Identity Thieves Not Big On Technology

alphadogg sends us to Network World, as is his wont, for a summary of a new study of identity theft based on the outcomes of more than 500 Secret Service cases from 2000 to 2006. Here is the study report (PDF). The AP has coverage emphasizing other slants on the findings. Among the surprises: just 51% of convicted ID thieves were sent to prison. Only 20% of the cases involved use of the Internet, and such cases may be on the decline. More perpetrators used good old-fashioned dumpster diving and stealing stuff out of mailboxes.

Comments

Lies, Damn Lies, and Statistics...

[gbulmash]

From the AP article: "The Federal Trade Commission has said about 3 million Americans have their identities stolen annually." And this study covers 517 cases over 7 years (2000-2006). I'm sorry, but I can't see a study of 517 cases during a period of approx. 21 million crimes providing really useful data.

Re:Three more

[stefanlasiewski]

Nuke it from orbit; it's the only way to be sure.

You're making a poor assumption

[Chmcginn]

The 99% margin of error on this study is about 5.5% (e.g. there is a 99% chance that the real percentages are within 5.5 points of the reported percentages). If the sample size were 1000, we would see a margin of error of 4%, and a we'd need a sample size of 10,000 to give us a 1.2% margin of error.

This assumes that the cases taken were representative of all cases in the United States, and were randomly selected out of the pool of available cases. Considering that the Secret Service only gets involved in certain cases of identity theft, this is probably an incorrect assumption.

Re:Three words

[stefanlasiewski]

A shredder doesn't help when a credit card company delivers a pre-approved credit card offer, or when the community college uses your SSN as your 'Student Identification Number' on a freshly printed postcard.

If Credit Card companies really cared about identity theft, then why do they mail out millions of unsolicited, pre-approved credit card offers every year? Even if someone signs up for the 'opt-out' list, some unscrupulous lenders will ignore the list and send unsolicited offers in the mail.

What percentage of identity theft occurs from someone stealing one of those little envelopes, I wonder.

Alternate explaination:

[Anonymous Coward]

Only 20% of the cases involved use of the Internet, and such cases may be on the decline.

Law enforcement is becoming less and less effective at identifying and prosecuting electronic identity theft. After all, only 20% of thieves who got caught used the internet.

You aren't taking the long view.

[khasim]

The big money is not in taking cash out of someone's account and hoping that they don't notice.

Here, you know what databases are, right? Think of a database of every possible Social Security Number.

Then, think about a criminal organization filling in the information they can find from various sources.

SSN - FName - LName - DoB - MomMaiden - Address - SpouseLink - Child1 - Child2 ..... BankAccnt1 - BankAccnt2 etc

Fill in enough of that information and you can use it to get info on the numbers you don't have filled in.

Now, they are you, as far as any financial institution is concerned. They can take out a second mortgage on your house. They can buy a car in your name. They can steal more from you than you have in any of your accounts.

They can even try to cash out your 401k. They are you.

Wrong Statistic

[cale]

Looking at the number of cases closed is the wrong statistic. In combating the problem of identity theft, or online fraud in the larger sense, what really matters are the actual losses associated with each case.

I don't really care if some mope dug through my dumpster, stole my credit card pre-approvals, and got caught using the fake card running up $200 worth of porn purchases. The case I worry about is the single criminal or criminal organization that systematically steals millions of pieces of credit card data and efficiently exploits each piece to the maximum extent possible.

If the investigation of each of those scenarios is one case then they have equal weight under the statistic used by the article. In terms of actually combating identity theft the latter example and the resultant prosecution is much more important and effective. Unless they discuss the loss amounts associated with cases of each case, this statistic, the conclusions based on it, and the entire article are missing the point and not talking about actually fighting identity theft and are instead talking about looking like you are fighting identity theft.

The other comments are completely on the money pointing out that this is only closed cases and the difficulty of actually closing an international investigation.

All in all another wholly misinformed article about the real threat of identity theft and online financial fraud.