infosec4all.com

Estimating the real cost of identity theft might not be as easy as it first appears. As I already mentioned, without a proper definition of identity theft it is not possible to determine the extent of the crime, and in turn, without estimates of the extent of identity theft it simply impossible to estimate the real cost of the crime. Newman et al (Newman, 2006), quoting a Government Accountability Office (GAO) report from 2002, state that there is no comprehensive or agreed-upon way to estimate the economic cost of identity theft. This post will provide an overview of various costs associated with the crime and imposed on, not only industry and individuals, but also on the government. As we have seen in the previous chapter, not all businesses suffer from this crime.

Willox et al (Willox, 2002) suggest that identity theft statistics in 2002 were just a tip of the iceberg, and conservatively estimated loss of identity theft to be at least tens of billions of dollars. According to the United States Treasury Department’s own research, cyber criminals (although it is not clear what exactly is meant by this term) made more money than illegal drug traders in 2005. (Gordon, 2006) Javelin Strategy and Research report suggests that the annual cost for consumers alone reaches $52.6 million. (Van Dyke, 2005)

The following is a crude breakdown of the costs associated with identity theft.

Individuals
Identity theft victims are faced with both tangible, financial cost and intangible costs that require a lot of time to recover from. Recovery is another indicator that differentiates the real identity theft from other crimes frequently misclassified as identity theft. When credit card or paper check fraud occurs, the victim is, in the worst case scenario, responsible for the first $50 of the total financial benefit assumed by the criminal. In most cases, US banks wave this amount, leaving a victim of credit or check fraud with virtually no tangible financial responsibility. (Sullivan, 2004) Possible frustration as non-tangible cost and time spent on reporting the incident is usually minimal. The most recent identity fraud consumer report shows that 68% of victims do not incur any out-of-pocket costs (Johannes, 2006) also indicating misclassification of credit card and check frauds.

Real identity theft on the other hand is characterized by not only direct and tangible financial loss that is relatively easily recoverable and relatively insignificant compared to intangible cost related to damage to reputation, credit worthiness, possible false criminal record, and efforts on clearing one’s name and financial and criminal history from those false records. According to Javelin’s report (Johannes, 2006), in spite of 37% decline in the last 12 months, the average out-of-pocket cost an identity theft victim has to pay is $422 (other authors like Sullivan, 2006 indicate much higher amounts – up to $1,000). An earlier report (FTC, 2003) suggest up to three times higher amounts for victims of ‘new accounts and other frauds.’ Unfortunately comparison of the amounts for the various types of frauds is not possible since the numbers for credit card and check frauds are combined with the numbers for the later fraud and show average fraud amount per victim of only $750 for the last three consecutive years. Federal Trade Commission (FTC, 2003) estimates the out-of-pocket cost for victims at $5 billion annually ($3.8 billion for ‘new accounts and other frauds’).

Sadly, the out-of-pocket cost is not the part that concerns many victims. It is the time and effort, frequently unaccounted for, that when translated in monetary terms leave a more serious impact on the victims. Schneier suggests that while some of the losses are absorbed by financial institutions – credit card companies in particular – the credit-rating damage is borne by the victim. (Schneier, 2007) No effort has been made so far to try to calculate the value of time spent, both by victims and relevant organizations, on resolving the issues resulting from identity theft. The average number of 40 hours needed by consumers to resolve the fraud (Johannes, 2006) is significantly distorted by cases of credit card and check fraud that usually take only one telephone call to financial institution to report the fraud and remove any responsibility from the victim. Federal Trade Commission’s (FTC, 2003) statement that in at least one quarter of all recorded cases it took only one day to resolve the situation indicates strong presence of other misclassified frauds (e.g. credit card fraud). At least 10% of cases took more than three months to resolve according to the same report. According to another report (Newman, 2004), the recovery time is taken to another extreme – on average, it takes about 600 hours for a victim to clear the damaged credit or clear the criminal records caused by identity theft. When combined together, the number of hours spent at national level totals 300 million out of which 194 million hours was spent by individuals on resolution of ‘new accounts and other frauds’ each year.

