U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

82–327 PDF 2002

S. HRG. 107–728

IDENTITY THEFT: THE NATION’S FASTEST

GROWING CRIME WAVE HITS SENIORS

HEARING

BEFORE THE

SPECIAL COMMITTEE ON AGING

UNITED STATES SENATE

ONE HUNDRED SEVENTH CONGRESS

SECOND SESSION

WASHINGTON, DC

JULY 18, 2002

Serial No. 107–30

Printed for the use of the Special Committee on Aging

(

SPECIAL COMMITTEE ON AGING

JOHN B. BREAUX, Louisiana, Chairman

HARRY REID, Nevada

HERB KOHL, Wisconsin

JAMES M. JEFFORDS, Vermont

RUSSELL D. FEINGOLD, Wisconsin

RON WYDEN, Oregon

BLANCHE L. LINCOLN, Arkansas

EVAN BAYH, Indiana

THOMAS R. CARPER, Delaware

DEBBIE STABENOW, Michigan

JEAN CARNAHAN, Missouri

LARRY CRAIG, Idaho, Ranking Member

CONRAD BURNS, Montana

RICHARD SHELBY, Alabama

RICK SANTORUM, Pennsylvania

SUSAN COLLINS, Maine

MIKE ENZI, Wyoming

TIM HUTCHINSON, Arkansas

JOHN ENSIGN, Nevada

CHUCK HAGEL, Nebraska

GORDON SMITH, Oregon

MICHELLE EASTON, Staff Director

LUPE WISSEL, Ranking Member Staff Director

(II)

C O N T E N T S

Page

Opening Statement of Senator Larry E. Craig ..................................................... 1

Statement of Senator Susan Collins ...................................................................... 2

PANEL I

Lieutenant Colonel (Retired) John T. Stevens, Jr., Upper Marlboro, MD .......... 4

Alice S. Fisher, Deputy Assistant Attorney General, Criminal Division,

United States Department of Justice, Washington, DC ................................... 11

James G. Huse, Jr., Inspector General, Office of Inspector General, Social

Security Administration, Washington, DC ........................................................ 24

Howard Beales, Director, Bureau of Consumer Protection, Federal Trade

Commission, Washington, DC ............................................................................. 34

Douglas Coombs, Deputy Special Agent in Charge, Financial Crimes Division,

United States Secret Service, Washington, DC ................................................. 59

PANEL II

Mari J. Frank, Esq., Privacy and Identity Theft Consultant, Laguna Niguel,

CA .......................................................................................................................... 80

Boris F. Melnikoff, Consultant to the Regional President, American Bankers

Association (ABA), Atlanta, GA .......................................................................... 100

Stuart K. Pratt, Vice President, Government Relations, Consumer Data Industry Association, Washington, DC .................................................................. 113

Dennis Carlton, Director of Washington Operations, International Biometric

Group, LLC, Washington, DC ............................................................................. 137

(III)

(1)

IDENTITY THEFT: THE NATION’S FASTEST

GROWING CRIME WAVE HITS SENIORS

THURSDAY, JULY 18, 2002

U.S. SENATE, SPECIAL COMMITTEE ON AGING, Washington, DC.

The committee convened, pursuant to notice, at 9:30 a.m., in

room SD–192, Dirksen Senate Office Building, Hon. Larry E.

Craig, presiding.

Present: Senators Craig, Carper, and Collins.

OPENING STATEMENT OF SENATOR LARRY CRAIG

Senator CRAIG. Good morning, everyone. Thank you for being

here. Let me welcome all of you and our witnesses to today’s hearing here before the Special Committee on Aging.

First and foremost, I want to thank Senator John Breaux of Louisiana, who chairs this committee, for the opportunity to address

this most important issue. I think Senator Breaux will attempt to

join us later on, as some of our other colleagues on the Special

Committee may also.

But I do believe, and I think all of us in Congress believe, that

it is important to address the identity theft issue and the tragedy

that this besets upon our nation’s seniors. Identity theft is the nation’s fastest growing white-collar crime. It is estimated that over

700,000 Americans become victims of identity theft each year. Several thousand of those victims are senior citizens, who are uniquely

vulnerable to this insidious crime.

As you may recall, in June of last year, I held a hearing on elder

abuse. We heard testimony about crimes committed against our

most vulnerable senior citizens. Today, you will hear about a different type of crime that is on the rise.

Our nation’s seniors spend a lifetime working hard to maintain

their independence and develop a legacy that they and their families can be proud of. With one fraudulent transaction, identity theft

can strip away a senior’s independence, sense of security, and dignity. Identity theft can destroy legacies and reputations, leading to

depression and despair.

To effectively fight this crime, it is critical that law enforcement

and the private sector work together. For example, Idaho law encourages financial institutions to report suspected instances of

elder financial crime to local authorities. Banks in Idaho, in cooperation with State agencies, provide training to their employees

on how to identify and prevent financial crime targeting the elderly, including identity theft. Idaho is only one of five States to imVerDate 11-MAY-2000 13:37 Dec 09, 2002 Jkt 000000 PO 00000 Frm 00005 Fmt 6633 Sfmt 6633 C:\DOCS\82327.TXT SAGING1 PsN: SAGING1
2

plement such a program. I say ‘‘only.’’ It should be 50 States of the

Nation aggressively pursuing this relationship between the private

and the public sector.

We also need to determine how existing State and Federal efforts

might be enhanced to promote cooperative approaches in resolving

these very complex cases. Penalties should be enhanced when these

acts ruin the lives of our most vulnerable citizens. Existing Federal

resources can and should be targeted toward providing more technical training in the identification and prosecution of identity theft.

I commend the Department of Justice and other key Federal

agencies here today in their efforts to combat this crime. I support

Attorney General Ashcroft’s current aggressive nationwide sweep

to pursue and prosecute individuals engaged in identity theft, including those targeting the elderly.

Finally, I would like to announce my cosponsorship of S. 2541,

which lengthens prison sentences for those who would perpetrate

the insidious and destructive crime of identity theft.

I look forward to the testimony from our witnesses today. I also

view this as an opportunity to build a record that my colleagues

will look at and consider as they encourage their States, both private and public sector law enforcement and crime prevention, to

participate in fighting identity theft.

With that, let me invite our first panel before us. We have a

cross-section of those involved in law enforcement and the public

sector and those who have experienced this kind of situation.

Let me first introduce to the committee and to the room Lieutenant Colonel, Retired, John Stevens of Upper Marlboro, MD. John

is one of those who I understand has experienced this kind of problem in his life, so John, we look forward to your testimony. Please

proceed.

Excuse me. We will hold you off for just a second. I have just

been joined by Susan Collins of Maine, a Senator, a member of this

committee, and let me allow her to make her opening statement,

John, before we proceed with your testimony. Thank you.

Susan, welcome.

STATEMENT OF SENATOR SUSAN COLLINS

Senator Collins. Thank you very much, Senator.

Today, the Special Committee on Aging will explore the impact

of identity theft on our nation’s seniors. Identity theft is an insidious crime. Unlike many types of fraud, in which victims are enticed by deceptive claims or lured by deals that are too good to be

true, identity theft can occur when a victim is simply engaging in

everyday activities, or in other cases, by unwittingly providing confidential personal information to the wrong party. Identity thieves

use their victims’ personal identifiers and financial information to

commit bank and credit card fraud, insurance fraud, and a host of

other criminal acts.

While anyone can be the victim of identity fraud, seniors are

among the most vulnerable. The number of seniors who have become the victims of identity theft is growing rapidly. Reported incidents among those aged 60 years and older skyrocketed by a staggering 218 percent between the year 2000 and 2001, and these figVerDate 11-MAY-2000 13:37 Dec 09, 2002 Jkt 000000 PO 00000 Frm 00006 Fmt 6633 Sfmt 6633 C:\DOCS\82327.TXT SAGING1 PsN: SAGING1
3

ures are likely to only continue to grow as America’s elderly population increases.

Some of the very achievements that seniors have worked for

their whole lives contribute to this vulnerability. For example, their

often excellent credit ratings make the elderly a particularly appealing target for identity theft. Many seniors have strong credit

ratings earned over the years by faithfully paying their bills on

time. This good credit is abused by identity thieves who take out

loans, sign leases, or open bank or credit card accounts and run up

bills in the elderly person’s name. In a very short amount of time,

a lifetime’s worth of solid credit, along with the pride and dignity

it brings, can be ruined.

Other aspects of seniors’ lives also make them more vulnerable

to the tactics used by identity thieves. Some seniors are simply unaware of the threat. They are unaware that perhaps by engaging

in transactions on the Internet that they may be vulnerable to

identity theft. Consequently, not only are they unable to take simple preventive measures, but they also may be unaware that their

identity has even been stolen for some period of time.

Moreover, fraudulent telemarketers take advantage of seniors

who live alone by seeming to offer friendship when their true purpose is to pump the elderly person for personal information.

As the Chairman of the Permanent Subcommittee on Investigations during my first 4 years in the Senate, I held numerous hearings on consumer fraud. Two years ago, I chaired a PSI hearing

that examined the increasing availability of false education and

credentials, such as drivers’ licenses, birth certificates, and Social

Security cards, over the Internet. One of the subcommittee’s findings was that false identification facilitates a host of other crimes,

ranging from underage drinking to credit card and bank theft to

identity theft.

One witness who used false identification documents to aid in

stealing others’ identities testified that not only was he able to

gather personal information about his victims online, but he also

was able to gather all the false identification documents he needed

online, as well. Another individual used false identification, apparently obtained from a website operator, to perpetrate identity theft

and a host of financial crimes, eventually racking up debts of

$35,000 in the victims’ name.

In December 2000, the Internet False Identification Prevention

Act of 2000, which I authored, became law, but I still think there

is a great deal more that we need to do. One of the things that we

can do is to increase public awareness about this problem, and that

is why I am pleased that the Senate recently passed legislation, the

National Fraud Against Senior Citizens Awareness Week, which I

hope will lead to activities like this.

I also want to thank Senator Craig for his leadership in holding

this hearing this morning. Thank you, Mr. Chairman.

Senator CRAIG. Senator Collins, thank you, and thank you for

your leadership in this area. It is a matter of not only seniors understanding the risks involved, but trying to plug the holes and

most assuredly going after those with effective prosecution, so

thank you again.

4

Now, let me turn to our panel, and once again, Lieutenant Colonel, Retired, John Stevens from Maryland. Welcome before the

committee and please proceed. We would ask all of you to stay with

our 5-minute rule. Your full statements that you provided for the

committee will become a part of the committee record. Thank you.

STATEMENT OF LIEUTENANT COLONEL (RETIRED) JOHN T.

STEVENS, JR., UPPER MARLBORO, MD

Colonel STEVENS. Good morning, Senator Craig, Senator Collins.

My wife, who is sitting directly behind me, and I wish to thank this

committee for your concern of the effects of identity theft on the

senior citizens of this country.

I am 74-years old and my wife is 3 years younger. We are rapidly

approaching our 49th wedding anniversary. We are still fighting

the identity theft battle that began in 1997. Our battle now is not

with the impostors that used our Social Security numbers to open

33 fraud accounts worth $113,000, but with the creditors, credit bureaus, and third party collection agencies.

By working 12 to 14 hours a day, paying $6,000 in attorney fees,

and spending a small fortune in phone bills, we cleared the fraud

accounts from our credit reports in about a year. However, this was

only temporary. They would reappear, in our credit reports, from

the same creditor or a third party collection agency. The life of

these fraud accounts was extended by the cavalier attitude of the

credit bureaus and the profit motive of creditors in failing to establish policies and procedures that would prevent this.

