One of the things I have learned writing this blog is that I have no power to predict which topics and posts are going to be popular. Sometimes I write what I think is an insightful and even controversial post and it gets five ho-hum comments and no links. Then I write what I think is a forgettable few paragraphs on a unimportant topic and next thing I know there are 30 impassioned comments and links to it all over the web.
My post last week on LifeLock’s legal woes fell into the surprisingly popular category. I thought it was a modestly interesting wrinkle on a rather unexciting topic. I didn’t understand what a hot button identity theft is for some, and what a great business it is for others.
Controversy and money is a combination I can’t stay away from, so I decided I needed to learn more about identity theft. It hasn’t been going that well. It seems the more I read the more confused the picture gets and even answers to some basic questions become more murky and ambiguous the more I dig.
For illustration, here’s a paragraph of background info I found at the end of a LifeLock press release:
The Federal Trade Commission reports that this fast growing crime [identity theft] is costing Americans more than $1.8 billion annually, and that complaints have risen 50% from 2007 to 2008. Since 2000, identity theft complaints filed with the Federal Trade Commission have gone from 230,000 to 1.2 million, a 422% increase in nine years.
That seems like a fairly ordinary and factual pair of sentences. A person who did not, as I do, live by the motto trust no one and check the math might happily accept the figures and move on. I just can’t. It’s like a compulsive disorder. Let’s examine those numbers.
When I started looking into this, in a rare moment of optimism, I thought I would soon find a definitive and believable number for the total annual cost of identity theft in the US. It seems like such a basic thing. But estimates are all over the place. The FTC came up with a figure of $47.6 Billion for 2003 and then in later survey $15.6 Billion for 2006. They blamed this difference on differing survey methodology, specifically cautioning against concluding that identity theft had become less of a problem between 2003 and 2006 and ignoring the more obvious conclusion that their numbers are just wildly inaccurate.
And the $1.8 Billion figure? The only mention of that number in the FTC’s latest report refers to the total cost to consumers of "fraud", a category that does not include identity theft. Interestingly, although the report is full of statistics on identity theft, it has no estimate for its cost, either to consumers or to the economy as a whole.
230,000 to 1.2 million, a 422% increase
Again, those numbers are in the FTC report, but they don’t refer to what LifeLock says they do. Since 2000 the FTC has been building the Consumer Sentinel Network complaint database, of which they are obviously proud. For 2008 it gathered 1.2 million complaints, but only 26% of those were identity theft complaints.
And it is not, to say the least, clear that the 422% increase in the size of this database is indicative of an increase in crime. The CSN is an aggregation of many data sources that have been added over the years. In context, I suspect that the increase in the size of the database reflects only that the FTC has been bringing in more data. If nothing else, I think it is reasonable to assume that if they believed that the types of crime they were tracking had grown more than four-fold in the past seven years they would have mentioned it in the report. They didn’t, although they made a nice chart of the growth of the size of the database over that period.
So how many consumers suffer identity theft in a year?
This might be the most basic of questions. The recent FTC report, based on consumer complaints, counted 318,000 for 2008. In any reasonable context, that’s a pretty big number. According to the Justice Department, it’s in the same ballpark as the number of robberies (445,125 in 2007) and about a third of the number of stolen cars (1,095,769).
But in the unreasonable context of LifeLock and the identity theft paranoia, that number is rather small. It’s only about a 0.1% of the population, orders of magnitude less than what is commonly asserted. Even the FTC’s 2003 and 2006 studies (which were based on phone surveys) pegged the percentage of Americans suffering identity theft at 4.6% and 3.7% respectively.
So which is it, hundreds of thousands or millions per year? The only honest answer is that I don’t really know. But I’m leaning towards hundreds of thousands. I think there are more stolen cars. Stealing cars is easier, more profitable, and not a federal crime.
And there is a whole tribe of companies and people, led by LifeLock but including Suze Orman, countless experts, and even FTC bureaucrats, who stand to benefit from pumping up the identity theft numbers and the fear that goes with them. Nobody is going to benefit from talking the hysteria down, so on balance I am going to assume that the public perception of the danger is exaggerated.
[Photo: Michael J Gogulski. His somewhat disturbing blog.]