Identity Theft: The Scope of the Problem
By Jonathan J. Rusch - Deputy Chief, Fraud Section, Criminal Division - US DOJ
United States Attorneys' Bulletin, March 2008
Identity theft is considered to be one of the most pervasive forms of white-collar crime in the United States. According to an October 2006 survey by Javelin Strategy & Research, more than 8.4 million U.S. adults were victims of identity theft in the preceding year. Rachel Kim et al., 2007 Identity Fraud Survey Report, Javelin Strategy & Research, February 2007, abridged version. While this crime takes many forms—from local vehicle break-ins and trash theft (see, e.g., United States v. Gonzales, 7:04 CR021-R (N.D. Tex., Oct. 21, 2005), to international Web sites gathering personal data (see Press Release, Sophos, The Italian Job: 26 arrested for Poste Italiane phishing attack (July 16, 2007)) "it invariably leaves victims with the task of repairing the damage to their lives." President's Identity Theft Task Force, Combating Identity Theft: a Strategic Plan, President's Identity Theft Task Force, April 2007, page 1.
II. Types of harm from identity theft
A. Financial harm
In the aggregate, victims of identity theft suffer substantial losses. Estimates of aggregate losses due to identity theft vary, but the President's Identity Theft Task Force stated that "the data show that annual monetary losses are in the billions of dollars." Id. at 11. The 2006 Javelin Research survey found that losses to businesses and others due to identity fraud totaled $56.6 billion. Rubina Johannes et al., 2006 Identity Fraud Survey Report, Javelin Strategy & Research, January 2006, abridged version.
There are many ways in which victims of identity theft may suffer direct financial harms, varying with the types of information that identity thieves obtain and the ways in which that information is used. These include misuse of their existing credit cards and debit card accounts, opening new accounts (including credit or debit card, loan, and utilities) by criminals, issuance of government benefits or services in the victims' names to unqualified individuals, and purchases of motor vehicles and other valuable items with the victims' funds or credit. See, e.g., Federal Trade Commission, Take Charge: Fighting Back Against Identity Theft, Feb. 2006. Victims generally are not liable for debts that identity thieves create in their names. If the misuse involves a consumer's existing credit card account, it can be relatively easy for the consumer to remedy the situation by calling the card issuer, reporting the fraudulent transactions, and providing supporting information. If the misuse involves a consumer's existing debit card or checking account, the victim should ultimately be able to have the fraudulently obtained funds restored to the account, pending resolution of the claim by the financial institution. The consumer, however, may be temporarily deprived of access to those funds. In addition, in cases involving creation of new credit card accounts, the victim may not learn of the identity theft until a creditor or debt collector contacts him or her. That contact may not take place until after the identity thief has already used those accounts and amassed substantial debt in the victim's name.
Unfortunately, victims may have to spend hundreds, if not thousands, of dollars recovering from the crime. Expenses may include notary fees, certified mailings, hiring of counsel, and lost income. Nonfinancial losses, such as lost time spent correcting credit reports, disputing fraudulent accounts, and obtaining new identity documents, also can be substantial, as described below.
Although many cases of identity theft involve smaller amounts of money, ranging from a few dollars to a few hundred dollars, other identity thefts can lead to more substantial losses. The 2006 Javelin Strategy survey found that, while the median fraud amount per victim was $750, the mean fraud amount per fraud victim was $5,720. Rubina Johannes et al., 2006 Identity Fraud Survey Report, Javelin Strategy & Research, January 2006. Because the median (the midpoint of the range of losses per victim, where half are below and half above that midpoint) is substantially lower than the mean (the total losses divided by the number of victims), these data indicate that many identity theft victims have lost thousands of dollars, if not more. See, e.g., National Institute of Standards and Technology (NIST)/Sematech, Engineering Statistics Handbook § 220.127.116.11 (July 18, 2006). While losses of this magnitude can be burdensome for more affluent individuals, they are devastating for persons of more modest means. Two instances that the President's Identity Theft Task Force cited in its recently-issued Combating Identity Theft: a Strategic Plan show how substantial a single victim's financial losses can be.
[I]n July 2001, an identity thief gained control of a retired Army Captain's identity when Army officials at Fort Bragg, North Carolina, issued the thief an active duty military identification card in the retired captain's name and with his Social Security number. The military identification, combined with the victim's then-excellent credit history, allowed the identity thief to go on an unhindered spending spree lasting several months. From July to December 2001, the identity thief acquired goods, services, and cash, in the victim's name, valued at over $260,000. The victim identified more than sixty fraudulent accounts, of all types, that were opened in his name: credit accounts, personal and auto loans, checking and savings accounts, and utility accounts. The identity thief purchased two trucks valued at over $85,000 and a Harley-Davidson motorcycle for $25,000. The thief also rented a house and purchased a time-share in Hilton Head, South Carolina, in the victim's name.
Combating Identity Theft: A Strategic Plan, President's Identity Theft Task Force, April 2007, page 10.
