No single hotline or database captures the universe of identity theft victims. Some individuals do not even know that they have been victimized until months after the fact, and some known victims may choose not to report to the police, credit bureaus, or established hotlines. Thus, it is difficult to fully or accurately quantify the prevalence of identity theft. Some of the often-quoted estimates of prevalence range from one-quarter to three-quarters of a million victims annually. Usually, these estimates are based on limited hotline reporting or other available data, in combination with various assumptions regarding, for example, the number of victims who do not contact credit bureaus, the FTC, the SSA/OIG, or other authorities. Generally speaking, the higher the estimate of identity theft prevalence, the greater the (1) number of victims who are assumed not to report the crime and (2) number of hotline callers who are assumed to be victims rather than “preventative” callers. We found no information to gauge the extent to which these assumptions are valid. Additionally, there are no readily available statistics on the number of victims who may have contacted their banks or credit card issuers only and not the credit bureaus or other hotlines. Nevertheless, although not specifically or comprehensively quantifiable, the prevalence and cost of identity theft seem to be increasing, according to the available data we reviewed and many officials of the public and private sector entities we contacted. The following presents summary information for each of the topics that we addressed. More detailed information is presented in appendixes II through V, respectively. As we reported in 1998, there are no comprehensive statistics on the prevalence of identity theft. Similarly, during our current review, various officials noted that precise, statistical measurement of identity theft trends is difficult due to a number of factors. Generally, federal law enforcement agencies do not have information systems that facilitate specific tracking of identity theft cases. For example, while the amendments made by the Identity Theft Act are included as subsection (a)(7) of section 1028, Title 18 of the U.S. Code, EOUSA does not have comprehensive statistics on offenses charged specifically under that subsection. EOUSA officials explained that, except for certain firearms statutes, docketing staff are asked to record cases under only the U.S. Code section, not the subsection or the sub-subsection. Also, the FBI and the Secret Service noted that identity theft is not typically a stand-alone crime; rather, identity theft is almost always a component of one or more white-collar or financial crimes, such as bank fraud, credit card or access device fraud, or the use of counterfeit financial instruments. Nonetheless, while recognizing measurement difficulties, a number of data sources can be used as proxies or indicators for gauging the prevalence of such crime. These sources can include consumer complaints and hotline allegations, as well as law enforcement investigations and prosecutions of identity theft-related crimes such as bank fraud and credit card fraud. Each of these various sources or measures seems to indicate that the prevalence of identity theft is growing: Consumer reporting agency data. Generally, in the view of consumer reporting agency officials, the most reliable indicator of the incidence of identity theft is the number of 7-year fraud alerts placed on consumer credit files. Generally, fraud alerts constitute a warning that someone may be using the consumer’s personal information to fraudulently obtain credit. Thus, a purpose of the alert is to advise credit grantors to conduct additional identity verification or contact the consumer directly before granting credit. One of the three consumer reporting agencies estimated that its 7-year fraud alerts involving identity theft increased 36 percent over 2 recent years—from about 65,600 in 1999 to 89,000 in 2000. A second agency reported that its 7-year fraud alerts increased about 53 percent in recent comparative 12-month periods; that is, the number increased from 19,347 during one 12-month period (July 1999 through June 2000) to 29,593 during the more recent period (July 2000 through June 2001). The third agency reported about 92,000 fraud alerts for 2000 but was unable to provide information for any earlier year. Also, due largely to increased public awareness about identity theft, the number of inquiries received by the fraud units of consumer reporting agencies is at an all-time high. However, an industry official opined that the number of inquiries is not a reasonable measure of the incidence of identity theft because virtually all individuals whose wallet or purse is lost or stolen will now call the consumer reporting agencies as a precautionary measure. FTC data. From its establishment in November 1999 through September 2001, FTC’s Identity Theft Data Clearinghouse received a total of 94,100 complaints from victims, including 16,784 complaints transferred to the FTC from the SSA/OIG. In the first month of operation, the Clearinghouse answered