieves). Second, existing studies of confirmed victim studies (from police reports and newspaper reports, such as Collins’ report in 2004) shows that the most likely source of data is businesses. Similarly, internal analyses written by the business community itself estimates that identity theft finds its roots in business databases 50-70% of the time. Finally, even if risk behaviors are consistent between the known and unknown victims, certain threats (such as security breaches, outsourcing risk, etc) are not addressed by any consumer action. That is, you are just as likely to become a victim, regardless of whether you shred, etc.

The FTC rejects Javelin's findings as "misleading:" In an email to Wall Street Journal reporter Robin Sidel, obtained under the Freedom of Information Act concerning the Javelin Report, an FTC employee wrote: "Since most surveyed–74 percent–could not identify the person who stole their identity, and half the 26 percent who could identify the thief either didn't personally know the thief or said it was someone other than a friend or relative, it would be misleading to suggest that the 'Culprit is likely a friend or relative.'"

A free copy of the short copy of the report can be downloaded here after you are asked for identifying information.

Photo: David Goehring