In another instance, an elderly woman suffering from dementia was victimized by her caregivers, who admitted to stealing as much as $200,000 from her before her death. The thieves not only used the victim's existing credit card accounts, but also opened new credit accounts in her name, obtained financing in her name to purchase new vehicles for themselves, and, using a fraudulent power of attorney, removed $176,000 in U.S. Savings Bonds from the victim's safe-deposit boxes.
Combating Identity Theft: A Strategic Plan, President's Identity Theft Task Force, April 2007, page 10.
It should be noted that identity-theft victims may have to spend more than de minimis amounts of money out of their own pockets to resolve their situations with creditors, or administrative or law enforcement agencies. The 2007 Javelin Strategy survey found that the average victim of existing account fraud paid $587 to resolve the problem. The average victim of new account fraud paid $617 to resolve the problem. Rachel Kim et al., 2007 Identity Fraud Survey Report, Javelin Strategy & Research, February 2007.
B. Nonfinancial harms
In addition to direct financial harm, victims of identity theft often suffer nonfinancial harms from which it may take substantially longer to recover. Among other things, victims whose financial accounts have been misused may suffer damage to their credit standing and general reputation in their dealings with legitimate businesses and government agencies.
One reason that identity theft can be so destructive to its victims, [as the President's Identity Theft Task Force noted,] is the sheer amount of time and energy often required to recover from the offense, including having to correct credit reports, dispute charges with individual creditors, close and reopen bank accounts, and monitor credit reports for future problems arising from the theft.Combating Identity Theft: A Strategic Plan, President's Identity Theft Task Force, April 2007, page 49.
For example, victims often find it necessary to make multiple telephone calls and write multiple letters to consumer-reporting companies, creditors, and debt collectors. Those calls and letters typically depend on the victim spending still more time to gather the information and documents needed to prove that they are not responsible for the accounts that the criminal has created or transactions that the criminal has conducted in the victim's name. Moreover, in some cases, when a criminal has used a victim's identity in the commission of a crime, or in identifying himself to law enforcement officers at or before the time of an arrest or first appearance in a criminal prosecution, the identity theft victim may unknowingly have a criminal record incorrectly created under his name. As a result, law enforcement records, such as the National Crime Information Center, may mistakenly list the victim's name as being associated with the criminal acts that the identity thief committed under the victim's name. This, in turn, can lead to mistaken arrests by law enforcement officers who rely, in good faith, on those law enforcement records.
The number of mistaken arrests of identity theft victims is believed to be extremely small in comparison to the estimated numbers of identity theft victims. Nonetheless, the following examples from media reports show how severe and long-lasting the effects of criminal identity theft can be.
California: In 2003, the State of California garnished the wages of a resident of the San Francisco Bay area, Jorge Arteaga, for failure to pay speeding tickets. At that time, Arteaga persuaded a judge that he was not the person to whom the tickets were issued, as the tickets pertained to a different car and a different address, and the signature on the ticket was not Arteaga's. Later in 2003, Arteaga was arrested twice on drug-related warrants, but reportedly again persuaded judges that he was not the criminal in both cases. In March 2006, however, Arteaga was arrested on yet another warrant in his name, for allegedly driving on a suspended license. While other records supposedly showed that Arteaga was a parole violator with two auto theft convictions, Arteaga asserted he knew nothing about those crimes. Because of Arteaga's purported status as a parole violator, he was subject to a parole revocation hearing. At the hearing, the presiding commissioner reportedly looked at the mug shot of the actual criminal. Although Arteaga asserted that he was not the person in the photograph, the fingerprints associated with the rap sheet supposedly were Arteaga's. As a result, Arteaga was sent to San Quentin Prison. Arteaga was released from prison only after his attorney reportedly wrote to the warden. A California Department of Corrections employee later described the situation as "a minor clerical error," explaining that "we have two former inmates, both on parole with the same name and we ended up accidentally switching their fingerprints in the files." In January 2007, Arteaga reportedly obtained a judicial exoneration declaring that he was "factually innocent of the crimes committed by the imposter."
ID Theft Puts Innocent Man In San Quentin, (KGO-TV broadcast 6 Feb. 20, 2007.
California: In San Francisco, a woman arrested for cocaine possession falsely told court officials that her name was Stancy Nesby, then failed to show up for subsequent court proceedings. A judge reportedly issued multiple warrants for the arrest of Stancy Nesby. Based on the mistaken warrants, from July 2002 to September 2004, the real Stancy Nesby was detained or arrested and jailed seven times by various California law enforcement agencies. Five of the arrests occurred after authorities in Shasta County, where the real Nesby was mistakenly arrested twice, reportedly asked the San Francisco Sheriff's Department to remove the warrants from a state computer system. Nesby eventually sued the City of San Francisco for the failure to remove the warrants from the system.
A victim who keeps getting arrested -- tangled in a case of identity theft, San Francisco Chronicle, September 21, 2004.