This recycling of fraud accounts and other personal fraud data

has been going on now for over 4 years, with no end in sight. We

never know what we are going to find in our credit reports. We are

tired of getting threatening letters and phone calls from collection

agencies. We are tired of constantly correcting the fraud accounts

and erroneous data that keeps appearing in our credit reports. We

are tired of having to pay cash for purchases, that would normally

be financed, because of the fraud, data that keeps reappearing in

our credit reports. We are tired of creditors and collection agencies

trying to extort money from us, with the help of the credit bureaus

on known fraud accounts. We want creditors and credit bureaus to

be held fully accountable for the time, misery and expense involved

in correcting their errors.

We are not victims of this crime. We are targets. As a target, we

will fight back, take evasive action, and employ countermeasures

against the enemy. I have already survived two wars and intend

to fight to win this one. My wife and I are warriors. We intend to

fight back for as long as it takes to overcome the horror of this

crime and regain control of our lives.

Identity theft is only possible with the full cooperation of the

three major participants. In our opinion, the impostor, the creditor,

and the credit bureaus are all co-conspirators and equally guilty of

identity theft.

Last year, we contacted an attorney in Louisiana to take action

against the creditors and credit bureaus in an effort to stop their

harassment and attempted extortion. We found out that there is a

2-year time limit on taking legal action. Of course, this only beneVerDate 11-MAY-2000 13:37 Dec 09, 2002 Jkt 000000 PO 00000 Frm 00008 Fmt 6633 Sfmt 6633 C:\DOCS\82327.TXT SAGING1 PsN: SAGING1
5

fits the co-conspirators who are responsible for this crime and not

those affected by it. This time limit should be removed.

The credit bureaus now sell protection from identity theft.

Equifax ‘‘Credit Watch’’ and Experian’s ‘‘Credit Manager’’ will alert

you to significant changes in your credit report and send you copies

to check the accuracy of the data. Protecting the integrity and ensuring the accuracy of information contained in a credit report

should be a normal part of their operation and not just available

to those willing to pay them for ‘‘protection.’’ My wife and I continuously warn people about identity theft and

how to fight it when it happens. We also warn about other related

scams, against the elderly, such as automatically raising auto insurance rates at age 70, rejected medical insurance claims that are

only paid upon resubmission, being billed for magazine subscription renewals you did not order and threats to ruin your credit if

you do not pay, telemarketers trying to sell you unwanted merchandise, merchants who demand your Social Security number for

routine purchases, and pharmacies that routinely short your pill

count on prescription drugs.

We advise others to ‘‘opt out’’ of the exchange of personal information by banks and other businesses. This practice needs to be

changed to ‘‘opt in’’ only.

How much longer must we put up with having our credit ruined

and being harassed and insulted by creditors and collection agencies? Why must our personal information be distributed to others

who use it to harass us with unwanted sales pitches and junk

mail? Why must we continuously correct errors in our credit reports caused by the incompetence and greed of others?

We want our lives back. Enough is enough. My wife and I would

like to enjoy what time we have left to be together in this world.

Our feelings can simply be expressed by quoting a line from the

movie ‘‘Network.’’ ‘‘I am mad as hell and I am not going to take

it anymore.’’ It is time to throw the money changers out of the temple.

Senator CRAIG. John, thank you. That is powerful testimony. We

appreciate it.

[The prepared statement of Colonel Stevens follows:]

6

7

8

9

10

11

Senator CRAIG. Now, let me introduce to the committee Alice

Fisher, Deputy Associate Attorney General, Criminal Division, U.S.

Department of Justice. Alice, thank you for joining us.

STATEMENT OF ALICE S. FISHER, DEPUTY ASSISTANT ATTORNEY GENERAL, CRIMINAL DIVISION, U.S. DEPARTMENT OF

JUSTICE, WASHINGTON, DC

Ms. FISHER. Thank you, Senator Craig and Senator Collins, and

thanks for giving me the opportunity to testify about identity theft

in senior citizens and our efforts at the Department of Justice.

As you noted, identity theft is not only a serious crime but one

of the fastest growing means of fraud in the United States. Criminals steal personal identification information each year in the thousands to commit crimes ranging from bank and credit card fraud

to international terrorism. Americans lose money, houses, their

good credit, et cetera. It goes on.

These crimes may work particular hardships, financial and emotional, on the elderly. The elderly may have a harder time recovering financially. They may be less able to withstand the emotional

toll from what you have to go through to recover your identity, as

we just heard.

Perhaps because identity theft does not usually involve face-toface contact between criminal and victim, we do not see identity

thieves as a group appear to be specifically targeting senior citizens. There is no doubt, however, that some criminals plan and

carry out identity theft fraud knowing that their victims are senior

citizens. Let me give you some examples of Federal prosecutions involving identity theft and seniors.

In a case now under Federal indictment, the defendants and others allegedly worked together to identify houses in the metropolitan

Detroit area that were owned free and clear by the elderly people.

The defendants would steal the identity of the true owners of the

houses. Then they would strip the equity out of the house by faking

refinancing without the owners’ knowledge or consent. Sometimes

they would fake a straw sale of the home.

In another case, a defendant in North Carolina stole mail from

senior citizens throughout the State, used the identification information to produce fake drivers’ licenses and counterfeit checks,

then used the licenses and checks to withdraw the seniors’ life savings out of bank accounts. I am pleased to report that one such defendant was just sentenced to over 5 years in prison.

In another Federal prosecution, the defendant took a job as a

live-in companion for an elderly woman. After the elderly woman

was hospitalized, the defendant obtained and used credit cards in

her name, stealing thousands of dollars. Here, too, this defendant

received significant jail time.

It goes without saying that identity thefts such as these are extremely harmful to the victims, especially senior citizens. Once an

identity thief has obtained access to the victim’s bank or financial

accounts, the victim may suffer significant financial losses and considerable emotional distress.

In a recent Federal prosecution in Texas, one of the victims was

an 80-year-old military woman whose checkbook had been stolen

from her car. After the criminals had drained thousands of dollars

12

from her bank account, her doctor had to treat her for a stress disorder she experienced as a direct result of the crime.

The Department of Justice regards identity theft as serious

criminal violation that requires a coordinated response from all levels of law enforcement, Federal, State, and local. The Department

has, therefore, undertaken a three-pronged approach to identity

theft.

First, the Department is vigorously pursuing identity theft prosecutions across the country. Most recently, in May, the Department

conducted a nationwide sweep of Federal prosecutions targeting

identity theft. In that sweep, the Department brought 73 criminal

prosecutions against 135 individuals in 24 districts. The offenses

charged included cases in which defendants bilked Americans of

millions of dollars, preyed on the elderly, and destroyed the credit

worthiness of hard-working families.

Second, the Department is pursuing additional legislation to address the most serious cases of identity theft and to provide greater

protection to the public through enhanced criminal penalties, and

I am pleased that, Senator Craig, you are cosponsoring this bill introduced by Senator Feinstein, S. 2541, which would create a new

crime of aggravated identity theft. This new class of identity theft

is defined by the nature and seriousness of the crimes committed

through the use of another’s identity. Individuals found guilty of

identity theft under this proposed bill will receive an additional 2

years’ imprisonment over and above for their sentence for the underlying offense, or an additional 5 years’ imprisonment where the

underlying offense is terrorism-related.

Third, the Department recognizes the importance of educating

law enforcement and the general public about identity theft. Too

many people, even criminal justice professionals, do not fully understand what identity theft is or how it can affect their lives and

assets. As a result, the Department is sponsoring or directly supporting a number of approaches to identity theft education and prevention.

Thank you, Senator Craig and Senator Collins. I ask that the full

text of my written remarks be entered in the record.

Senator CRAIG. They will be. Thank you very much for that testimony.

[The prepared statement of Ms. Fisher follows:]

13

14

15

16

17

18

19

20

21

22

23

24

Senator CRAIG. Now, let me turn to James Huse, Inspector General of the Social Security Administration here in Washington. Jim,

please proceed.

STATEMENT OF JAMES G. HUSE, JR., INSPECTOR GENERAL,

OFFICE OF INSPECTOR GENERAL, SOCIAL SECURITY ADMINISTRATION, WASHINGTON, DC

Mr. HUSE. Thank you, Senator Craig and Senator Collins, for

holding this important hearing this morning on identity theft and

America’s senior citizens.

Criminals do not steal the identities of the elderly so they can

pretend to be old and wise. They do it because senior citizens are

more likely than most of us to have significant assets, savings, investments, paid-up mortgages, good credit, and Federal entitlement

checks. People over age 50 control at least 70 percent of the nation’s household net worth. They are also easier and safer to rob.

Some are less sure of themselves, more trusting, and less aware of

simple precautions. Anybody can steal candy from a baby, but

criminals know our older Americans have money for the taking and

they do not cry out loud.

Identity theft is an enabling crime, one that permits criminals to

commit other crimes more effectively. In most cases, identity theft

begins with the misuse of a Social Security number, the SSN. No

aspect of my mission of protecting Social Security programs from

fraud, waste, and abuse is more important than our oversight of

the use and misuse of the SSN.

There is an almost infinite variety to these cases. Thieves are

finding houses owned by the elderly, as Ms. Fisher testified, assuming the identities of the true owners and stripping the equity

out of their houses without their owners’ knowledge or consent.

In San Diego, a man who had been a fugitive felon for 17 years

with four prior felony convictions, including prison escape, used a

70-year-old South Dakota woman’s SSN to create 33 stolen or fictitious identities. He also took out credit cards and loans under these

assumed identities while receiving Social Security benefits under

three of his identities.

A Virginia man working under a senior citizen’s SSN while collecting disability benefits under his own number obtained over

$24,000 worth of loans and credit for goods and services. The older

man’s credit was damaged and his retirement benefits were interfered with because of the earnings posted to his records at SSA.

Many elderly individuals who trust the Social Security Administration are victims of scams promising more information or additional Social Security benefits. Such victims have been tricked into

parting with their Social Security numbers and other personal

identifiers, simply assuming that SSA never responded to their request for information.

Yesterday’s Washington Post had this story by Dan Oldenburg

on a ‘‘do not call’’ registry scam that victimized the elderly. The

caller asks for personal information, a bank account or credit card

number, supposedly to verify if you are on a list, but it was a scam.

These, of course, are used and sold for illegal purposes.

Congress has enacted helpful legislation to treat the disease of

identity theft in its later stages. The ability to prevent identity

25

theft is even more essential. While we cannot return the SSN to

its original limited function, we must take workable steps to limit

both its use and the expansion of its use.

First and foremost, the time has come to make the difficult determinations as to those uses that are appropriate and necessary and

those that are merely convenient. The SSN has become a de facto

national identifier and its daily use has, in many instances, become

a luxury we can no longer afford. The availability of SSNs on public documents and over the Internet, for example, must come to a

stop.

Congress should consider requiring the cross-verification of SSNs

through both governmental and private sector systems of records.

Only in such a way can we combat and limit the spread of false

identification information and SSN misuse. Similarly, all law enforcement should be provided the same SSN verification capabilities currently granted to employers.

We need legislation that regulates the use of the SSN and provides enforcement tools to punish its misuse. If we are to head off

the many crimes identity theft breeds, we need legislation to restrict sale of SSNs by government agencies, to prohibit display of

SSNs on government checks, drivers’ licenses, vehicle registrations,

and prohibit sale, purchase, or display of the SSN in the private

sector.

