The Identity Theft and Assumption Deterrence Act of 1998 made identity theft a federal crime. Although FTC does not have the authority to bring criminal cases, the act established FTC as the federal clearinghouse for identity theft complaints. FTC is required to keep a log of such complaints and to notify consumers that their complaints have been received. In response to this requirement, in November 1999 FTC established the Identity Theft Data Clearinghouse to gather information from consumers who file complaints or inquire about identity theft. FTC inputs this information into its Consumer Sentinel database, which is used by more than 1,000 law enforcement agencies. According to FTC, the number of identity theft complaints it has received has steadily risen each year— climbing from 31,000 in 2000 to 247,000 in 2004. FTC staff noted that the increase in reported instances of identity theft may in part reflect enhanced consumer awareness and willingness to report such crimes. However, not all identity theft victims contact FTC. No single federal law enforcement agency has primary jurisdiction over identity theft crimes. Identity theft is not typically a stand-alone crime but rather a component of one or more crimes such as bank fraud, credit card fraud, social program fraud, tax refund fraud, and mail fraud. For example, a fraudster might steal another individual’s personal identifying information in one city and use the information to commit credit card fraud and mail fraud in another city or state. Consequently, a number of federal law enforcement agencies can have a role in investigating identity theft crimes, including the Federal Bureau of Investigation (FBI), Internal Revenue Service, U.S. Postal Inspection Service, U.S. Secret Service, and the Social Security Administration’s Office of the Inspector General. The Department of Justice (DOJ) prosecutes federal identity theft cases. The FACT Act of 2003, among other things, strengthened victims’ rights with respect to identity theft and gave FTC and businesses a larger role in dealing with identity theft crimes. The act also highlighted the need for law enforcement agencies to assist victims in documenting their identity theft crime. Section 609(e) requires business entities to provide victims of identity theft with information on fraudulent business transactions—for example, copies of applications for credit or records of purchases. In the past, businesses have been reluctant to provide such information, fearing their potential exposure to lawsuits for the inappropriate disclosure of sensitive personal financial information. To address this concern, Congress added a provision protecting businesses from civil liability claims for disclosing such information. In addition, the FACT Act reinforces the need for police to assist victims in taking official reports. These reports can then be used to substantiate claims of identity theft when alleged victims request, for example, copies of business records involving instances of potential fraud. The FACT Act also requires that FTC develop a model summary of rights for consumers who believe that they are victims of identity theft (see app. II). CRAs are required to provide a substantially similar version of the model summary of identity theft victim rights to any consumer who “contacts a consumer reporting agency and expresses a belief that the consumer is a victim of fraud or identity theft.” As previously mentioned, the act mandated that FTC launch a public campaign on how to prevent identity theft by December 2005, but did not specifically require that section 609(e) be included in the campaign. At the time of our review, some efforts to educate consumers, business entities, and local enforcement officials about their rights and obligations under section 609(e)—notably efforts undertaken by the FTC, U.S. Postal Inspection Service, International Association of Chiefs of Police, and National Credit Union Administration—were under way. We found that while most of the federal agencies and law enforcement agencies and other groups that we contacted were engaged in outreach related to identity theft issues, those efforts generally did not have a component specifically addressing section 609(e). In particular, FTC staff told us that outreach for section 609(e) would be part of broader efforts to educate the public, business entities, and law enforcement officials about identity theft and FACT Act provisions and that outreach on 609(e) would increase beginning in December 2005 as part of its public identity theft campaign. As of June 2005, outreach efforts by a variety of interest groups, including businesses and their trade groups, federal law enforcement agencies, and banking regulators, were also just beginning. Most of these groups saw FTC as having primary responsibility for outreach. FTC staff told us that they have undertaken a number of outreach efforts to educate the public, law enforcement, and others on the FACT Act, including section 609(e). However, FTC staff explained that section 609(e) is only one tool in the resources available to victims for remedying the effects of identity theft and that FTC’s first priority is to make those affected aware of all of the relevant provisions contained in the FACT Act. Since 2004, FTC in conjunction with federal law enforcement agencies has cosponsored six conferences and