Identity Theft: The Aftermath 2007 Conducted by the Identity Theft Resource Center® (ITRC) With comparisons to The Aftermath 2003, 2004, 2005, 2006 Surveys Original data analyzed by: Linda Foley, Sheila Gordon, and ITRC staff Final Summary: Co-written by the ITRC staff Commentaries: James Leei and Charlie Nelsonii Policy makers and law enforcement are hereby permitted to use this survey for legislative and educational purposes. This project was supported by Grant No. 2007-VF-GX-K038 awarded by the Office for Victims of Crime, Office of Justice Programs, U.S. Department of Justice. Points of view in this document are those of the ITRC and do not necessarily represent the official position or policies of the U.S. Department of Justice Identity Theft: The Aftermath 2007 With comparisons to The Aftermath 2003, 2004, 2005, and 2006 studies EXECUTIVE SUMMARY Since 2003, the Identity Theft Resource Center® (ITRC) has conducted annual victimization surveys to study the impact of identity theft crimes on its victims. iii The primary purpose of these studies is to identify what the impact of identity theft is to the victim. This year, now that we have five years of information, we are able to analyze the data, draw some conclusions, map trends and itemize areas for further research. While the numbers are expressed as percentages, it is critical that we remember these numbers are people. These are people with lives that have been interrupted, altered, torn apart and/or impacted for years to come. They are people with feelings and emotions whose outlook on life and interactions with others may change due to the invasive nature of this crime. This study reflects only the experiences of confirmed identity theft victims who worked with the ITRC, and is not a census or general population-based study. It should be noted the responses were given at the time victims responded to the survey. Therefore, it does not distinguish between those who are still being affected from those who are not. Thus, certain measures of victimization represent conservative estimates since the assessment was limited to the ending date of the study. The following are highlights of The Aftermath 2007 study. Tables and additional data can be found in the full report, where indicated. • Prevalence of Types of Identity Theft Crimes: The “unlawful use of personal identifying information” for only financial identity theft crimes was reported by 78% of the respondents. 2% reported criminal cases only, and 2% reported governmental issues only. The rest were combination cases: financial and criminal (7%), financial and governmental (9%), and a combination of all three types were reported by 3% of those surveyed. (Tables 1A and 1B) • Uses of victim information: More than one-half (57%) of the 2007 sample reported their personal information had been used to open a new line of credit in their name. 13% of all respondents noted their information was used for obtaining new cable and/or utility services. (Table 2) Additionally, check fraud and debit card fraud is increasing. While this may indicate changes due to the sampling taken, for two years ITRC has predicted that criminals will turn to other types of identity theft when it becomes more difficult to open new lines of credit. After The Aftermath 2008, ITRC will be able to draw more definitive conclusions about new trends. • Non-financial forms of identity theft: In 2007, 62% of respondents reported thieves had committed financial crimes that resulted in warrants being issued in the victim’s name, more than 2 ½ times higher than in 2006 and double the amount from 2004. All areas of criminal identity theft combined with other issues increased between 2006 and 2007. It should be noted that identity thieves continued to obtain government assistance and benefits using the victim’s information. (Table 4) Page 2 of 37 Identity Theft: The Aftermath 2007, ©May 2008, Identity Theft Resource Center®, www.idtheftcenter.org • Sources of Stolen Information: With a five-year history to study, it is clear that according to the respondents about 1/3 of cases were started by a person known to the victim. The next highest category of identity theft originated from a lost/ stolen wallet or PDA. Scams became more of a problem for victims in 2007 than previous years. Identity theft due to mail theft and theft of information from a burglary of car or home has dropped in the past few years. (Table 5) • Moment of Discovery: In 2007, 82% of victims found out about the identity theft through an adverse action compared to 76% in 2006. Ways listed included: creditor demanded payment on a late bill, contacted by collection agency, noticed missing funds from bank account, denied credit or a loan, law enforcement notification, someone I know saw bills or other evidence of a crime. Only 10% of respondents found out about the crime due to proactive measures taken by businesses and 8% saw something unusual on their credit report. 