I applaud the decision of the Treasury Department to remove

SSNs from all Treasury checks, including Social Security and Supplemental Security Income checks, to protect the privacy of the

SSN and reduce opportunities for identity theft. This good decision

needs to be codified into law.

I describe other needed legislative changes in my written statement. With such legislation and the continuing dedication of the

government agencies involved and of this Special Committee, I am

confident that we can reverse the trend of identity theft against

older Americans. Thank you very much.

Senator CRAIG. Thank you very much. We will visit at length

about your suggestions about the use of the SSN and how it ought

not be used. I think those are very valuable suggestions.

[The prepared statement of Mr. Huse follows:]

26

27

28

29

30

31

32

33

34

Senator CRAIG. Now, let us turn to Howard Beales, Director, Bureau of Consumer Protection, the Federal Trade Commission here

in Washington. Howard, welcome before the committee.

STATEMENT OF HOWARD BEALES, DIRECTOR, BUREAU OF

CONSUMER PROTECTION, FEDERAL TRADE COMMISSION,

WASHINGTON, DC

Mr. BEALES. Thank you, Senator Craig and Senator Collins.

Thank you for the opportunity to be here today to speak to you

today about the crime of identity theft, which is a complex and pernicious problem in today’s society. It is a crime that cuts across all

lines of our population. Last year, we received complaints from just

over 86,000 victims, including the elderly.

In 1998, Congress recognized the seriousness of this problem by

making identity theft a Federal crime. Although the FTC does not

have criminal law enforcement authority, we play a central role in

assisting law enforcement and in helping victims recover. Under

authority given to us by Congress, we have implemented a dedicated program to respond to ID theft. This program has three central features: Assisting consumers through complaint handling and

steps to ease recovery; supporting law enforcement by making

these victims’ complaints available to State and Federal agencies

for their use in investigations; and educating consumers on how to

prevent and how to recover from identity theft.

The centerpiece of our program is our toll free number for identity theft victims, 877–ID–THEFT. Callers are connected with

trained counselors who take their complaints and walk them

through the steps to repair the damage done by identity thieves.

Consumers can also enter their complaints via an online complaint

form. From both the web complaint form and from telephone contact, we gather information about the incident, what happened to

the victim, what is known about the suspect, and any special problems the victim may be encountering.

These data, in turn, are used to support and to enable more effective law enforcement investigations. Using our secure web-based

Consumer Sentinel network system, law enforcement officers, from

local sheriffs to the U.S. Secret Service, can access the more than

189,000 complaints that are now in our database. They can use

that information to track down witnesses, to identify trends, or to

look at information relating to their region or their ongoing cases.

Using the Secret Service’s clustering software and supported by

research from other law enforcement databases, we also develop

preliminary investigative reports, which we send out to the U.S.

Secret Service’s Financial Crimes Task Forces and to other law enforcement agencies throughout the country to both assist and encourage investigations and prosecutions.

To further support the prosecution of identity theft, we are now

training local and State law enforcement officers throughout the

country. Sponsored jointly with the Justice Department and the Secret Service, the training focuses on how to investigate identity

theft and how to coordinate with the Federal resources that are

available to State and local authorities.

Coordination at all levels is particularly important in fighting

identity theft because it is a crime that does not respect geographic

35

boundaries. We have already trained about 450 officers from over

110 agencies during the past 4 months and more sessions are

planned. We continue to develop more and better ways to get the

complaint data and other resources into the hands of those who

could best pursue investigations and prosecutions.

Finally, consumer education plays a key role in our identity theft

program. While no one can completely protect themselves from

identity theft, there are steps we can all take to minimize our vulnerability.

For example, we advise consumers to be mindful of exposing

their personal information, in particular, destroying financial documents before throwing them out and not leaving behind credit card

receipts in stores and restaurants. We include such guidance in our

booklet, ‘‘ID Theft: When Bad Things Happen to Your Good Name,’’ as well as step-by-step advice for victims on how to repair the damage caused by identity theft. To date, we have distributed more

than 1.5 million copies, both in hard copy and via our website.

Other agencies, including the Social Security Administration, the

SEC, and the FDIC, also print and distribute the booklet, as do

many private sector organizations. We recently released a version

in Spanish.

Despite these efforts, the risk of identity theft remains real for

all Americans, including those aged 60 and over. To determine

whether the elderly are particular targets for identity thieves, we

examined the complaints in our database. That analysis shows that

older Americans experience more or less the same types of identity

theft at roughly similar rates to others.

In 2001, our clearinghouse received 5,800 complaints from victims who were 60 and over. That constitutes 10 percent of the complaints where the victims provided their age. In contrast, this age

group is 16 percent of the U.S. population. Without doing a survey

of the population, we are unable to say whether they are simply

less likely to be victims of identity theft or if they are just less likely to report it. It is very difficult for us to separate those two possibilities in our data.

Americans over 60 experience the same types of identity theft

and at more or less the same rates as those under 60. While there

are some variations, for example, senior identity theft victims report slightly more credit card fraud than other age groups, they

also report less employment-related identity theft, but there is

nothing that signals that older Americans in general are more or

less vulnerable in any particular way from other members of the

population.

We do take special care in our consumer education and outreach

efforts to reach older consumers. We work closely with the SSA,

which distributes our booklet, and we have also worked closely

with AARP, which has run many stories in its publications, referring members to our website and toll-free numbers and using our

statistics to help explain identity theft.

In conclusion, despite the efforts of Congress and Federal and

State and local law enforcement agencies, identity thieves remain

among the most insidious and opportunistic of criminals, preying

without prejudice on all segments of our population. The financial

and emotional toll paid by the victim, however, is likely to be parVerDate 11-MAY-2000 13:37 Dec 09, 2002 Jkt 000000 PO 00000 Frm 00039 Fmt 6633 Sfmt 6633 C:\DOCS\82327.TXT SAGING1 PsN: SAGING1
36

ticularly egregious when the victims are elderly, who have worked

a lifetime to establish good credit, only to have it ruined by these

insidious thieves. Their acts are heinous and the FTC will continue

to place a high priority in assisting law enforcement agencies in

their efforts to identify and prosecute these criminals, as well as

advising older Americans on steps they can do to reduce the risk

of this crime.

Thank you, and I look forward to your questions.

Senator CRAIG. Howard, thank you very much.

[The prepared statement of Mr. Beales follows:]

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

Senator CRAIG. Our last witness on this first panel is Doug

Coombs, Deputy Special Agent in Charge, Financial Crimes Division, U.S. Secret Service. Doug, welcome to the committee.

STATEMENT OF DOUGLAS COOMBS, DEPUTY SPECIAL AGENT

IN CHARGE, FINANCIAL CRIMES DIVISION, UNITED STATES

SECRET SERVICE, WASHINGTON, DC

Mr. COOMBS. Thank you very much. Mr. Chairman, Senator

Craig, Senator Collins, thank you for the opportunity to address

this committee on the subject of identity theft and the Secret Service’s efforts to combat the problem. I am particularly pleased to be

here with my colleagues and partners in fighting identity theft

from the Federal Trade Commission, Department of Justice, and

the Social Security Administration.

With the passage of new Federal laws in 1982 and 1984, the Secret Service was provided jurisdiction for the investigation of the

counterfeiting of identification documents and access device fraud.

The explosive growth of these crimes has resulted in the evolution

of the Secret Service into an agency that is recognized worldwide

for its expertise in the investigation of all types of financial crime.

The burgeoning use of the Internet and advanced technology,

coupled with increased investment, has led to a great expansion

within the financial sector. Although this provides benefits to the

consumer through readily available credit and consumer-oriented

financial services, it also creates a target-rich environment for today’s sophisticated criminals, many of whom are organized and operate across international borders. Information collection has become a common byproduct of the newly emerging e-commerce and

has led to an entirely new business sector being created which promotes the buying and selling of personal information.

As a result, the information consumers provide in credit card applications, loan applications, or with merchants they patronize are

a valuable commodity in the new age of information trading. With

the availability of this personal information, the crime of identity

theft can be perpetrated with minimal effort on the part of even

the relatively unsophisticated criminal.

Identity theft is not typically a stand-alone crime. It is almost always a component of one or more crimes, such as bank fraud, credit card or access device fraud, or the passing of counterfeit financial

instruments. In many instances, an identity theft case encompasses

multiples types of fraud and affects all Americans, regardless of

age, gender, nationality, or race.

Obviously, the impact is magnified when it affects one of America’s most valued assets, the elderly, as they represent a generation

with a trusting nature that is easy to exploit. This group is particularly dependent on other caregivers for assistance, such as relatives, medical staff, service personnel, and oftentimes complete

strangers. This dependency increases their vulnerability to certain

schemes involving identity theft.

It has been our experience that criminal groups involved in financial fraud and identity theft are increasingly diverse and routinely operate in a multi-jurisdictional environment. This has created problems for local law enforcement agencies that generally act

as the first responders to their criminal activities. By working

60

closely with other Federal, State, and local law enforcement, we are

able to provide a comprehensive network of intelligence sharing, resource sharing, and technical expertise bridging jurisdictional

boundaries. This partnership approach to law enforcement is exemplified by the 37 Financial and Electronic Crimes Task Forces the

Secret Service has located throughout the country.

Another important component of the Secret Service’s preventative investigative efforts has been to increase awareness of issues

related to financial crime investigations in general and of identity

theft specifically. The Secret Service has tried to educate consumers and provide training to law enforcement personnel through a

variety of partnerships and initiatives. The Secret Service has assigned a Special Agent to the Federal Trade Commission on a fulltime basis to support all aspects of their identity theft program.

The International Association of Chiefs of Police and the Secret

Service have partnered to produce an ‘‘Identity Theft Roll Call’’ video geared toward local police officers throughout the nation. The

purpose of this video is to emphasize the need for police to document a citizen’s complaint of identity theft regardless of the location of the suspect. The video and its companion reference guide

will provide offices with information that can assist victims with

remediation efforts.

At the request of the Attorney General, the Secret Service joined

an Interagency Identity Theft Subcommittee comprised of Federal,

State, and local law enforcement agencies, regulatory agencies, and

professional agencies. It meets regularly to discuss and coordinate

investigative and prosecutive strategies, as well as consumer education programs.

All levels of law enforcement should be familiar with the resources available to combat identity theft and to assist victims in

rectifying damage done to their credit. The Secret Service has already undertaken a number of initiatives aimed at increasing

awareness and providing the training necessary to address these

issues, but those of us in law enforcement and consumer protection

communities must continue to reach out to an even larger audience

and we must continue to approach these investigations with a coordinated effort. This is central to providing a consistent level of

vigilance in addressing investigations that are multi-jurisdictional,

while avoiding duplication of effort.

The Secret Service is prepared to assist this committee in protecting and assisting the nation’s largest growing population segment with respect to prevention, identification, and prosecution of

identity theft criminals.

That concludes my remarks. I will be glad to answer any questions that Senator Craig and Senator Collins might have. Thank

you.

Senator CRAIG. Doug, panelists, thank you very much for your

remarks.

[The prepared statement of Mr. Coombs follows:]

61

62

63

64

65

66

67

68

69

70

71

Senator CRAIG. Let me start with a brief line of questioning, then

I will turn to Senator Collins, and then I may have additional questions.

John, what is the best advice you might give seniors who would

be looking at this record or listening in to protect themselves from

what happened to you and Mrs. Stevens?

Colonel STEVENS. First of all, so many people want your Social

Security number. Do not give it to them unless there is a legitimate need for it, because that is the beginning of all the identity

theft and it was the beginning of ours. We suspect—— Senator CRAIG. So it was the Social Security number that was

the entry to your resources?