an average of 445 calls per week. By March 2001, the average number of calls answered had increased to over 2,000 per week. In December 2001, the weekly average was about 3,000 answered calls. However, FTC officials noted that identity theft-related statistics may, in part, reflect enhanced consumer awareness and reporting. SSA/OIG data. SSA/OIG has reported a substantial increase in call-ins of identity theft-related allegations to its Fraud Hotline in recent years. Allegations involving SSN misuse, for example, increased more than fivefold, from about 11,000 in fiscal year 1998 to about 65,000 in fiscal year 2001. To some extent, the increased number of allegations may be due to additional Fraud Hotline staffing, which increased from 11 to over 50 personnel during this period. However, SSA/OIG officials attributed the trend in allegations partly to a greater incidence of identity theft. Also, irrespective of staffing levels, SSA/OIG data indicate that about 81 percent of all allegations of SSN misuse relate directly to identity theft. Federal law enforcement data. Generally, although federal law enforcement agencies do not have information systems that facilitate specific tracking of identity theft cases, the agencies provided us case statistics for identity theft-related crimes. Regarding bank fraud, for instance, the FBI reported that its arrests increased from 579 in 1998 to 645 in 2000—and was even higher (691) in 1999. The Secret Service reported that, for recent years, it has redirected its identity theft-related efforts to focus on high-dollar, community-impact cases. Thus, even though the total number of identity theft-related cases closed by the Secret Service decreased from 8,498 in fiscal year 1998 to 7,071 in 2000, the amount of fraud losses prevented in these cases increased from a reported average of $73,382 in 1998 to an average of $217,696 in 2000. The Postal Inspection Service, in its fiscal year 2000 annual report, noted that identity theft is a growing trend and that the agency’s investigations of such crime had “increased by 67 percent since last year.” (See app. II.) We found no comprehensive estimates of the cost of identity theft to the financial services industry. Some data on identity theft-related losses—such as direct fraud losses reported by the American Bankers Association (ABA) and payment card associations—indicated increasing costs. Other data, such as staffing of the fraud departments of banks and consumer reporting agencies, presented a mixed and/or incomplete picture. For example, one consumer reporting agency reported that staffing of its fraud department had doubled in recent years, whereas another agency reported relatively constant staffing levels. Furthermore, despite concerns about security and privacy, the use of e-commerce has grown steadily in recent years. Such growth may indicate greater consumer confidence but may also have resulted from an increase in the number of people who have access to Internet technology. Regarding direct fraud losses, in its year 2000 bank industry survey on check fraud, the ABA reported that total check fraud-related losses against commercial bank accounts—considering both actual losses ($679 million) and loss avoidance ($1.5 billion)—reached an estimated $2.2 billion in 1999, which was twice the amount in 1997. Regarding actual losses, the report noted that the 1999 figure ($679 million) was up almost 33 percent from the 1997 estimate ($512 million). However, not all check fraud- related losses were attributed to identity theft, which the ABA defined as account takeovers (or true name fraud). Rather, the ABA reported that, of the total check fraud-related losses in 1999, the percentages attributable to identity theft ranged from 56 percent for community banks (assets under $500 million) to 5 percent for superregional/money center banks (assets of $50 billion or more), and the average for all banks was 29 percent. The two major payment card associations, MasterCard and Visa, use very similar (although not identical) definitions regarding which categories of fraud constitute identity theft. Generally, the associations consider identity theft to consist of two fraud categories—account takeovers and fraudulent applications. Based on these two categories, the associations’ aggregated identity theft-related losses from domestic (U.S. operations) rose from $79.9 million in 1996 to $114.3 million in 2000, an increase of about 43 percent. The associations’ definitions of identity theft-related fraud are relatively narrow, in the view of law enforcement, which considers identity theft as encompassing virtually all categories of payment card fraud. Under this broader definition, the associations’ total fraud losses from domestic operations rose from about $700 million in 1996 to about $1.0 billion in 2000, an increase of about 45 percent. However, according to the associations, the annual total fraud losses represented about 1/10th of 1 percent or less of U.S. member banks’ annual sales volume during 1996 through 2000. Generally, the fraud losses are borne by the respective financial institution that issued the payment card.