42% reported that they found out within the first three months of the crime. One analyst believes that people found out more quickly because of the more aggressive nature of collection efforts and the tightening of the credit market. (Table 8) • Costs to Victim: Respondents in 2007 spent an average of $550.39 dollars in out-of-pocket expenses for damage done to an existing account. These expenses include: postage, photocopying, purchasing police reports, travel, buying court records, and childcare. In reference to new accounts, respondents spent an average of $1,865.27 compared to $1,342 in 2006. • Cost to Business: In 2007, the average loss in goods and services to businesses, as reported by survey respondents, was $48,941.11 compared to $87,303 in 2006. Six individuals exceeded $100,000, with one in excess of $700,000. This study only includes respondents who contacted the ITRC in 2007 and is not necessarily indicative of a national business loss average. • Victim Hours Repairing Damage: In The Aftermath 2007, victims reported spending an average of 116 hours repairing the damage done by identity theft to an existing account used or taken over by the thief. Answers included 6,000, 8,640, and 5 years of time (outliers). In cases where a new account was created, respondents reported an average of 157.87 hours to clean up the mess with outliers of “endless” and “too many to count.” • Extended involvement: In 2007, 70% of victims indicated that it took up to 12 months to clear issues of all misinformation, compared to 50% in 2006. A moderate amount of victims (12%) stated one to two years. Unfortunately, another 19% indicated that it took two or more years to resolve their case. In studying the four year history it appears to be that identity theft victims are resolving cases faster and may be spending less periods of time to become whole again. (Table 9) • Response by Creditors, Utilities and Collection Agencies: As in previous years, credit issuers, utility companies and collection agencies continue to rate poorly in their handling of identity theft victims. • Inability to Clear Negative Records: Credit agencies, either by putting negative information back in records (31%) or not removing it in the first place (32%), topped the list of reasons for victims’ inability to clear their records. Other prominent responses include Social Security Number tied to another person’s file (22%) and victims’ fraud alerts ignored (19%). An increase was also seen in the sale of credit accounts even though the fraudulent account was cleared by the creditor and the inability to get proof even with a police report. (Table 11) Page 3 of 37 Identity Theft: The Aftermath 2007, ©May 2008, Identity Theft Resource Center®, www.idtheftcenter.org • Unexpected secondary effects: Victims reported a number of additional problems including: higher insurance rates, current credit card interest rate increased and criminal records not cleared. The inability to get credit resonated with the majority of respondents (64%). In addition, 36% reported an increase in credit card rates, 53% have collection agencies still calling, 27% had credit cards cancelled (even though the accounts were being properly maintained), 18% said it affected their ability to get a job, and 14% reported tenancy issues. (Table 10) • Relationship of Imposter to Victim: It is important to note that a large percentage of respondents seem to have been victimized by those who may have easy access to personal identifying information including friends, family members, ex-spouses/significant other, or those in close contact with the victim, such as co-workers. (Table 7) • About the Imposter: Of those respondents who knew something about their imposter, many reported their thief has committed other crimes, experienced financial difficulties, have or are dealing with addictions, and may have committed identity theft against other family members. (Table 6) • Child Identity Theft: In 2007, 47% of this special case group reported that one, both, or a step parent was the thief. Another 12% reported that it was another family member. 18% said that the person had access to information but is not related and 24% did not know how the case first began. (Question 26) The age of the victim when the crime FIRST began varied with 18% under five years old. It should be noted that the crime may have been discovered years later. • Victim Response to Family or Child Identity Theft: Throughout the five year range, we have seen spikes in categories such as family supports victim in trying to force responsibility on the thief (2004). In addition, “the family will turn against the victim if action taken” noticeably decreased from 15% (2005) to 6% (2006) and then increased to 18% in 2007. Family support does appear to be increasing, yet some families are torn or still in denial or want the victim to drop the case. Victims are also torn about filing a police report. Since respondents could answer multiple times, it appears that family support is critical to the outcome of the case. (Table 16) • Emotional Impact: Few significant positive changes have occurred in the feelings of victims and in terms of reported victim symptomology. More than 49% of the respondents reported stressed family life, 22% felt betrayed by unsupportive family members and friends, and 23% said their family didn’t understand. (Table 17) The strongest