Colonel STEVENS. We suspect that they came off of the DOD computers that have access to my wifes and my Social Security numbers, under the DEERS and ID program that they were able to get

that information on us. But the thing is, just be aware, do not talk

to door-to-door salesmen that just happen to be in the neighborhood. Never fall for any of the telemarketing schemes. Always opt

out whenever you have the opportunity, and if you do not, complain

anyway so that it just cuts down on a lot of the junk mail that you

have to shred. Generally, be aware of what is happening.

The major thing that you have to do is just stop giving out information indiscriminately. Everybody wants to find out about you,

but do not answer the questions.

Senator CRAIG. John, do you know if those who perpetrated the

crime against you and Mrs. Stevens were ever apprehended and

prosecuted?

Colonel STEVENS. They have not been, but we suspect we know

who they are and I think it was a person that probably had access

to the DOD computers.

Senator CRAIG. How long ago was this? When did this start?

Colonel STEVENS. It started—we found out about it in March

1997.

Senator CRAIG. Ninety-seven.

Colonel STEVENS. This was by a phone call from then-Nations

Bank wanting me to make payments on a Jeep Cherokee that was

bought in Texas, and I am living in Maryland. I do not have a Jeep

Cherokee. We found out that there were a total of five cars that

were bought in our name and total damages—they totaled it up to $113,000.

Senator CRAIG. Alice, what is the single greatest challenges for

prosecutors in obtaining a conviction in identity theft cases?

Ms. FISHER. I think the biggest challenge for all of us, as John

said, is prevention and education of ways to prevent. But from a

prosecutorial perspective, I would say that prompt reporting and

aggressive review of financial data and reporting to State police,

local police, Federal authorities, so we can investigate the case immediately. It gives us a better chance to find the culprit and then

prosecute them. Once we find who did it, the prosecution actually

is fairly straightforward. But it is finding the criminals.

In one case, I think it was out of Texas, it was 20 years before

it was reported by the woman who was the victim of an identity

theft because she did not regularly use credit cards, and the person

that had committed the crime had used her Social Security number

72

to get drivers’ license in some States, filed bankruptcy in another

State, and was arrested in yet another State, and it was 20 years

before they found it.

So I would say the challenge is to encourage people to report any

suspicious activity promptly to the authorities.

Senator CRAIG. In this effort, is State law a problem?

Ms. FISHER. Actually, in the last 3 years, the States have really

gotten on board in this problem and 47 States have passed identity

theft laws. So we are real pleased in the way that they are coming

along. We also coordinate through the Attorney General’s Subcommittee on Identity Theft with the National Association of Attorneys General and the National Association of District Attorneys

and the International Association of Chiefs of Police and reach out

to chiefs of police all over the nation.

I would say that one of the things we would hope that the State

and locals would do better is to fill out police reports better, because not only does that get us on board for enforcement, but it

also helps victims, such as John, to use that police report to secure

and restore their identity.

Senator CRAIG. Thank you.

Mr. Huse, in today’s world of trying to develop single-digit, or

multiple-digit but single-number IDs, we all want a universal

phone number that we can use anywhere in the world, and in the

wireless world, that is becoming increasingly the case. I think we

all want to consolidate numbers as much as we can because we

find our mind full of all kinds of access numbers and code numbers

and that type of thing. Is there any prohibition now against the use

of the SSN?

Mr. HUSE. No. The SSN is pretty much the de facto national

identifier, and I think, as a people, we need to accept the fact that

it has become that. It pervades almost every aspect of our governmental, financial, and commercial lives. We are our number, and

I think that probably as a people, we do not want a national identity card, but we have a great ambiguity about the fact that the

number has become very convenient for us to do business in this

very complex world we have today. So I think, to answer your question, we need to live with the reality of what the number is and

what it does and now look at ways to make its integrity stronger.

I think that is the key.

Senator CRAIG. You had suggested that might be done by requiring limits in its application, I guess that is a better way of saying

it?

Mr. HUSE. I think we need to look at how the number is used

and how it is displayed and how it is aggregated in different data

banks and databases by people who use it for commercial purposes.

We need to regulate that. We have to be sure that the data in these

stores, whether they are independent research companies or financial institutions or credit bureaus, we have to be sure that the data

there is accurate and that the people that run those are responsible

for that data. I think that is an obligation of government.

I think that those records need to be matched, not only commercial and financial records, but also all government records at local,

county, State, and Federal records so that their data is accurate.

73

In that process, the anomalies will fall out and those become key

law enforcement leads. I do not know any other way to fix this.

I have been involved in this for 32 years. I was a Secret Service

agent long before I became an Inspector General. This is a problem

that has a solution, but it involves a little bit more action. A lot

has been taken, and I think this is the last step to really make it

protected.

Senator CRAIG. This committee, and we will work with you, visit

with you about that at length to see where we might make better

use of your ideas.

Mr. Beales, is there a way to acquire reports of identity theft

from credit reporting agencies to supplement your current database?

Mr. BEALES. Well, what we do right now is the credit reporting

agencies refer people to us and we refer people to them, so that

when people call us, we certainly tell them to call the credit reporting agencies to make sure that they get a copy of their credit report

and make any corrections to their credit reports and the credit reporting agencies, when they get a complaint, they urge the victims

to call the FTC to get our consumer education materials and also

to report the offense for law enforcement purposes.

They need somewhat different data than we do and we get information about the nature of the crime that is useful to us that they

do not particularly need. So it is not clear that direct sharing would

be the most efficient way to go about it, simply because of the different information needs. But we do think we have good cooperation in referring consumers so that we probably are picking up

most of those complaints, but we cannot tell for sure.

Senator CRAIG. Let me move on to Mr. Coombs and then my

other colleagues, and Senator Tom Carper has joined us, and then

I will come back to you, Mr. Beales, with another question.

Mr. Coombs, is there a danger that funds stolen through identity

theft can become sources for funding terrorist activities domestically, or is there any evidence that that has ever occurred?

Mr. COOMBS. Prior to my current assignment as Deputy Special

Agent in Charge in the Financial Crimes Division, I spent numerous years supervising and running a Counterfeit Crimes Task

Force in Orange County, CA, and then a fraud squad in Los Angeles, CA, which is among some circles considered the identity theft

capital of the world.

It is my experience that, as Senator Collins pointed out in her

opening remarks, that fraud identification, credit card fraud, and

stolen identities certainly have evolved to where they are the tools

of the criminal of the 21st century, if you will. It is my experience

that financial crimes and identity theft, which is often a component

of financial crimes, is committed by a spectrum of the criminal element, if you will, from the drug dealer who needs to support a

habit to organized criminal groups that it is part of their overall

criminal portfolio, to the unsophisticated criminal who utilizes

dumpster-diving as a means to compromise information, to the sophisticated technically savvy, if you will, criminal who utilizes

hacking and maybe a scheming device to compromise this information.

74

It is the vulnerability of the information that is susceptible and

is prone to identity theft. Therefore, it certainly is possible and feasible that terrorists could compromise information for financial

gain, or more importantly, to create that cloak of anonymity to

commit other types of crimes.

Senator CRAIG. Thank you very much.

Before I turn to Senator Collins for questions, let me turn to Senator Carper to see if he has any opening statement. Tom.

Senator CARPER. I do not. I am glad to be here and I am glad

you are here, as well. I really just came to hear Susan Collins’ questions. [Laughter.]

Senator COLLINS. Right.

Senator CRAIG. Here we go. Senator Collins?

Senator COLLINS. Thank you very much, Mr. Chairman.

Colonel Stevens, it was fascinating to hear that you first found

out that your identity had been stolen when you got a call from a

bank demanding payments on a Jeep that you did not own, and

then you found out that there were five other cars or vehicles that

had been purchased in your name.

I would like you to tell us a little bit about what you did when

you realized this had happened to you and how cooperative were

credit card companies, banks, and credit bureaus in your quest to

straighten it out, because from my experience as a financial regulator at the State level, I know a lot of times, consumers felt extremely frustrated in trying to straighten out instances of just

misidentity, where two people have the same name, much less

identity theft. Could you tell us whether this has been a difficult

process or not?

Colonel STEVENS. It is very difficult. The first thing, I had to get

my wife down off the ceiling, because when she got all this information, she exploded. Thank goodness, I am partially deaf anyway,

so——[Laughter.]

After the phone calls—in other words, to clear the Jeep Cherokee, I faxed them a copy of my driver’s license. They faxed me a

copy of the application. The only thing correct on it was the Social

Security number and a smattering of my first and last name. The

birthdays were wrong and everything else was wrong. In fact, if

they had checked the birthdays and the issue date of the Social Security number, they would have found the Social Security number

was issued before they were born. You know, just a simple check.

But we requested copies of the credit reports. Then we started

to treat it like a—well, since I was in research and development

for so long, we treated it like a project, systematically, with notebooks tracing down these creditors, because the credit bureaus did

not have the information to contact them. So we would have to

make numerous phone calls. I would go on the Internet and try to

trace down an address and phone number.

So we finally contacted a majority of them and we would send

them a sworn affidavit attesting to the fact that we did not do it.

In other words, we are proving the negative. We did not do it. We

are not the ones you are looking for.

So based on that, they would take that information and clear the

account, or so we thought. Anyway, it disappeared from the credit

report. Then again, they would turn up a little while later, a couple

75

of months later, in a third party collection agency. We have had

some that have recycled as many as five times now. My wife just

got notice of another one that was cleared and recycled again. It

just keeps going on.

Senator COLLINS. So it is still going on even as we speak, 5 years

later?

Colonel STEVENS. I described it once before as this birthday candle you blow out and it keeps relighting itself. [Laughter.]

It just keeps coming back.

Senator COLLINS. Mr. Beales, we have heard Mr. Stevens talk

about how extremely difficult it is for him to restore his good credit

and clear his name and that has been my experience in talking

with consumers in Maine, as well. Obviously, Mr. Stevens describes

himself as a warrior. He is undaunted. He is just going to keep

pursuing this. But for a lot of seniors who are considerably older

than Mr. Stevens and perhaps more intimidated by the process,

this is a real problem.

Does the FTC actually assist individual consumers in clearing

their record and restoring their good credit or are you just a repository for information and education about this?

Mr. BEALES. We are definitely a repository for information. We

assist individual consumers in providing them with information

and the steps to take, but we do not have the resources to do it

on their behalf or to go as their advocate in dealing with the process. We try to explain the process, talk them through the process

of what they have to do so they know what is coming, but they

have to do it themselves.

Senator COLLINS. Mr. Chairman, I think that is a problem for a

lot of our seniors and I do want, as part of this hearing, to let people know that most States have a Bureau of Consumer Credit Protection or something along that line which may be willing to intervene more directly for consumers.

Inspector General Huse, I want to follow up on the issue of the

Social Security number because Mr. Stevens’ case shows that that

is the gateway to this crime in so many instances. I agree with you

that the Treasury has taken a very important step by no longer

printing the Social Security number on Social Security checks, but

could you give us other examples of either legislative or administrative actions that you think should be taken to better safeguard

that Social Security number, because once you have that, once the

thief has that, it is very easy for him to get the other information

he needs.

Mr. HUSE. It is the breeder identification, the Social Security

number, in every possible context, to include in terrorists’ activities, the use of numbers, identifying numbers, fake Social Security

numbers. In the case of the September 11 terrorists, I think the Director of the FBI has testified to that, that that has been a result

of their investigative efforts.

This number is so pervasively used, I think the obligation now

is to make sure that the numbers themselves have some accuracy,

and we have so many systems of records at local, county, State,

and the Federal level, on just the governmental side. All those

records should be accurate as to who I am, who you are, and what

76

our Social Security number is because it has become our identification.