presentations geared directly to local law enforcement, which included a discussion on the FACT Act. In addition, since January 2004 FTC has participated in more than 50 conferences, seminars, and presentations on the FACT Act involving attorneys, bar associations, business trade groups, financial institutions and state regulators. FTC staff told us that these outreach efforts addressed increasing the awareness of section 609(e) provisions, as appropriate to the particular audience. Other FTC outreach efforts on section 609(e) include links on FTC’s Web site at www.consumer.gov/idtheft to its model summary of identity theft victim rights and other information on identity theft, a toll-free hotline (1-877-IDTHEFT) offering counseling to help consumers who want or need more information about dealing with the consequences of identity theft, and FTC’s Consumer Response Center and Distribution Office that provides publications on identity theft, among other topics. For example, FTC recently updated its identity theft booklet, renamed Take Charge: Fighting Back Against Identity Theft, to incorporate the FACT Act requirements, including section 609(e). Further, FTC has included section 609(e) in the mandated summary of identity theft victim rights that the CRAs began distributing in January 2005. At the time of our review, this summary was the primary mechanism for providing consumers with information on their right to obtain business records on potentially fraudulent transactions. According to FTC staff, FTC’s Web site on identity theft included links to section 609(e) as of its effective date of June 1, 2004, which was subsequently integrated into an updated identity theft Web site. According to FTC staff, section 609(e) will also be incorporated into the public education campaign that FTC is required by the FACT Act to implement by December 2005 which will help increase outreach on the provisions. FTC staff told us that the agency has conducted outreach on privacy, consumer reporting, identity theft, and related legislation and regulations for several years and that the initiatives target consumers, businesses, and law enforcement agencies. FTC conducts its identity theft education campaign through its Web site, printed publications, conferences and presentations, syndicated news articles and newscasts, training sessions, communications with state attorneys general, and visits to high school and college campuses. It also holds seminars for small businesses that may not be active with trade groups. Additionally, the agency provides counseling over the telephone to consumers who contact FTC with complaints or inquiries about identity theft. FTC staff explained that the agency attempts to leverage its resources to conduct outreach—that is, it relies on consumers, law enforcement agencies, and businesses to spread the relevant information it provides among one another. FTC staff stated that the mandated public education campaign would build upon and become a component of FTC’s ongoing consumer and business education campaigns. FTC staff stated that the mandated campaign will be under way by the December 2005 deadline and will include coverage of section 609(e). The staff told us that in terms of its identity theft outreach to consumers, FTC’s priority is for consumers to know that FTC is the organization that consumers should contact if they need information or assistance with identity theft problems. They added that requesting business transaction records under section 609(e) is not the first step an identity theft victim takes to restore his or her credit. According to FTC staff, the campaign will focus on all aspects of identity theft prevention and remediation as well as informing consumers, businesses, and law enforcement agencies about the new rights and responsibilities discussed in section 609(e) and other provisions that are useful to consumers. At the time of our review, FTC could not provide us with information on the exact extent of coverage that section 609(e) would receive in FTC’s outreach materials to consumers and businesses. FTC did provide us with a copy of its identity theft public education solicitation dated June 1, 2005. According to the solicitation, one of the expected targets of the campaign are identity theft victims with the goal of assisting those victims in the recovery process by teaching them the steps to take to reclaim their good names. FTC plans to evaluate the effectiveness of the public outreach campaign using various means. According to the solicitation, the program plan for the public education campaign is expected to include strategies for monitoring and evaluation of program results. FTC staff also told us that they also intend to monitor and evaluate the results of this contract through traffic to the identity theft Web site, publications distribution, and identity theft complaints to the FTC. We found that a variety of outreach efforts on identity theft were under way or were being planned by businesses, trade groups, law enforcement agencies, federal banking regulators, and consumer groups. We were able to obtain only limited information on efforts undertaken by businesses and their trade groups and associations. A few business trade group representatives told us that they had been active in reaching out to their constituents on identity theft issues through presentations and newsletters.