What's the Real Cost of Identity Theft?

Yesterday’s The New York Times (www.nytimes.com) carried an article on identity theft, which basically suggested the problem is not as important as it seems (“Surging Losses, but Few Victims”, Circuits, September 27, 2006). Since I had just written on the topic in this blog (September 22, 2006), I read it closely. The Times article largely dismissed the Federal Trade Commission study I had quoted—which found 10 million identity thefts per year at a cost of $48 billion—in favor of a recent Department of Justice report that found only 3.6 million cases costing $3.3 billion in a six month period.

Those are big differences, but neither the Times article nor other references came up with much of an explanation of where they came from or who was right. Since studies are available on line (see the National Criminal Justice Reference Service fact page at www.ncjrs.gov/spotlight/identity_theft/facts.html) I was able to look for myself.

The full analysis is too detailed to post here, although I’d be delighted to share it with anyone who wants a copy. Key points boil down to:

- Both studies rely on telephone surveys, which I suspect are inherently unreliable when asking for specific cost estimates. FTC study is particularly questionable since it had a sample of just 4,057 people, of whom just over 500 actually reported an identity theft. The DOJ study used a 42,000 sample.

- Once you adjust for differences in methodology (FTC asked about individuals over the past year, DOJ asked about households in the past six months), both studies yield approximately the same number of Americans affected. Both studies also found that just over half the cases involved fraudulent charges against existing credit card accounts.

- The estimated annual cost for identify theft against all existing accounts, credit card and other, came to around $14 billion in the FTC study and about $5 billion (after some adjustments I made on my own) in the DOJ study. Given the DOJ’s larger sample size and that the Times quoted The Nilson Report with an apparently reliable annual figure of $1.1 billion for bank credit card fraud, the DOJ estimate is probably closer to the truth.

- The really big difference between the two studies is the cost of new accounts opened using stolen personal data. Although categories in the two studies are not exactly comparable, the FTC pegged this at $33 billion per year while the DOJ figure (after my adjustments) is about $1.5 billion.

To me this says there is less disagreement than meets the eye. Both studies find about the same number of people affected and both find somewhat similar figures for fraud against existing accounts. The real discrepancy is in the cost of stolen personal data. Here it’s anybody’s guess as to whether the DOJ is undercounting or the FTC is exaggerating. But asking the right question is the first step to finding an answer, so at least we know where people who study this issue should be spending their time.