feelings expressed were: rage or anger, betrayal, unprotected by police, personal financial fears, sense of powerlessness, sense they were grieving, annoyed, frustrated, exhausted, sleep disturbances, an inability to trust people, and the desire to give up and stop fighting the system. ITRC long term emotional responses included: 8% felt suicidal, 19% feeling captive, 29% ready to give up and 10% felt that they have lost everything. (Table 18) PRELIMINARY CONCLUSIONS OF THIS STUDY This study clearly indicates a need for research on various topics including family identity theft, long-term emotional impacts of this crime on victims, child identity theft, and the criminal elements involved in identity theft. Page 4 of 37 Identity Theft: The Aftermath 2007, ©May 2008, Identity Theft Resource Center®, www.idtheftcenter.org Identity Theft: The Aftermath 2007 TABLE OF CONTENTS Page # 1. Introduction .................................................................................................................... 6 2. Findings .......................................................................................................................... 6 A. Victim Location .................................................................................................... 6 B. Type of Crime ....................................................................................................... 7 C. Financial Identity Theft ........................................................................................ 8 D. Criminal, Government Issues and Cloning Identity Theft ................................. 11 E. Sources of Stolen Information ............................................................................ 12 F. About the Identity Thief ..................................................................................... 13 G. Moment of Discovery ........................................................................................ 15 H. Long-Term Cost/Time Victim Impact ................................................................ 16 I. Cost to Business ................................................................................................. 18 J. Other Effects of the Crime- Secondary Wounding ............................................ 18 K. Victims’ Experiences with Organizations – Resolving residual effects ........... 21 L. Special Identity Theft Cases ............................................................................... 24 M. Emotional Impact on Victims ............................................................................. 26 N. Consumer Behaviors… ...................................................................................... 29 3. Final Comments- From the Victims ............................................................................. 31 4. Methodology ................................................................................................................. 36 5. Endnotes ....................................................................................................................... 36 Page 5 of 37 Identity Theft: The Aftermath 2007, ©May 2008, Identity Theft Resource Center®, www.idtheftcenter.org 1. INTRODUCTION All respondents to this survey were confirmed as identity theft victims by ITRC victim advisors. It is important to remember that this survey is not a census survey; rather it reflects the victim pool that responded to the survey invitation. This may skew results due to the populations that ITRC serves. This report, designed to summarize the findings of the survey, is potentially useful for educational outreach, policymakers and law enforcement, and ultimately for identity theft victims and the public at large. While other studies look at demographics, definitions of identity theft and other issues, The Aftermath focuses on the issues facing victims. Learning more about identity theft victimization and the experiences of the victims themselves are priorities of the U.S. Department of Justice, legislators and business associations. All agree that victimization issues are an important component to understanding the broad phenomenon of identity theft. In addition, consumer response to those who fail to authenticate identities (giving thieves credit using the victim’s info) is becoming ever stronger. Victim resolution and consumer trust are concerns since they affect the economy and the well-being of our citizens. This report compares patterns from the 2003 through 2007 ITRC Aftermath Surveys of identity theft victims to help readers understand identity theft. According to James Lee, Founder and Principal of C2M2 Associates, a business consulting group: “While the general trends show reason for optimism, such as the drop in the average cost per person and the increase in how soon victims learn of a theft, there are still many opportunities for improvement. The data also reflects the trends noted elsewhere in that identity criminals are a crafty lot who tend to shift their tactics in response to new or improved protections adopted by people and businesses. The increase in the number of verified crimes attributable to the Internet and workplace are perfect illustrations of this fact. As businesses hardened access to their networks, ID criminals shifted to the use of on-line phishing and pharming scams to gather the information they needed to commit their crime of choice. Workplace theft also reflects this trend as most insiders realize the value of the information to which they have ready access.” Finally, while the numbers are in terms of percentages in most cases, it is crucial to remember these reflect people: People with lives that have been interrupted, altered, torn apart and/or impacted for years to come. They are people with feelings and emotions whose outlook on life and interactions with others may change due to the nature of this crime. 