That can be done by the Congress requiring periodic matching of

that data so that all of those systems of records are accurate. If you

take care of that, that is one piece. The Congress could consider

making that requirement binding on the financial and commercial

sector for the legitimate reasons that the number has been expanded to be used in commerce. We will never be able to pull that

back unless we replace it with something else. That is a requirement, I think—that due diligence should be part of their ability to

use the number.

The Social Security Administration itself has taken tremendous

steps in the last few years to improve the business process of

issuing the number. Now we have to fix the process of keeping the

number accurate and strong in terms of integrity through its use.

I think those are places we can work and find some solutions.

Senator COLLINS. Mr. Chairman, thank you. I know my time has

expired. I do want to just let Ms. Fisher know that I am expecting

a report from the Justice Department pursuant to the law on Internet identity theft. It has been over a year and I hope it will be

forthcoming soon, because it does ask for legislative recommendations in this area. Thank you.

Senator CRAIG. Thank you.

Tom, questions?

Senator CARPER. Thank you. Yes, indeed.

About 5 years ago, one of our nieces down in North Carolina had

her identity stolen and what occurred after that has been something I would not want to visit on anybody. On the one hand, there

are the financial concerns and worries, but it is just as Mr. Stevens

knows, just a huge pain in the neck to put up with—a lot of stress,

a lot of worry, and a lot of aggravation.

I want to follow up on the question that Senator Collins presented to Mr. Huse. One of the questions I ask of panels is what

should we do? You began to answer that question, and I would just

ask of others at the table to do so as well. What should we do as

legislators to address this problem? What is our obligation?

Mr. Huse, you have already spoken a little bit. I do not want to

pick on you too much.

Mr. HUSE. I will only add one thing and then stop. The piece I

also strongly believe in is that we have to grant law enforcement—

because this crime is so pervasive and it cuts across all levels of

government—we have to grant law enforcement at the local, county, State, and Federal level, but particularly those local law enforcement officers, the right to verify Social Security numbers, just

as we allow employers to do that now on the wage and earnings

side, to see if the person has the right to work.

That tool is critical in the early investigative stages of an identity theft case like Colonel Stevens. If local law enforcement can establish those identities as they are working the crime, a lot more

can be done as we do now. This crime, because of the Internet and

our modern technology, works so quickly, we need to give all of the

tools we can to law enforcement.

Senator CARPER. OK, thank you. Others?

77

Mr. BEALES. Senator, I think S. 2541 is a very good idea, toughening the penalties and streamlining the proof requirements for

identity theft is a good way to address the problem. I think hearings like this help to reduce the problems because they bring them

to people’s attention. That encourages people to report problems to

us sooner, and we have definitely seen that trend in our database

over the last couple of years, and that, in turn, makes it easier to

prosecute.

I think that verifying Social Security numbers is a very interesting idea that potentially raises some privacy problems, depending

on what records are being matched, that would give us some pause,

but it is certainly worth exploring.

Senator CARPER. Thank you, and I recognize that. There has to

be a public policy debate over those uses, between individual rights

and the collective good. But I think it is a debate worth having.

I, too, endorse S. 2541 in the sense that under present laws now,

a lot of sentencings in terms of identity theft are not as strong as

they could be. We have had two recent investigations where the

sentences, at least to a lay person, seemed light in view of the severity of the crimes that were committed. This is a bill that we

really need soon.

Ms. FISHER. I would agree with that, Senator.

Senator CARPER. What else would you like to offer, Ms. Fisher?

Ms. FISHER. Well, I think this bill would increase the penalties

which not only encourages our U.S. Attorneys across the country

to prosecute these crimes, because there are harder sentences, but

hopefully will have a significant deterrent affect when people want

to steal others’ Social Security numbers or other identification information to engage in bank fraud or credit card fraud or document

fraud that relates to terrorism or anything else like that. So for the

deterrent effect, as well, we think it is important.

Senator CARPER. Mr. Coombs.

Mr. COOMBS. I agree with Ms. Fisher. Any more tools that you

can give law enforcement for their tool box is a tremendous enhancement. It is commonly known in criminal circles that the

crime of identity theft, the penalties are low and the financial

gains, the probability, are extremely high. S. 2541 has mandatory

sentencing for identity theft, and if it is terrorism-related, there are

more years added, and that is a tremendous bill and also would

have the support of the Secret Service, as well.

In regards to information and verifying information, anything

that we can do to verify businesses—verify information, because it

really is the compromise of information that is the root cause of

identity theft, and if there is any avenues to provide banking institutions, for instance, to verify information with good information

versus the bad information that they are getting, that would be a

tremendous asset to them.

I know the Treasury Department yesterday issued some regulations to enhance risk assessments and ‘‘know your customer’’ as a

result of the PATRIOT Act, and the Secret Service works closely

with the financial industry in developing protocols for knowing

your customer. So, hopefully, with these protocols and enhancements and knowing your customers, we can do better at verifying

this information.

78

Senator CARPER. Thanks.

Colonel STEVENS. I would like to take a little bit different approach, sir. I think the creditors, the banks, and the credit card

companies, and the credit bureaus should be held accountable for

opening fraud accounts. In my case, I have seen that just a little

bit of diligence on checking an address, a birthdate, a place of employment—for instance, I was listed as working at Stanley Tools in

Texas after I retired from Johns Hopkins University as a physicist,

so——

Senator CARPER. How did you like working at Stanley Tools?

[Laughter.]

Colonel STEVENS. It was enjoyable, apparently. The people spent

a lot of money who worked there. But just to hold the people accountable to show a little bit of care in opening these accounts, look

at birthdays, or a different address. Of course, I was told once that

15 percent of the people move every year, so they could not disqualify them for credit on that basis. My answer to that is, 85 percent of them do not move, so we all have to suffer for that.

Why can they not just take more care in opening the account,

check the data, and the credit bureaus can look for any drastic

changes. In fact, they have a protection policy now that costs, I

think, $79.95 a year that they will do that. I thought they should

do that under the normal process of doing business.

Senator CARPER. One follow-up question, and it sort of follows up

to what Mr. Stevens has just said. When someone’s identity is stolen and credit card purchases are made illegally using that stolen

identity or other, whether it is credit card purchase or others, who

ends up suffering the financial loss?

Colonel STEVENS. The creditor has to suffer that and that is why

they are so determined that they are going to turn that account

over to a third party collection agency, which comes right back on

me. They will hound you to death to try to make you pay that bill.

Now, some people will cave into that, and that is a warning to senior citizens like myself. Do not pay it, because that is an admission

of guilt and that account will remain on your credit report, I believe, for 7 years. But they will hound you, they will call you on

the phone, and if you clear it with them, they turn it over to another one, and we have had some recycled going on the fifth time

now, with the same account.

Senator CARPER. What can we do to change the incentive so that

the incentive falls more on the issuer of, we will say, the credit

card to be more diligent in terms of the background checks to control their underwriting losses?

Mr. BEALES. Senator, I think, mostly, they have the right incentives now, because ultimately, it is the creditor that pays the losses

and that is certainly the way it should be. If they issue credit to

the wrong person, they ought to have to eat the loss.

The difficulty is, I think, from the creditor’s perspective and also

from the way the system as a whole has to work, is there are also

people out there who do owe the money and simply are not paying.

So creditors have a legitimate interest in trying to collect in those

kinds of cases and it is hard for creditors to distinguish the victim

of identity theft from the deadbeat in some cases.

79

We can try to make that process easier and encouraging people

to file police reports is one thing that helps with that. We have developed a uniform fraud affidavit that creditors will accept as evidence that this really is an identity theft victim. But there is a tension there that is inherent in the nature of the crime that I think

is difficult to get rid of entirely.

Mr. HUSE. This really comes down to the accuracy of these

records, and that is the difficulty on the commercial side, is they

have information that they have aggregated through various ways,

but there is no way for them to verify that information in a facile

way, or any obligation right now, either, other than due diligence

in a business context.

If we make it, that cross-verification, a requirement, over time,

the number has better standing than it does now. Right now, it is

defeated because it is—the integrity is very amorphous, and I think

that is really an aspect there that deserves a good look.

Senator CARPER. OK, good. You have been most helpful. Thank

you for your testimony. Thank you for your response to our questions. Mr. Stevens, good luck.

Colonel STEVENS. As long the candle does not relight itself, we

will be struggling out there. We are going to fight them, though.

Senator CARPER. Thank you.

Senator CRAIG. Tom, thank you very much.

Mr. Beales, one last question of you. Are there factors within the

aging population that may indicate that this crime is being underreported relative to their general population, or relative to the general population. You were giving us statistics as to those victimized. In many other areas, we find seniors under report simply because of their view of their own personal integrity or their privacy

sense or they are going to suffer through a bit of a different attitude in a population base compared to younger people.

Mr. BEALES. We certainly see that in our fraud cases, that the

elderly are less likely to report that they are victims of fraud than

are members of the population at large. It is not clear that translates here, although it may, because this is a little bit more like

having your wallet stolen. This is to say you are a victim in a very

different way than you are in a fraud where you sort of have to

say you are a victim and you have to admit you were taken. But

having your wallet stolen is not quite like that. So it is not clear

that it is the same sort of a problem. It may be, and we are in the

design stages of some research to try to find out whether there

really is a difference, but at this point, we do not know.

Senator CRAIG. Alice, gentlemen, thank you all very much for

your testimony today. You have helped build a valuable record. We

appreciate it. Thank you.

Now, let me call our second panelists forward, if you would

please come forward.

Let me thank our second panel for being here. Let us get started,

if we could, please, and let me first introduce Mari Frank, a Privacy and Identity Theft Consultant from Laguna Niguel, CA. Mari,

welcome before the committee.

80

STATEMENT OF MARI J. FRANK, ESQ., PRIVACY AND IDENTITY

THEFT CONSULTANT, LAGUNA NIGUEL, CA

Ms. FRANK. Thank you very much, Senator Craig, for inviting me

and for holding this important hearing. I am the author of the

‘‘Identity Theft Survival Kit,’’ which I have brought as a resource

to this committee to give to you.

Senator CRAIG. Great. Thank you.

Ms. FRANK. As a member of AARP myself, several years ago, an imposter took my identity and stole over $50,000 using my name

and my profession as an attorney. Additionally, I have personally

assisted hundreds of elderly victims myself.

There is very little that seniors can do to prevent this crime. Law

enforcement needs more resources and it needs to investigate,

which often they do not. But law enforcement will never have the

power to prevent it. The key players with the unique opportunity

to thwart this crime are governmental agencies and businesses

that collect and use our information. Security breaches of databases, careless information handling practices, and unscrupulous

employees facilitate this fraud. There is no control over information

in the hands of others and there is no opportunity to avoid identity

theft. Once victimized, it may take months or years to find out, and

then to remedy the situation.

Here are a couple of examples of real-life stories. Sidney, a retired executive, learned that his identity was stolen after he and

his wife purchased a new home. His loan application with his

three-in-one credit report revealed his credit score, his Social Security number, and all of his accounts. His masquerader, using that

loan application, was able to open new credit card accounts, rent

a new apartment, obtain utilities, stealing over $100,000 in their

name.

Allan and Marcia were retired in a mortgage-free home. They

learned that convenience checks were stolen from their mailbox

and thousands of dollars were spent in their name. Checks were

stolen, credit cards were opened, other purchases were made.

Worse yet, they learned that their mortgage-free home now had a

mortgage with a lender who was threatening foreclosure.