Other intangible costs of identity theft include harassment from debt collectors, banking problems, loan rejections, utility cutoffs and even arrest for criminal offenses. (Newman, 2004) Anecdotal accounts report resident damage to victims’ reputation even many years after identity theft case has closed. In spite of claims by credit reporting agencies victim’s information continues to be passed to solicitors, credit scores contain damaging information caused by fraudsters, and victims are arrested and re-arrested for crimes they’ve never committed. (Sullivan, 2004) The same accounts also report what Newman et al (Newman, 2006) call other personal sufferings and shock of discovery that are equally disturbing but not quantifiable.

Businesses
When talking about the loss suffered by businesses, quantification proves to be even more difficult. At first sight numbers are frightening – $33 billion in 2002 according to the Federal Trade Commission. (FTC, 2003) However, big portion of this amount appears to be considered a ‘cost of doing business’ (Newman, 2005) while some costs in the case of credit card companies are picked by the merchants. (Sullivan, 2004)

Businesses in general consider two types of financial cost (Newman, 2005): hard or easily calculated, and soft, indirect costs that are much more difficult to estimate. It is not known whether the FTC number considers both. The latter cost is definitely greater and more dangerous for business. Estimates of opportunity costs do not seem to exist, but it is clear that merchants and financial sector providers pay the bulk of the cost, directly and through productivity, systems and procedures, and reputation. (Van Dyke, 2005) The crime also reduces consumer confidence in financial infrastructure, reduces corporate productivity and leads to higher costs for consumers, and compromises economic infrastructure. Another ‘soft’ cost is the fear of identity theft. This is the fastest growing barrier to online services like electronic billing (Van Dyke, 2005)

Another reason why it is impossible to estimate the cost of identity theft in the private sector is the fact that not all businesses lose money to this crime. As seen in the previous chapter, identity theft has opened a new, potentially very profitable market for various protection services providers.

Government
Government agencies do not maintain separate statistics on identity theft and only estimates come from GAO reports. (Newman, 2005) Those estimates are divided into three groups: investigation costs, prosecution costs, and corrections costs. According to an earlier report (Newman, 2004) the investigation of each case costs law enforcement between $15,000 and $25,000, but due to significant differences in the cases, those numbers must be taken with caution. The only available data on prosecution suggest that, on average, white-collar crimes cost $11,400 per case. It is not known how much identity theft prosecution averages deviate from this number. Newman also suggests that due to the lack of proper training, law enforcement is more inclined to use their limited resources on other crimes. Finally, with regard to the cost of corrections, it is only known that, on average, white collar inmates cost government $17,400 per annum, while an average probation cost is $2,900.

Other intangible government costs of identity theft suggested by Newman include national security threats, public safety threats, burdens created by illegal immigration, costs associated with introduction of national ID system, increased public paranoia, and overall decrease in confidence in benefits of the information age.

This post shows how the lack of proper definition of identity theft affects the quantification of the problem in monetary terms and time spent on recovery. We have seen that not only individuals, but businesses and governments suffer from the crime of identity theft. Exact amounts are impossible to calculate. The chapter costs of each individual real identity theft case are much higher than published averages for customers, businesses, and government. It is also clear that due to misclassification of other crimes that cost less in out of pocket expenses and take less recovery time, total damage due to identity theft is significantly lower than initially feared.

References:

Gordon, Gary R, et al, The Ongoing Critical Threats Created by Identity Fraud: An Action Plan, Journal of Economic Crime Management, Volume 4, Issue 1, Summer 2006

Federal Trade Commission (FTC), Identity Theft Victim Complaint Data – Figures and Trends on Identity Theft January 1 – December 31, 2002, Federal Trade Commission, January 22, 2003

Johannes, Rubina, et al, 2006 Identity Fraud Survey Report, Javelin Strategy and Research, January 2006

Newman, Graeme R., Identity Theft, U.S. Department of Justice, Office of Community Oriented Policing Services, June 2004

Newman, Graeme R. and Megan M. McNally, Identity Theft Literature Review, National Institute of Justice Focus Group Meeting, July 2005

Schneier, Bruce, Security Matters – Solving Identity Theft, Forbes.com, January 22, 2007, 6:00 AM ET

Sullivan, Bob, Your Evil Twin, John Wiley & Sons, Inc. 2004

Van Dyke, James, Reading behind the Lines: How Identity Fraud Really Happens, Javelin Strategy and Research, presented at Digital ID World conference in 2005
Willox, Norman A. et al, Identity Fraud: Providing a Solution, Journal of Economic Crime Management, Volume 1, Issue 1, Summer 2002