2. FINDINGS A. Population of Respondents: Crime Location and Age when Crime First Began Victims responded from approximately 70% of the 50 states, plus the District of Columbia and U.S. territories. They represented the victim population that contacted the ITRC during the 2007 calendar year. The area the victim lives in is not to be misconstrued as the location of the crime. Regarding where their personal information was eventually used, many victims reported that their case was multi-jurisdictional in nature, crossing county and state lines. The age range of the victim when the crime first began: under 18 (4%), between 18-29 (28%), 30-39 (26%), 40-49 (24%), 50-60 (11%), and 61+ (7%). These numbers are similar with FTC complaint report. Page 6 of 37 Identity Theft: The Aftermath 2007, ©May 2008, Identity Theft Resource Center®, www.idtheftcenter.org Additionally, two people were deceased when the crime began (reported by executor of estate or loved one), 8 became a victim due to a scam, 45 strongly believed their case started due to a security breach, 17 people tied their case to a lost or stolen wallet, and 44 victims personally knew the imposter. B. Type of Identity Theft Respondents were asked what types of identity theft they experienced. Financial identity theft continues to be the most prevalent form of identity theft. (Table 1B) Financial: Creating new accounts which may include credit, utilities, checking accounts, as well as account takeover. Financial situations also included debit cards, utilities and/or collection issues. Criminal: Providing someone else’s name to law enforcement to avoid arrest or tickets in the criminal’s own true name. Governmental: Includes getting employment, IRS, driver’s license, welfare and other government benefits. The “unlawful use of personal identifying information” for only financial identity theft crimes was reported by 78% of the respondents. Criminal cases only represent 2%, and another 2% reported governmental issues only. The rest were combination cases: financial and criminal (7%), financial and governmental (9%), and a combination of all three types were reported by 3% of those surveyed. It is clear that thieves are using a combination of crimes to commit identity theft. An example would be the theft or creation of a birth certificate, obtain a job, and open credit cards all by using the Social Security Number of the victim. Part of this may be due to the fact that credit issuers and employers are beginning to ask to see authentication documents, forcing imposters to create, buy, or steal identifying documents. Table 1A. Reported Types of Crime Table 1B. 2007 only 2007 Aftermath 80 70 60 2007 50 2006 40 2005 30 Financial only 20 2004 Criminal only 10 2003 Gvt. Only 0 Financial/Criminal F Cr Cl F/Cr F/Cl All GI Fin/Gvt Issues All All numbers are percentages F= Financial Cr= Criminal Cl= Cloning GI= Governmental Issues All = all types involved In previous years, the ITRC used different definitions for some of elements used in this Table 1A. Therefore, you will see no statistical data for financial/cloning or “all” reported for 2006 or 2007. Governmental Issues (GI) was a new category added in 2006. Page 7 of 37 Identity Theft: The Aftermath 2007, ©May 2008, Identity Theft Resource Center®, www.idtheftcenter.org C. Financial Identity Theft Given the nature of identity theft, it makes it easy for perpetrators to use or attempt to use the victims’ identities in a variety of methods. Respondents were therefore asked to indicate the ways in which the identity thief had used their personal data. More than one-half (57%) of the 2007 sample reported their personal information had been used to open a new line credit in their name. 13% of all respondents reported their information was used for obtaining new cable and/or utility services. These numbers along with those for new cellular service, obtaining loans, renting an apartment or buying home, and car notes have decreased in the last several years. (Table 2) Consistently over the last few years it appears that there are more charges made on credit or debit cards in the victim’s possession than on stolen cards. This may be due to the fact that a consumer is not aware the card was skimmed until the monthly statement arrives. Categories which showed distinct increases include: • Changing names/addresses on existing credit accounts • Opening new checking or savings accounts • Takeover of existing checking accounts via theft or check washing • Opening new Internet service • Obtaining a student loan • Accessing the victim’s online banking account While mortgage fraud is not highly reported on the ITRC 2007 Aftermath, according to the FBI’s 2007 Mortgage Fraud Report (2008), this type of crime is on the rise, increasing 176%.iv These are two conclusions that can be made with this information: 1. The areas where the numbers have decreased are those with beefed up authentication and security protocols. 