Steve, a 78-year-old retired policeman, was living in an assisted

care facility. His personal information was held in an unlocked cabinet in the nursing home and later used to purchase luxury cars

and electronic equipment. He even found that he had a criminal

and fraudulent DMV record in another State.

Lorraine, a 65-year-old widow of a deceased decorated United

States Air Force General found out several months after her husband’s death that his identity was stolen to commit security crimes.

Not only is she left to deal with that grieving, but also to clean up

his tarnished reputation.

Although Federal law protects victims of credit card fraud from

paying the losses, as we know, there are still out-of-pocket costs,

which may cost thousands of dollars. Also, for those who experience

‘‘ATM–VISA fraud,’’ and check fraud, replacing the money in those

accounts is almost impossible. Without assistance, the elderly feel

overwhelmed, give up, pay fraudulent bills, or even file bankruptcy.

Emotionally, seniors feel very victimized, and violated, not only by

the criminal perpetrators, but even worse, by the creditors’ harassVerDate 11-MAY-2000 13:37 Dec 09, 2002 Jkt 000000 PO 00000 Frm 00084 Fmt 6633 Sfmt 6633 C:\DOCS\82327.TXT SAGING1 PsN: SAGING1
81

ment and lack of cooperation, the frustration of the experience from

the credit reporting agencies when they fail to correct, and the refusal of law enforcement to even investigate the crime.

The following factors make this crime easy and insidious: Mail

theft; insider theft; dirty employees; unscrupulous relatives; hackers and high-tech fraudsters creating false documents; dumpsterdiving at businesses and hospitals; information brokers selling personal information indiscriminately; selling of credit reports, loan

documents, rental car applications; theft in offices, buildings,

websites, computers; pretext calling and different scams; government and various industries’ negligent information handling practices; public record access, including birth certificates and death

certificates that have the Social Security number.

It is a myth that seniors can prevent identity theft. Offering consumer tips like ordering your credit reports twice yearly and guarding your personal information and shredding are great information,

but gives our aging population a sense of false security. Precautions taken by government entities and private industries

should do the following, and by the way, I have 17 pages in my

written testimony to give many more things, but I will just give

you a few.

Senator CRAIG. Thank you. [Laughter.]

Ms. FRANK. Because you were asking for solutions on the last

panel, I have bullet pointed all the things that we think should be

done.

Limit the use of the Social Security number, since it is the key

to identity theft. Verify, authenticate, and protect whatever identifier is used, whether it is a number, a password, or biometric information. Completely destroy personal information that companies

are discarding. They should truncate credit card numbers and

other unique identifiers, like Social Security numbers, and secure

all data, online and offline, and they should notify customers and

consumers or employees of security breaches.

Rather than going any further, I just want to end with whether

a Social Security number or a biometric identifier is used, the same

issues arise. How will we protect that information as it is stored,

transferred, sold, or used? Our nation’s aging population, the fastest growing segment of our society, is most at risk to be victimized

by the fastest growing crime. Let us set realistic guidelines for information handling practices. Thank you.

Senator CRAIG. Mari, your testimony is valuable and I think

those examples and recommendations based on your experience are

extremely valuable and I thank you for that.

[The prepared statement of Ms. Frank follows:]

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

Senator CRAIG. Now, let me turn to Boris Melnikoff. Boris is the

Consultant to the Regional President of the American Bankers Association, Atlanta, GA, and I understand has just become the

grandfather of a ninth granddaughter, is that correct, Boris?

Mr. MELNIKOFF. That is correct. Thank you very much, Senator.

Senator CRAIG. Congratulations.

Mr. MELNIKOFF. Thank you, sir.

Senator CRAIG. Those are special things in one’s life.

Mr. MELNIKOFF. At 1:57 yesterday afternoon, sir.

Senator CRAIG. Congratulations. Please proceed, Boris.

STATEMENT OF BORIS F. MELNIKOFF, CONSULTANT TO THE

REGIONAL PRESIDENT, AMERICAN BANKERS ASSOCIATION

(ABA), ATLANTA, GA

Mr. MELNIKOFF. Thank you, sir. Stopping identity theft before it

occurs and resolving those unfortunate cases that do occur is of the

utmost importance to the banking industry. Banks have a long,

proud history of securing their customers’ information, including

those of senior citizens.

As technology and the Internet have made more information

readily available, we have redoubled our efforts to help educate

consumers about how to prevent and resolve identity theft. Banks

and our customers are partners in protecting information.

This morning, I would like to make three key points. First, the

banking industry has been actively involved in an ongoing effort to

educate consumers on how to protect themselves from identity

thefts. Each one of us can limit vulnerabilities to this crime.

Second, the American Bankers Association has developed videos,

articles, statement stuffers to assist in training bank staff and educate consumers.

Third, it is important for the private and public sectors to pursue

innovations to improve identification of individuals, beginning, for

example, with the improved standards for drivers’ licenses.

Identity theft harms consumers and banks and severely challenges law enforcement. We can only be successful in fighting this

crime if we all work together. In 1998, ABA was very supportive

of the changes made by Congress, led by Senator Kyl, which made

it easier for law enforcement to bring action on ID theft cases. Unfortunately, at that time, there was no appreciable increase in prosecutions, however, likely due to the high volume of cases that law

enforcement was already engaged in. We were encouraged, however, by the Justice Department’s announcement in May that a nationwide effort has resulted in 73 criminal prosecutions for identity

theft.

Let me now turn to the educational efforts of the industry. ABA

members have been leaders in the private sector’s push to educate

consumers. We realize that people need our expertise and guidance

to avoid being victimized. Of course, the first step to combat identity theft is self-awareness and how you can protect yourself. I have

included in my written statements tips on protecting one’s personal

information. Taking many small steps, while not eliminating identity theft, will diminish the frequency of the crime.

Let me highlight a few examples of what the ABA has done. Just

yesterday, I did a radio tour where I was interviewed on 15 radio

101

stations from coast to coast talking about ID theft prevention.

These stations collectively reached an estimated 9.5 million listeners.

Second, the ABA has distributed to all its members a theft communication kit. This kit contains, Senator, public service announcements, sample statement stuffers, sample newspaper columns that

a banker could tailor to his or her community. We have provided

a copy of this kit to the committee.

Senator CRAIG. Thank you.

Mr. MELNIKOFF. ABA also offers a separate statement stuffer for

banks to use in mailing to consumers, with close to six million distributed across the country already.

Finally, the ABA has sent 1,200 copies of a video produced by JP

Morgan Chase and Company to our members. A copy of the tape

has also been supplied to the committee, sir.

While the ABA has done a considerable amount of work in this

area, we realize the individual industry efforts must continue. Fortunately, many of our members are engaged in similar efforts

across the country. I continue to witness superb examples of industry’s outreach, many of which I have mentioned in my statement.

Mr. Chairman, the ABA urges government leadership directed at

improving methods of identifying individuals. There is no better

way to protect against fraud and terrorism than by improving the

identification documents used to complete financial transactions.

Specifically, we believe in the efforts to improve how States issue

drivers’ licenses is of particular importance.

Thank you for the opportunity to update the committee on the

industry efforts in this important area.

Senator CRAIG. Thank you.

[The prepared statement of Mr. Melnikoff follows:]

102

103

104

105

106

107

108

109

110

111

112

113

Senator CRAIG. With the indulgence of the panel and the audience, there is a vote underway and my primary responsibility being

in this body is to vote. So we will stand in recess for a few moments while I run and vote and I will return as quickly as I can

to proceed with the balance of the panel and questioning.

The committee will stand in recess. [Recess.]

If I could ask everyone to take their seats and for the panel to

reassemble, please.

Boris, we just finished with you, and let me tell you that the effort that it appears the American Bankers Association has underway with both public outreach, but also education of professional

staff of employees sounds impressive and is important and I am

glad to hear that.

Now, let me turn to Stuart Pratt, Executive Director, Consumer

Data Industry Association here in Washington. Stuart, welcome before the committee.

STATEMENT OF STUART K. PRATT, VICE PRESIDENT, GOVERNMENT RELATIONS, CONSUMER DATA INDUSTRY ASSOCIATION, WASHINGTON, DC

Mr. PRATT. Mr. Chairman, thank you for inviting us here today,

and for the record, I am Stuart Pratt, Vice President, Government

Relations, for the Consumer Data Industry Association.

Senator CRAIG. That is a much more impressive title than I gave

you.

Mr. PRATT. But I appreciate the promotion, actually.

Senator CRAIG. All right. Thank you. [Laughter.]

Mr. PRATT. We are the association which represents all of the nation’s largest credit reporting systems, check approval systems, and

mortgage reporting systems, and so, obviously, we play a very central role in these types of debates.

In fact, we applaud you for holding this hearing because identity

theft is a pernicious crime. It is a difficult crime for everyone involved. We all end up, as a result of the criminals’ activities, trying

to untangle this snarl of accounts and information, and sometimes

it goes smoothly and sometimes it goes very well, and then sometimes you have seen cases where it does not go as smoothly as we

would like for it to go.

We thought we would focus on just two messages today in terms

of, first of all, what have we been doing as an industry to try and

work through and actually alter practices, business practices, that

will make it easier for victims to keep their information safe and

sound and to bring their credit history back to whole, and also, we

wanted to focus, as well, on consumer education and how educational efforts, we think, do play an extraordinarily important

role.

We looked at this issue as far back as 1997, and by March of

2000, we had issued a six-point program that would assist victims.

The six-point program is outlined in a press release which is attached to the testimony today. Let me just highlight a couple of key

steps that we thought were particularly important in this six-point

program.

First, we standardized the security alert. When you contact the

credit bureau, one of the first steps we will take is to put a security

114

alert on your file. It is a text message and it says, ‘‘I have been

a victim of identity theft. Please do not grant credit. For example,

here are telephone numbers you can use to verify who I am.’’ Obviously, if you have a telephone number and you are standing in

front of the consumer, unless you have a cell phone strapped to

your hip, there should be some interplay there that allows a lender

to be able to make a better risk decision about who they are doing

business with.

By standardizing the alerts, both in terms of the text itself and

also by adding an alphanumeric sequence, which is a fancy way of

saying a code, at the beginning of the security alert, we think this

better enables every one of our lender customers to be able to look

for that alert message, to look for the code, and to take the actions

that they think are appropriate based on that information.

So that obviously gives us a way of, downstream, trying to help

the consumer stay whole, because that alert message remains on

the file and it is a decision that we make jointly with the consumer

during the consumer relations process.

We also know that consumers like standardization across the

spectrum, so there are three major credit reporting systems in this

country and most consumers we interviewed, by the way, in our

process, said, we would like to have the same kind of treatment

each time so we do not have to go through three different versions

of the treatment.

In this case, what we did is we said, we will do three things first

for the consumer. When you contact us, even if you are just leaving

a message on an automated voice attendant, we are going to put

a security alert on your file. We are going to take you off of any

direct mail offers of credit, opt you out of any non-initiated transaction, so only when you go and apply for credit will your credit

report be used. Third, we will get your report to you in the mail

within three business days, often quite a bit sooner than that, and

obviously, there are Internet deliverables, as well, today. But those

three steps ensure the consumer has a better continuity across the

three credit reporting systems.

Then we also designed a system on the back end which is our

attempt to be responsive to the fact that identity theft is more longitudinal than some other types of crime. It is more difficult for us

to know, is it over? Am I finished? Or do I still have a problem that

is latent, that is out there? Is there more credit that I just am not

aware of yet that was not yet reported to the credit bureau, for example?