Wisconsin: In 1998, a man arrested on drug charges identified himself to police as Malcolm Boyd. A Janesville, Wisconsin resident, Malcolm Boyd, learned of the arrest and went to local police to correct the error. Four months later, after a traffic stop, the real Boyd was arrested and detained on the same pending drug charges. After comparing Boyd's photograph with that of the original individual arrested on drug charges, the police released Boyd. Soon after, Boyd was fired from his part-time job because (according to Boyd) "he was accused of lying about his criminal record." The darkest side of ID theft, (MSNBC, Mar. 9, 2003) Some months later, Boyd was laid off from a full-time job, but denied unemployment benefits, because of his criminal record. Boyd was able to get those benefits reinstated, but then had his driver's license suspended for failure to pay traffic fines. The next year, Boyd learned that the man using his name had been arrested in a neighboring county. To establish his innocence of those charges, the real Boyd provided his fingerprints to the local district attorney and later received court documents establishing his innocence. Nonetheless, Boyd was arrested and detained again in 2002 and 2003, but later released.
United Kingdom: An Andover, England resident, Simon Bunce, reportedly entered personal data on a supermarket shopping Web site so that he and his wife could shop online. Thereafter, someone using Bunce's name and address registered for a pornography Web site used by pedophiles. In connection with a United Kingdom law enforcement operation against child pornography, on two occasions in 2004, Bunce was arrested and his house searched. Police later reportedly sent Bunce a letter saying they were not taking any further action in the case because they had not found any evidence of wrongdoing on his computers or media storage devices. The police publicly confirmed that Bunce was not charged with any offense.
Identity theft nightmare, Andover Advertiser, April 4, 2007.
Criminals in some instances have even used the identities of deceased persons to conceal their criminal status or activities. For example, in October 2006, Michigan authorities arrested a convicted sex offender on identity theft and forgery charges. He allegedly applied for a birth certificate in the name of an infant who had died in 1972, so that he could move to the State of Oregon without having to register as a sex offender. Office of the Attorney General, State of Michigan, UP Sex Offender Arrested in Bizarre Identity Theft Case (Oct. 17, 2006)
More recently, in April 2007, a Southern California woman was federally charged with stealing the identities of hundreds of deceased people and using their personal information to file fraudulent federal tax returns that sought more than $1 million in refunds. U.S. Attorney's Office, Central District of California, Hawthorne Woman Charged with Stealing Hundreds of Identities of Dead People to File Bogus Tax Returns that Sought More Than $1 Million in Refunds (Apr. 12, 2007) Such conduct can create significant problems for surviving family members and for executors of the deceased persons' estates in restoring the deceased persons' financial affairs and reputation.
The financial and human toll from identity theft can be devastating. As one of the most pervasive forms of white collar crime in the United States, it warrants focused investigative and prosecutive resources. The perpetrators of identity theft will inevitably grow in number due to the lucrative nature of the offense, and they will likely increase in sophistication as technology evolves. Investigators and prosecutors must do the same to combat the problem.
ABOUT THE AUTHOR
Jonathan J. Rusch serves as the head of the United States delegation to the United Nations Crime Commission Expert Group on Fraud and the Criminal Misuse of Identity, the United States Co-Chair of the United States-Canada Mass-Marketing Fraud Working Group, and Chair of the national-level Mass Marketing Fraud Working Group. Since 1995, Mr. Rusch has been the Justice Department's coordinator for a series of multinational fraud enforcement operations, including "Operation Global Con" in May 2006 and "Operation Roaming Charge" in October 2004.
Mr. Rusch also serves as Executive Director for Consumer and Benefit Fraud of the Department of Justice's Hurricane Katrina Fraud Task Force. In that capacity, he oversees the Task Force's national enforcement program with respect to charity fraud, disaster-relief assistance fraud, identity theft, and other forms of consumer-related fraud. In addition, since May 2006 he has been serving as a key drafter and editor of the President's Identity Theft Task Force Strategic Plan.
He has been the lead prosecutor in major fraud and public corruption prosecutions by the Department of Justice, including successful prosecutions of a former United States Treasurer, a House Sergeant at Arms, and former Members of Congress, as well as ringleaders of various mass-marketing fraud schemes.
Mr. Rusch received the Attorney General's Award for Fraud Prevention in 2006 for his work on the Hurricane Katrina Fraud Task Force, the Assistant Attorney General's Award for Inter-Agency Cooperation in 2005 for his work in organizing and leading strategic law enforcement initiatives, the Chief Postal Inspector's Award in 2004 for his work in fraud prevention and cross-border fraud initiatives, and the Attorney General's Distinguished Service Award in 1995 for his work in investigating the House Bank scandal. Mr. Rusch also is an Adjunct Professor of Law at Georgetown University Law Center, where he teaches courses on Global Cybercrime Law and Trial Practice, and Lecturer in Law at the University of Virginia Law School, where he teaches Cybercrime.
This article is adapted from a report that Mr. Rusch drafted for the Criminal Process Committee of the American Bar Association Administrative Law and Regulatory Practice Section. The views herein are not necessarily those of the American Bar Association or any of its components.
Rusch, Jonathan J., "Identity Theft: The Scope of the Problem", United States Attorneys' Bulletin, March 2008, pages 1-5