No single hotline or database captures the universe of identity theft victims. Some individuals do not even know that they have been victimized until months after the fact, and some known victims may not know to report or may choose not to report to the police, credit bureaus, or established hotlines. Thus, it is difficult to fully or accurately measure the prevalence of identity theft. Some of the often-quoted estimates of prevalence range from one-quarter to three-quarters of a million victims annually. Generally speaking, the higher the estimate of identity theft prevalence, the greater the (1) number of victims who are assumed not to report the crime and (2) number of hotline callers who are assumed to be victims rather than “preventative” callers. However, we found no information to confirm the extent to which these assumptions are valid. Nevertheless, although it is difficult to specifically or comprehensively quantify identity theft, a number of data sources can be used as proxies or indicators for gauging the prevalence of such crime. These sources include the three national consumer reporting agencies that have call-in centers for reporting identity fraud or theft; the Federal Trade Commission (FTC), which maintains a database of complaints concerning identity theft; the SSA/OIG, which operates a hotline to receive allegations of SSN misuse and program fraud; and federal law enforcement agencies—Department of Justice components, Department of the Treasury components, and the Postal Inspection Service—responsible for investigating and prosecuting identity theft- related cases. Each of these various sources or measures seems to indicate that the prevalence of identity theft is growing. According to the three national consumer reporting agencies, the most reliable indicator of the incidence of identity theft is the number of long- term (generally 7 years) fraud alerts placed on consumer credit files. Fraud alerts constitute a warning that someone may be using the consumer’s personal information to fraudulently obtain credit. Thus, a purpose of the alert is to advise credit grantors to conduct additional identity verification or contact the consumer directly before granting credit. One of the three consumer reporting agencies estimated that its 7- year fraud alerts involving identity theft increased 36 percent over 2 recent years—from about 65,600 in 1999 to 89,000 in 2000. A second agency reported that its 7-year fraud alerts increased about 53 percent in recent comparative 12-month periods; that is, the number increased from 19,347 during one 12-month period (July 1999 through June 2000) to 29,593 during the more recent period (July 2000 through June 2001). The third agency reported about 92,000 fraud alerts for 2000 but was unable to provide information for any earlier year. The federal Identity Theft Act (P.L. 105-318) required the FTC to “log and acknowledge the receipt of complaints by individuals who certify that they have a reasonable belief” that one or more of their means of identification have been assumed, stolen, or otherwise unlawfully acquired. In response to this requirement, on November 1, 1999, FTC established a toll-free telephone hotline (1-877-ID-THEFT) for consumers to report identity theft. Information from complainants is accumulated in a central database (the Identity Theft Data Clearinghouse) for use as an aid in law enforcement and prevention of identity theft. From its establishment in November 1999 through September 2001, FTC’s Identity Theft Data Clearinghouse received a total of 94,100 complaints from victims, including 16,784 complaints transferred to the FTC from the SSA/OIG. In the first month of operation, the Clearinghouse answered an average of 445 calls per week. By March 2001, the average number of calls answered had increased to over 2,000 per week. In December 2001, the weekly average was about 3,000 answered calls. However, FTC staff noted that identity theft-related statistics may, in part, reflect enhanced consumer awareness and reporting. SSA/OIG operates a fraud hotline to receive allegations of fraud, waste, and abuse. In recent years, SSA/OIG has reported a substantial increase in calls related to identity theft. For example, allegations involving SSN misuse increased more than fivefold, from about 11,000 in fiscal year 1998 to about 65,000 in fiscal year 2001. A review performed by SSA/OIG of a sample of 400 allegations of SSN misuse indicate that up to 81 percent of all allegations of SSN misuse related directly to identity theft. “… our office has investigated numerous cases where individuals apply for benefits under erroneous SSNs. Additionally, we have uncovered situations where individuals counterfeit SSN cards for sale on America’s streets. From time to time, we have even encountered SSA employees who sell legitimate SSNs for hundreds of dollars. Finally, we have seen examples where SSA’s vulnerabilities in its enumeration business process [i.e., the process for issuing SSNs] adds to the pool of SSNs available for criminal fictitious identities.” Although federal law enforcement agencies do not have information systems that specifically track identity theft cases, the agencies provided us