So over the course of the next 90 days, once we have brought a

file back to current, we will then send the consumer additional copies of his or her file with the 800 number, with access to live personnel. It keeps the consumer engaged—and this would be true for

a senior or for any other consumer who is a victim—keeps them engaged. Look at your file. Tell us if there is something else wrong

with that file so we can take care of that.

Now, we also knew that consumers wanted escalated services.

We want to be believed. That is one of the key points that many

consumers have said. How hard is it to prove who I am? So we

agree with all the testimony that has said, get a police report. If

you get a police report, we will immediately with that police report

115

block the fraudulent information. We will not wait to check with

the lender. We will take your word for it. The police report is a

validating document for us. We will block the fraudulent data. This

should give a consumer a chance to get on with their life much

more quickly and to be able to bring their credit report whole much

more quickly, as well.

Finally, we do accept the FTC’s standardized fraud affidavit,

which again reduces the paperwork burden, if you will, for victims,

and that is another key component of this. How many different affidavits do I complete? How much money do I have to pay to have

them notarized, and so on and so forth.

We think consumer education is another key component of this,

and I know a lot of times we talk about consumer education as a

replacement for other actions. But as you can see, we have taken

procedural actions with our business model to change what we do

for victims. But consumer education clearly allows us, for example,

to be able to partner up, and in our case, we committed ourselves

to partnering up with a group called Call for Action. We did

produce a brochure, and this brochure is maybe in some ways a

simplified version of the type of information that the Federal Trade

Commission promulgates. We, in fact, encourage consumers to contact the FTC.

We also promulgate information on victims’ rights under the law

and encourage consumers to understand their rights under the law.

For every citizen, by the way, the Fair Credit Reporting Act is not

obvious, and so we produce a flow chart that says very simply, this

is what should happen when you contact the credit bureau, dispute

your information, and get that information corrected.

We have seen more data, and we have indicated this in our testimony, where data shows that we are making progress. More consumers are calling our fraud units, taking a preventative step, so

maybe that is the last, most important point I can leave with you.

As opposed to calling and saying, ‘‘I am a victim,’’ the majority are

calling and saying, ‘‘I want to take a preventative step to make

sure I do not become a victim.’’ That is good news in terms of the

consumer education.

Let me close with that. I see my time has expired and I am open

for questions and I thank you for the time that you have.

Senator CRAIG. Stuart, thank you for that testimony.

[The prepared statement of Mr. Pratt follows:]

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

Senator CRAIG. Now, I am going to turn to Dennis Carlton. Dennis is Director of Washington Operations for the International Biometric Group in Washington, DC. Dennis.

STATEMENT OF DENNIS CARLTON, DIRECTOR OF WASHINGTON OPERATIONS, INTERNATIONAL BIOMETRIC GROUP,

LLC, WASHINGTON, DC

Mr. CARLTON. Senator, thank you, and on behalf of our company,

I would like to thank the committee for the opportunity to talk to

you about the technology called biometrics and describe how it can

be used to combat the problem of identity theft.

Let me begin with a brief description of the International Biometric Group so that you better understand who we are and our

unique position in the world of biometrics. International Biometric

Group, or IBG, provides independent consulting services to government and private industry customers interested in biometric technology. Our organization focuses on three primary functions: Evaluating and reporting on biometric products and vendors, as well as

the markets in which they compete; advising clients on how to implement biometric systems; and integrating a wide range of biometric hardware and software to meet the security needs of our customers.

We take a practical, hands-on approach to biometrics. We have

conducted extensive comparative testing of more than 30 different

biometric solutions so that we know how they are likely to perform

in the real world. IBG holds to a strict vendor-neutral policy, which

enables us to maintain close relationships with biometrics vendors

while ensuring that our clients receive accurate and independent

advice on which biometrics systems can best meet their needs.

Let me take a few moments to review some of the basics of biometrics. A technical definition of biometrics is the automated measurement of behavioral or physiological characteristics of a human

being to determine or authenticate their identity. In other words,

it is the use of computers to confirm who a person is by matching

a behavior or a permanent physical characteristic with similar

records in a database.

Research has shown that behaviors, such as the way we speak,

the way we sign our names, and even the way we type on a keyboard, are distinct and unique enough that they can be quantified

and compared by computers to existing samples. In a similar way,

physical characteristics of the human body, such as the friction

ridges on the pads of our fingers, the geometry of our hands, the

shape of our face, and the patterns of our irises and retinas, can

be measured and matched against computer databases.

A wide range of products on the market can acquire and match

a person’s biometric data in order to quickly and accurately identify

who they are. Time permitting, I hope to be able to demonstrate

some examples of these technologies to you later.

To effectively describe how biometrics can be used to combat

identity theft and protect senior citizens, I think it is important to

address some issues that often confuse the dialog about biometrics.

First, it is important to set practical expectations of what biometrics can and cannot do. To date, we have not seen a biometric

product that will work accurately 100 percent of the time. Whether

138

it is wrongly identifying one person as somebody else, only to identify someone it should not recognize, or preventing someone from

initially enrolling in the system, all biometrics systems make errors. A properly designed system needs to employ biometrics as just

one of a number of interlocking layers within a security solution

and must also include a quick and efficient exception handling

process.

Second, no one biometric technology is right for every application. For instance, while a finger scan technology may be an excellent solution for replacing passwords to gain access to a desktop

computer system, it is not of much help trying to pick a potential

terrorist out of a crowd in an airport terminal.

Finally, people should not automatically conclude that the use of

biometrics is an invasion of our personal privacy or a violation of

our civil liberties. Biometrics themselves are privacy neutral. It is

the way they are employed and the protections put in place to limit

misuse that makes biometrics either private invasive or privacy

protective. What is essential is that individuals are fully informed

on how their data is shared, used, collected, and secured. For more

information about biometrics and privacy, I commend to you an

IBG-sponsored website dedicated exclusively to the subject,

www.bioprivacy.org.

Biometric technology has been employed to prevent fraud and

identity theft for several years now. I personally managed a pilot

program that began in 1998 which evaluated the use of finger scan

technology in a retail grocery store for confirming the identity of

people who paid for their purchases by personal or payroll check.

Reaction to the system by those who used it was universally positive. People found it much easier and faster to identify themselves

with an index finger rather than digging through a pocket or purse

for an ID, and the store found the incidence of loss due to check

fraud reduced to zero. Most interestingly, senior citizens were some

of the most enthusiastic proponents of the system. They recognized

that no one could steal their checkbook and drain their bank account if a system like this was widely deployed.

Several companies have now commercialized the concept of identification at the point of sale, and I have brought some current examples of these technologies for demonstration purposes.

To properly serve the needs of elderly citizens, it may be necessary to make some adjustments to standard biometric systems.

For example, the aging process can reduce the suppleness of a person’s skin, which can present problems for finger scan technology.

The use of certain moisturizers and specially designed sensors can

significantly reduce this problem.

Another problem commonly associated with the aging process,

decreased visual acuity, can make it difficult for people to properly

position themselves for a facial scan or iris scan system. To overcome this challenge, vendors can offer more sophisticated camera

systems that automatically locate the subject’s face or eyes with little user effort.

As I mentioned earlier, for citizens who are physically unable to

interact with the biometrics system, an efficient and transparent

exception handling process is essential.

139

In conclusion, biometric technologies have already been shown to

be powerful tools for combatting the growing scourge of identity

theft that afflicts Americans, young and old. Thank you for your

time, and I welcome the opportunity to demonstrate some of these

technologies if time is available.

Senator CRAIG. Dennis, I will question you by allowing the demonstration at the end. How is that?

Mr. CARLTON. That is great, sir.

[The prepared statement of Mr. Carlton follows:]

140

141

142

Senator CRAIG. Let me turn to our other panelists for some questions.

Mari, obviously, you have been out on the front line, not only a

victim, but assisting victims and helping them. Who can an elderly

person go to to help them recover lost assets or fix damaged credit

histories? Who can they turn to?

Ms. FRANK. Right now, there really are not many places. There

are some legal aid places. There are some consumer agencies. But,

in effect, there are not many places for people to go. I mean, you

look at John Steven’s cost. Then there are attorneys but not many

will not take the cases on contingency. The FTC will just give you

advice, like Mr. Beales said. So there really are not a lot of places

that people can go unless people like me, who do pro bono work or

if they get my kit. It is really an unfortunate thing. One of the suggestions that I had was that States and maybe the Federal Government set up some kind of an ombudsman center for help for people

who really need it.

Senator CRAIG. Do you know if State Legal Aid Services assist

seniors?

Ms. FRANK. Some of them do, yes, and there are some senior citizen programs around the country, and maybe AARP refers. But

there is not anything really around—I have tried to refer people to

others who will do the work for them and they come back to me,

so that has been a problem.

Senator CRAIG. Thank you.

Boris, are bank tellers typically trained to spot the signs when

someone is trying to access an account under a false ID?

Mr. MELNIKOFF. Yes. In fact, a lot of the training information I

shared earlier in my testimony covers not only that, but also the

unusual transactions that a senior citizen might want to conduct,

which I think is an important factor. There have been many, many

instances where a senior citizen would come into a bank, approach

a teller. The teller will recognize the senior and the senior will

want to withdraw large sums of cash. All of that—and it is preventable, and a majority of banks do exercise all of their rights to

protect that consumer’s assets, if you will. So the answer on both

parts of the question, Senator, is yes. Bank tellers are trained to

accomplish that.

Senator CRAIG. Do financial institutions have the authority to report suspicious financial activity that looks like identity theft to

local authorities?

Mr. MELNIKOFF. Yes, sir. Through the use of a SAR, if you will,

and additionally, here again, reverting back to the elderly or senior

citizen withdrawing large sums of money, law enforcement in some

instances is notified at once in the hopes of talking the senior citizen out of removing that kind or those dollar limits. In nine out

of ten cases, it is nothing but a flim-flam that the senior is about

to experience. So, yes, sir, your answer is, yes, we do do that as

an industry.

Senator CRAIG. How do you effectively screen, because we have

obviously heard of those who are making applications for purchasing cars using false IDs, a failure on the part of that loan officer

to make a few simple calls to double-check addresses or anything

of that nature? Is there any effort underway to double-check, reVerDate 11-MAY-2000 13:37 Dec 09, 2002 Jkt 000000 PO 00000 Frm 00146 Fmt 6633 Sfmt 6633 C:\DOCS\82327.TXT SAGING1 PsN: SAGING1
143

check, if you will, this kind of informational flow that would establish a credit and, therefore, allow a transaction to occur?

Mr. MELNIKOFF. Yes, and I think just to tie in with the announcement made by Treasury yesterday, if you will, that possibly

would give the financial industry access to certain data as it pertains to the individual in the Social Security system. As we speak

today, we do not have that ability to do so. We rely on, and I hope

my colleague does not take any personal affront to this, but we rely

on the credit bureaus and other systems for verification. But as

mentioned earlier, the Colonel’s date of birth or his Social Security

number was issued prior to his birth. So we need to work on that,

and by having access for legitimate reasons, that would be a significant help to the financial industry and to verify and reverify

what we are doing.

Senator CRAIG. With the industry having to eat the cost once discovered, is there an annualized cost that identity theft is costing

the banking industry of this country? Do you know of one that has

been calculated?

Mr. MELNIKOFF. No, sir. There is no central repository. Now,

there were statements made earlier, and I made a statement with

respect to filing a SAR. But there are limits on the SAR, and the

limits are $5,000 up to $25,000. So there is no central repository,

so we really do not know.

