Spotlight: Chris Jay Hoofnagle
Page | 1 | 2 | 3 | 4 | 5 | 6 | 7 |

How hard is it to estimate the prevalence of identity theft, given the varying definitions of the crime and reliance on consumer complaint data?

Consumers: Be on high alert

• Prevalence of ID theft • Identification/authentication • ID theft losses • Phone company ID theft • Benefits of banks reporting fraud • Protection for consumers • Weird impulsivity • Recent improvements

It's difficult to assess the amount of identity theft for a number of reasons, including the fact that institutions that are victims are reluctant to discuss fraud events. And that's not a concern limited to identity theft. It's long been known that businesses don't want to talk about various ways that they've been defrauded because it erodes trust and public perception of the company.

So the institutions affected don't want publicity around it. But we're also seeing, and I think it's more difficult to deal with, issues of synthetic fraud. That's where an imposter makes up an identity, so through synthetic fraud, a consumer victim may never appear. And this all relates back to problems of using the Social Security number and authentication in lead generation in initial customer acquisition.

What should be done about the widespread use of Social Security numbers as identifiers? Is there a better way for companies to verify identity?

It's clear that no single identifier is a single bullet, and if there's a transition to a new identifier, the new identifier will become a target for fraudsters.

I think that as the new red flag rules specify, one has to have a flexible approach to dealing with these problems. Authentication shouldn't rely on Social Security number and birth date alone. There should be other authenticators in addition to the Social Security number.

I think the basic problem is that the Social Security number is used for identification and authentication. If used for just identification, I think that many synthetic claims could be identified by matching Social Security numbers to names -- which I know is not always possible. So that's just one way of doing it. You can use previous addresses, phone numbers etc., but currently the competition for new customers is driving reliance on Social Security number alone.