2. Areas where increases have occurred could indicate that criminals are turning to these areas as being more lucrative, or that these industries may not yet have put into action strict enough protocols to prevent such occurrences. Increases in criminal activity also were noted. Table 2. Use of Victim’s Identity (choose all that apply) USE 2007 2006 2005 2004 2003 New credit account in victim’s name 57% 60% 59% 66% 63.50% Get new cell phone 16% 30% NA 27.90% 32.0% Charges on a stolen credit card/debit card 15%** 16% 13% 8.1% without PINS Charges on victim’s card still in their 22% 27.0% 26.0% 26.9% 23.2% possession Page 8 of 37 Identity Theft: The Aftermath 2007, ©May 2008, Identity Theft Resource Center®, www.idtheftcenter.org Charges over Internet 25% 28.0% 15.0% 21.8% 19.9% New home phone * 29.0% NA 18.8% 12.7% Get new cable/utility 13% 29.0% 26.0% 18.3% 9.4% Name/change address on existing credit 29% 18.0% 14.0% 15.2% N/A account Obtained auto loan/car purchase as victim 4% 8.0% 7.0% 12.7% 9.9% Other Loans 15% 17.0% 6.0% 12.7% 17.7% Open new checking or savings account 16% 12.0% 7.0% 11.7% 16.6% Create checks with false account info 12% 12.0% 14.0% 11.7% 16.6% Takeover existing checking via theft/ 12% 9.0% 12.0% 10.7% 16.0% washing Got apartment or home as victim 8% 11.0% 13.0% 10.7% 8.8% Open internet 10% 7.0% 5.0% 9.1% 8.3% Charges made on stolen card/debit cards 15%** 16.0% 13.0% 8.1% N/A without PINS Mortgage or 2nd mortgage as victim 5% 3.0% 5.0% 7.1% 5.0% Takeover/add service to existing cellular 4% 8.0% NA 7.1% 6.1% account Access victim’s online banking account 11% 9.0% 11.0% 5.1% 4.4% Takeover/add service to existing 5% 7.0% 4.0% 3.6% 2.2% cable/utility Takeover/add service to existing home * 7.0% NA 3.0% 5.0% phone Student loan 15% N/A 2.0% 3.0% 2.2% Rent/Lease car using victim’s info 2% 8.0% NA 1.5% N/A Filed bankruptcy under victim’s info 0% 2.0% 3.0% 1.0% 3.3% Business loan N/A N/A 1.0% 1.0% 6.1% Other N/A N/A 25.0% 15.2% N/A * home phone was combined with energy or utility in 2007 ** Debit cards without PINS added -2007 Page 9 of 37 Identity Theft: The Aftermath 2007, ©May 2008, Identity Theft Resource Center®, www.idtheftcenter.org Analyst James Lee noted: “The gaping hole in the safety net continues to be the credit granting process where ID thieves are still able in significant numbers to by- pass internal corporate safeguards and external measures such as credit alerts placed by individuals to fraudulently obtain legitimate credit in the names of unsuspecting people. This comes despite sizable investments by the business community to improve their products, processes and procedures to make it more difficult for personal information to fall into the hands of criminals or other people who would misuse the most precious possession a person has – their good name. It is clear that credit alerts are not always an effective deterrent to ID crimes. However, it will be interesting to see in future years the impact of credit freezes on the ability of criminals to open new credit accounts. Research and experience by other organizations indicate a relatively low level of acceptance and understanding of the benefits of a freeze by individuals. This is an area ripe for exploration by progressive financial service providers and the consumer reporting agencies.” Credit Cards: Victims who reported fraudulent new credit cards were asked if they knew the total number of credit cards granted using their personal information (Table 3). In 2007, 55% of the respondents reported that 1 – 3 cards were opened fraudulently, a significant increase from 29% in The Aftermath 2006. This category has remained the highest ranking category for the past 3 years. There was a slight increase in the prevention of new credit cards being issued in 2007, still representing a significant decrease from 2004 and 2003. It is not known why imposters seem to stop at 3 credit cards, nor why so many people still have cards opened fraudulently using their personal information. ITRC could speculate that perhaps the fraud alerts were not observed, had expired, or that the fraud alerts were not in place yet due to the fact that the victim did not know of any identity theft activity until much later. Table 3. Number of Fraudulent New Credit Cards Issued NUMBER OF 2007* 2006 2005 2004 2003 CARDS 0 18% 15.0% N/A 46.2% 48.6% 1-3 55% 29.0% 66.0% 27.4% 17.7% 4-6 16% 20.0% 20.0% 11.7% 14.9% 7-10 7% 4.0% 6.0% 10.2% 8.3% 11-15 1% 0.0% 2.0% 2.0% 2.8% 16-20 0% 0.0% 0.0% 1.5% 2.2% 21 or more 0% 0.0% 4.0% 1.0% 5.5% * two people responded in a way that could not be counted Page 10 of 37 Identity Theft: The Aftermath 2007, ©May 2008, Identity Theft Resource Center®, www.idtheftcenter.org