But I think, and my opinion is, if you take all of the fraud that

the financial industry, to include all types of credit grantors, we

are probably looking at anywhere from $15 to $18 billion a year.

That is on one side only. Then coupled with the other frauds, be

it insurance fraud, Medicaid fraud, government fraud, with due respect, you are talking about another $10 to $15 billion. So fraud

costs this nation a significant amount of money and I think we can

do a much better job if we are allowed the tools or access to the

tools to do it.

Senator CRAIG. It sounds like precautionary training and devices

to detect and double-checking would be a rather inexpensive way

of solving some of those problems.

Mr. MELNIKOFF. It certainly would, sir, and we support it.

Senator CRAIG. Mari, I saw your hand come up. Yes?

Ms. FRANK. Yes, sir. Thank you so much. One of the things that

the Postal Inspector did for verification of addresses—this was

after we complained about this in 1998 when I testified before the

Technology Committee for the new Identity Theft Deterrence Act— was they started sending verification of address. So if you put in

for a change of address, they now will send a postcard to the old

address and the new address to see if you really have moved.

We have been asking the credit grantors and the banks to do the

same, because—what has happened to John when he became a victim, what happened to me, the fraudster will always change the

address. They have to do that so you do not find out about it. The

main step that the creditors should be doing is when they see that

the address that is on the application is different from the credit

report, that should be a key signal that they should verify address

with either a phone call or a postcard before they issue credit, and

I have been asking for this for 6 years and I do not see this happening now with the creditors.

144

Senator CRAIG. Well, that is a great lead-in comment, Stuart, to

turn to you. Mr. Pratt, do the credit reporting companies have the

authority to report suspicious financial activities that look like ID

theft to local authorities.

Mr. PRATT. We do not have any law like the one that permits

banks to permit, under the SAR, the system of SARs. I think

maybe the key question is, do we have the kind of information that

would allow us to even identify something suspicious? We are loading an enormous amount of information per month into the databases and so there is almost every variation on a theme in terms

of how files behave, if you will. Some people have very little credit.

Some people accumulate very little credit over long periods of time.

Other folks move frequently, so is an address change an indication

of a problem? Is a couple of new credit accounts an indication of

a problem?

So it may be a little bit difficult for us to pin down and say, aha,

this one looks suspicious relative to the 200 million files we maintain, relative to the two billion items of information updated every

month over the course of any given year, but we do not have an

official authority to do so, no.

Senator CRAIG. You did indicate to me, though, that certain activities cause you to trigger an account, or what was the term you

used in blocking an account or——

Mr. PRATT. Well, when a police report is submitted to us——

Senator CRAIG. When a police report is submitted.

Mr. PRATT. Yes, sir. Then we do use that as a way to escalate

service for the consumer who is a victim. It is a way for us to——

Senator CRAIG. Only in that instance, then?

Mr. PRATT. Only in that instance, because today, with the technology that is out there, if we cannot use a police report, almost

anyone can produce an affidavit. There is an awful lot of what we

call credit repair, fraudulent credit repair activity, which is a process by which a firm may charge a consumer hundreds of dollars to

then write letters and try to delete accurate but adverse information off the credit files.

So we have to have a way to distinguish between someone who

simply wants to eliminate important risk data for safety and

soundness of the banking system and someone who genuinely says,

I am a victim of a crime, help me quickly, help me now, and that

is what we do with the police report. That may not be the final answer, but that is our answer today, is to say a police report seems

like a reasonably safe and sound process—although, by the way, do

not miss that a fraudulent police report can be produced and we

have already received fraudulent police reports.

Senator CRAIG. I would think that if they can steal IDs, they

could steal a form and manufacture police reports that look fairly

legitimate.

Mr. PRATT. It is hard to distinguish real and falsified documents

of all kinds, and that is always the struggle for the industry.

Senator CRAIG. Then there is no reason in your mind to believe

that a change of address is something that would trigger a response to check to see if that was a legitimate change, or is that

simply going to be too costly for your——

145

Mr. PRATT. I do not think we are putting cost as the only metric

out there to measure a decision that we ought to make that would

help our system stay accurate—— Senator CRAIG. Well, I asked that—that was a legitimate question, where you get hundreds of millions of data—— Mr. PRATT. Let me put address changes—— Senator CRAIG [continuing]. You have got, therefore, probably

hundreds of thousands of requests for address changes a year—— Mr. PRATT. In fact, it is millions—— Senator CRAIG [continuing]. It does cost to verify.

Mr. PRATT. We receive, because of the—and this goes actually to

some of the Postal Service information as well as information from

Census—about 40 million addresses change every year in this

country. So it is difficult to use an address on its own as an indicator.

Also, many consumers on their credit file will probably have or

may have more than one accurate address. I may use one card for

my business purposes and so I may use my corporate address for

that particular credit card. So that billing, that report that comes

in every month from that particular lender shows my business address. Many of my other cards may be my home address, and so

I may even have two legitimate addresses which are reporting into

the system.

So admittedly, it is tough to pin it down and say, aha, this one

is unique and this one deserves some different kind of attention.

Senator CRAIG. What would be some of the unintended consequences of overly broad restrictions on the use of Social Security

numbers on credit reporting companies?

Mr. PRATT. For us, we have the Fair Credit Reporting Act that

says you must maintain reasonable procedures to assure maximum

possible accuracy. That was the law that Bill Proxmire passed back

in 1970.

Consumers have several expectations at the table at any given

time. One is, I want my information safe. Clearly, another one is,

I also want it to be accurate. My credit report is, in large part, how

I get my mortgage and how I do drive away with my car and how

I obtain credit and so on and so forth.

So with 40 million address changes a year, with what we estimate to be about three million last names changing in this country

due to marriage and divorce, with consumers sharing very similar

last names—for example, there are about 2.5 million Smiths in this

country and another two million Jones in this country, and so with

consumers with very straightforward, very common last names, to

keep that information separate, the SSN plays a very, very important role in the data accuracy, the data matching part of how we

build our databases.

So it really depends on the approach taken to restricting the

SSN, whether it directly applies to our business model or the members that we represent or whether it applies more generally out in

some other dimension.

Senator CRAIG. Stuart, you heard Mr. Stevens testify this morning. I am aware that you are familiar with his case to some degree.

Could you please tell me or the committee the status of that case

at this moment?

146

Mr. PRATT. I have committed to Mr. Stevens, and I have to follow

up with him to make sure I understand where he is in the process,

particularly in light of the fact that there apparently is another account that showed up on his file. I have to know which of the systems it showed up on. I have to see whether it showed up in all

three and then we will obviously follow up with him further.

One of the points, though, that Colonel Stevens made which is

important to us, as well, and we will have to understand this better, is if the account is being cycled through collection agencies, the

account number is not necessarily always reported to us, and so the

question is, can the credit bureau—we want to keep that bad data

off the file at all costs. There is nothing worse than sending to the

customer, the American Bankers Association member, false information, because obviously they are making the wrong decision.

They are missing out on a customer with whom they would like to

do business, first of all.

So one of the technical questions, which we do not have to wade

our way through here today, is, is there a collection reporting issue

that we have to look into a little bit further based on Colonel Stevens’ experience? But in terms of the specifics, obviously, I have

made a commitment to Colonel Stevens to follow up with him and

his wife and see where we are.

Senator CRAIG. That would be most helpful.

Mr. PRATT. Yes, sir.

Senator CRAIG. Before I go into this technology demonstration,

Mari, I gave you the first word. I will give you the last word, if it

is brief. [Laughter.]

Ms. FRANK. OK. Well, I guess I will say this about biometrics or

Social Security number. I am going to pick up on this. Biometrics,

or that piece of our body that we use as a unique identifier, in and

of itself, it is not good or bad. It is how it is used.

The one thing I want to bring up that he mentioned was this,

and this is the problem we are having with the Social Security

number, if you use the Social Security number as the gateway or

the key and you really do not spend a lot of time on other matching, like matching ages, birthdates, address, and you just focus on

that Social Security number, you are going to get a lot of

mismatches and a lot of errors and that causes that negligent information handling practices and fraud.

The same thing will happen with the biometric information. So

if my fingerprint is used and somehow nothing else matches and

there are these fraudsters and these techno-geniuses who can corrupt these files, and I have spoken with people in the Secret Service who have told me it can be done and I have read about it, so

if someone is using a piece of biometric information instead of the

Social Security number and there are still negligent information

handling practices, meaning there are not matches, then if I become a victim at that point, how do I prove who I am?

So the issue of biometrics is the same as the issue of Social Security number. We have to take a broader look and have greater

matching and verification. That is the issue. So I do not have a

problem with biometrics per se just how it may be misused.

Senator CRAIG. I think I heard Dennis say, and I am about to

be a victim of it, in a positive sense, that it is not 100 percent accuVerDate 11-MAY-2000 13:37 Dec 09, 2002 Jkt 000000 PO 00000 Frm 00150 Fmt 6633 Sfmt 6633 C:\DOCS\82327.TXT SAGING1 PsN: SAGING1
147

rate, and we understand it. But the application of it effectively creates a threshold that is important, I think.

I cannot disagree and I think there is one piece of information

amongst many that have emerged out of the testimonies today,

that checking and cross-checking and being cautious. Obviously,

the message that—well, my wife and I just went through an experience about a year ago with the loss of her father and, therefore,

working with her mother, and my wife is the trustee of the estate

and working with her mother as an elderly person in Tucson.

Frankly, our relationship with the bank was very positive. They

worked us over good when we went in with her mother to sit down

and begin to work with her on her accounts and her investments,

and it was a cross-check and a double-check. We were very pleased

by that in the end. It was a threshold that we had to get through.

In the first instance, there was almost an element of annoyance.

Here is a daughter and a mother sitting down together, but the

bank did not know that and other banks that they did business

with wanted my daughter’s signature and her presence there, so

that was a little different.

But I was very pleased to see that, that there was a very real

caution being taken there with this elderly person, because all of

a sudden, here were two younger people who by all appearances

were going to access potentially fairly large sums of money, so

Boris, that was a pleasing experience.

I have not yet adjourned this committee. Dennis, what do you

have in mind?

Mr. CARLTON. I have two demonstrations here, Senator, one of

iris scan technology and one of finger scan technology to show you

two different applications of how biometrics identifies an individual

it knows and will reject someone that it does not recognize. So—— Senator CRAIG. How do I explain if my finger scan shows up on

an FBI file? [Laughter.]

To my knowledge, that will not happen.

Mr. CARLTON. It will not here, Senator.

Senator CRAIG. All right, fine. I told staff, if I was going to subject myself to this and it was recorded on a CD, I got the CD.

[Laughter.]

Let me come over and see what you have.

Thank you, panelists, very much for the testimony you bring and

obvious experience that you have had on identity theft. The committee felt it was an important issue that we will continue to pursue and try to lift visibility, too, for the seniors of our country and,

of course, if you lift it to seniors, you will lift it to others, because

it is a growing concern, as we have said, nationwide, so we do appreciate that.

I am told that August 20 is National Senior Citizens Fraud

Awareness Week. The Attorney General and Postmaster General

will be speaking to that. I am pleased to hear that. It is obviously

time that we continue on a progressive basis to publicize these

issues, to draw public awareness to them.

I would like to insert in the record a statement submitted by

Marc Rotenberg, Executive Director of the Electronic Privacy Information Center.

[The prepared statement of Mr. Rotenberg follows:]

148

149

150

151

152

153

154

155

156

157

158

159

160

Senator CRAIG. Again, the committee thanks you all for your participation today and the committee will stand adjourned.

[Whereupon, at 11:49 a.m., the committee was adjourned.]

Æ