Identity Theft: Making the Known Unknowns Known

TABLE OF CONTENTS I. INTRODUCTION II. THE KNOWN KNOWNS: IDENTITY THEFT A. New Account Fraud B. Account Takeover III. THE KNOWN UNKNOWNS A. Missing Data and Other Limitations of Identity Theft Surveys B. Law Enforcement Statistics Do Not Capture the Problem IV. MAKING THE KNOWN UNKNOWNS KNOWN A. Mandated Public Reporting of Identity Theft Incidence and Severity B. Who Should Report and to Whom V. THE CHALLENGES OF THE REPORTING APPROACH A. Institutions Themselves Are Not Always Aware of Identity Theft B. Reporting Could Enable Fraud C. Reporting Will Pit Financial Institutions Against Victims D. The Market Will Solve the Identity Theft Problem VI. THE BENEFITS OF THE REPORTING APPROACH A. Reporting Will Identify the Most Vulnerable Practices B. Reporting Will Provide Metrics for Interventions C. Reporting Will Focus Public Attention on the Real Problem D. A More Competitive Market for Protecting Consumers Will Arise VII. CONCLUSION I. INTRODUCTION REPORTS THAT SAY THAT SOMETHING HASN'T HAPPENED ARE ALWAYS INTERESTING TO ME, BECAUSE AS WE KNOW, THERE ARE KNOWN KNOWNS; THERE ARE THINGS WE KNOW WE KNOW. WE ALSO KNOW THERE ARE KNOWN UNKNOWNS; THAT IS TO SAY WE KNOW THERE ARE SOME THINGS WE DO NOT KNOW. BUT THERE ARE ALSO UNKNOWN UNKNOWNS--THE ONES WE DON'T KNOW WE DON'T KNOW. (1) There is widespread agreement that identity theft causes financial damage to consumers, creditors, retail establishments, and the economy as a whole. (2) The Federal Trade Commission ("FTC") has identified it as the fastest growing white collar crime; (3) federal and state governments have enacted numerous laws to curb its incidence and severity. (4) The contours of the identity theft problem, however, are known unknowns: no one knows the prevalence of identity theft, the relative rates of "new account fraud" and "account takeover," (5) or the effect this crime has on the economy. What is more, the advent of "synthetic" identity theft (6) has exacerbated these measurement difficulties. These known unknowns present serious problems. They hamper attempts to evaluate the scope of the crime and to allocate law enforcement resources more efficiently. They also prevent us from determining whether various consumer protection interventions have been effective. Because of these unknowns, we cannot tell whether consumers, regulators, and businesses are over- or under-reacting to the crime. They prevent us from evaluating how the costs of the crime are distributed in society. These unknowns even foreclose the basic determination of whether the prevalence or severity of identity theft has changed over time. Why, despite increases in identity theft, are law enforcement, the public, industry, or policymakers unable to measure the crime accurately? This Article argues that the answer lies in the methods used to measure the problem. What we do know has been learned through telephone and Internet surveys; however, few in-depth studies have been done. (7) While well-intentioned and valuable for some purposes in the identity theft policy debate, these surveys cannot completely document the contours of the crime. More fundamentally, however, we are asking the wrong people about the crime. The surveys seek to obtain information about identity theft from its victims--individuals who have the most limited view of the problem. Victims often do not know how their personal data were stolen or who stole the information. Financial institutions are in a better position to report information on identity theft. If lenders and organizations that control access to accounts (including payment companies such as PayPal and Western Union) were required to provide statistics about identity theft, a more complete and detailed picture would emerge. However, these data have significant potential to cause embarrassment and attract unwanted regulatory attention, which may explain why these institutions have not made these data publicly available. …