Identity Theft and Fraud: Evaluating and Managing Risk

Chapter 6: Measuring Identity Theft and Fraud

102 “Nothing great was ever created without enthusiasm.” —Ralph Waldo Emerson Measuring identity theft and fraud is critically important if society is to make any progress in defending against it. This derives from the old axiom that you can’t manage something if you can’t measure it. However, there are many problems with determining how identity theft and fraud affects its victims in order to find a basis for measurement. These are discussed in detail, with a number of examples of statistics on reported incidence of fraud, and how this might relate to actual levels, which are often higher. More reliable measures of fraud are then reported from a variety of sources, based on overall measures and the relatively standardized categories of credit card fraud, existing accounts fraud, new accounts fraud, and others. The chapter concludes with a discussion of how to detect identity fraud, and the level of its costs to society. Problems with Measurement There are a number of problems associated with getting a measure of how identity theft and fraud are affecting its various stakeholders . The first goes back to the lack of a commonly understood definition . There have been many surveys that ask consumers if they have been victims of identity theft without providing any guidance as to what different kinds of losses, thefts or frauds should Chapter 6 Measuring Identity Theft and Fraud Measuring Identity Theft and Fraud | 103 be included in this category. If the problem is not clearly defined during the collection of data, the resulting reports are difficult to interpret and impossible to compare. To illustrate this problem, in a 2006 survey of Canadian consumers , participants were asked if they thought each of a number of different scenarios described a case of identity theft. For example , one scenario described simple credit card fraud and another described cheque fraud involving a close family member. Only 71% and 61% of participants, respectively, regarded these scenarios as cases of identity theft (Sproule and Archer 2008). Had these participants simply been asked if they had been victims of identity theft, the results would have included less than three quarters of the true number of victims of credit card fraud and less than twothirds of the true number of victims of cheque fraud involving someone close to the victim. Because of the lack of definition, if we want to include these types of frauds, the results of the survey would under report the incidence rate, and if we want to exclude them, the results would over report the incidence rate. There are also characteristics of the crime itself that hinder data collection and response. First, we can only report and measure crime after it has been detected, and there is often a significant lag between the crime and its detection. Once detected, the theft or fraud must be reported. In the study of criminology, the ‘dark figure of crime’ refers to the large number of crimes that go unreported. Businesses and other organizations often don’t report cases of identity fraud to police, but they may respond to surveys asking about the loss or theft of personal information. In a survey of Australian businesses, researchers found that in total only 9% of identity fraud events were reported to law enforcement (Lacey and Cuganesan 2004). Statistics Canada conducted a survey of fraud against businesses in 2008.1 Figure 6.1 shows results for this survey from the retailing and banking sectors. Almost half of the retailers said that they never or seldom report fraud to the police. Reports were 1 Note that these data include all frauds, not just identity fraud. 104 | Identity Theft and Fraud more common when there were significant losses. In the banking sector, frauds are more likely to be reported, with only 4% of firms stating that they rarely or never call police. Almost all the banks said that they report frauds when there are significant losses, where links to organized crime are suspected and when they want to pursue criminal charges. Figure 6.1: Percentage of Fraud Incidents Reported to Police (Adapted from Taylor-Butts and Perreault 2009) We also know that few individual victims report cases of identity fraud to police. Most victims report the identity fraud to the organization or business involved, but only 25% to 35% of victims report the incident to the police. Police reports are most common in new accounts and other frauds but still...