with statistics for identity theft-related crimes. Regarding bank fraud, for instance, the FBI reported that its arrests increased from 579 in 1998 to 645 in 2000—and was even higher (691) in 1999. The Secret Service reported that, for recent years, it has redirected its identity theft-related efforts to focus on high-dollar, community-impact cases. Thus, even though the total number of identity theft-related cases closed by the Secret Service decreased from 8,498 in fiscal year 1998 to 7,071 in 2000, the amount of fraud losses prevented in these cases increased from a reported average of about $73,000 in 1998 to an average of about $218,000 in 2000. The Postal Inspection Service, in its fiscal year 2000 annual report, noted that identity theft is a growing trend and that the agency’s investigations of such crime had “increased by 67 percent since last year.” “The availability of information on the Internet, in combination with the advances in computer hardware and software, makes it easier for the criminal to assume the identity of another for the purposes of committing fraud. For example, there are web-sites that offer novelty identification cards (including the hologram). After downloading the format, fonts, art work, and hologram images, the information can be easily modified to resemble a state- issued driver’s license. In addition to drivers’ licenses, there are web-sites that offer birth certificates, law enforcement credentials (including the FBI), and Internal Revenue Service forms.” Similarly, the SSA/OIG has noted that, “The ever-increasing number of identity theft incidents has exploded as the Internet has offered new and easier ways for individuals to obtain false identification documents, including Social Security cards.” Aliens and others have used identity theft or other forms of identity fraud to create fraudulent documents that might enable individuals to enter the country and seek job opportunities. With nearly 200 countries using unique passports, official stamps, seals, and visas, the potential for immigration document fraud is great. In addition, more than 8,000 state or local offices issue birth certificates, driver’s licenses, and other documents aliens can use to establish residency or identity. This further increases the number of documents that can be fraudulently used by aliens to gain entry into the United States, obtain asylum or relief from deportation, or receive such other immigration benefits as work permits or permanent residency status. Reportedly, large-scale counterfeiting has made employment eligibility documents widely available. For example, in May 1998, INS seized more than 24,000 counterfeit Social Security cards in Los Angeles after undercover agents purchased 10,000 counterfeit INS permanent resident cards from a counterfeit document ring. Generally, when a person attempts to enter the United States at a port of entry, INS inspectors require the individual to show one of several documents that would prove identity and/or authorize entry. These documents include border crossing cards, alien registration cards, nonimmigrant visas, U.S. passports or other citizenship documents, foreign passports or citizenship documents, reentry permits, refugee travel documents, and immigrant visas. At ports of entry, INS inspectors annually intercept tens of thousands of fraudulent documents presented by aliens attempting to enter the United States. As table 1 shows, INS inspectors intercepted over 100,000 fraudulent documents annually in fiscal years 1999 through 2001. Generally, about one-half of all the intercepted documents were border crossing cards and alien registration cards. The availability of jobs is one of the primary magnets attracting illegal aliens to the United States. Immigration experts believe that as long as opportunities for employment exist, the incentive to enter the United States illegally will persist and efforts at the U.S. borders to prevent illegal entry will be undermined. The Immigration Reform and Control Act (IRCA) of 1986 made it illegal for employers to knowingly hire unauthorized aliens. IRCA requires employers to comply with an employment verification process intended to provide employers with a means to avoid hiring unauthorized aliens. The process requires newly hired employees to present documentation establishing their identity and eligibility to work. From a list of 27 acceptable documents, employees have the choice of presenting 1 document establishing both identity and eligibility to work (e.g., an INS permanent resident card) or 1 document establishing identity (e.g., a driver’s license) and 1 establishing eligibility to work (e.g., a Social Security card). Generally, employers cannot require the employees to present a specific document. Employers are to review the document or documents that an employee presents and complete an Employment Eligibility Form, INS Form I-9. On the form, employers are to certify that they have reviewed the documents and that the documents appear genuine and relate to the individual. Employers are expected to judge whether the documents are obviously fraudulent. INS is responsible for checking employer compliance with IRCA’s verification requirements.