While banks, government agencies and healthcare providers are doing decent jobs of assisting consumers after incidents of identity theft, ID theft expert Joanna Crane says more needs to be done.
"I would like to emphasize that there are many, many financial institutions that haven't taken the proactive step of supporting an organization like the Identity Theft Resource Center ... with the intention of helping their customers or individuals who may be victims of identity theft," says Joanna Crane, ID theft expert and former senior attorney for the Federal Trade Commission who now serves as an executive advisor for the Identity Theft Resource Center.
"I think this type of support makes good business sense."
Between 8 million and 9 million U.S. consumers fall victim to identity theft every year. These consumers become angry when their personal information is compromised, and they often blame their banks or credit unions, especially when fraudulent bank transactions result. "Oftentimes they will switch banks," Crane says in an interview with BankInfoSecurity.com's Tracy Kitten [transcript below]. "Thirty percent will switch credit card companies after an account takeover," she adds. And 27 percent will switch their primary bank or credit union if they experience a new account opened in their name.
The consumer response is significant, and because banking institutions and other organizations want to keep customers and members satisfied, they need to become involved at the core of prevention and remediation efforts.
But good work is being done.
Collaboration between the financial industry and the federal government in 2004 led to the founding of the Identity Theft Assistance Center, a not-for-profit public-private partnership that to date has helped more than 80,000 victims of identity theft.
The healthcare industry recently launched a new project called the Protected Health Information Project, which is trying to understand the vulnerabilities that exist in the new electronic health records system, where there's great exposure to potential medical information compromise.
During this interview, Crane discusses:
- How banking institutions, healthcare providers, as well as local and state governments can get more involved in efforts to assist victims and offer support for grassroots ID theft organizations;
- Why banks and credit unions are at the heart of most ID theft incidents; and
- Incentives governmental agencies and Congress are offering to improve ID theft recovery and education.
Crane also recommends organizations educate themselves about the options available for victim assistance. She suggests the following websites as places to start:
- Federal Trade Commission
- Identity Theft Resource Center
- Identity Theft Assistance Center
- Consumer Federation of America
- Identity Theft Victims Assistance Network Project
- Financial Fraud Enforcement Task Force
Crane began her career as an attorney at the FTC in 1995. Crane is a subject matter expert and consultant for a variety of identity theft-related organizations, including the Department of Justice's Office of Victims of Crime, the Maryland Crime Victims Resource Center and the Identity Theft Resource Center. She also serves as a board member for the Identity Theft Assistance Center. Before retiring from the federal government in 2010, Crane worked as a senior attorney and the Identity Theft Program Manager at the Federal Trade Commission, where she oversaw coordination implementation of the FTC's responsibilities under the Identity Theft and Assumption Deterrence Act of 1998. Before joining the FTC's identity theft program, Crane brought enforcement actions against various unfair and deceptive business practices, such as fraudulent work-from-home business opportunity schemes.
TRACY KITTEN: You've been and continue to be involved with a number of ID theft organizations and causes. Can you give our audience a little background about the work you've done with the FTC's program to assist victims of identity theft, as well as a bit about the work you continue to do through organizations such as the ITRC?
JOANNA CRANE: Both the FTC and the Identity Theft Resource Center established their victims assistance hotlines and web pages back in 1999. They've both been part of the landscape for a good ten years-plus, and they're there to support victims of identity theft in resolving their cases and also to broaden public education and awareness in the understanding of identity theft, and also conducting research and working with the private sector on solutions. But the main thing is that they both do have toll-free hotlines and they also have websites where victims of identity theft can get assistance in resolving their problems, because victims do experience frustration and harm when they go through the recovery process. Often times, it takes a counselor, an advisor, someone on the other end of the phone to get the victim oriented to the steps they need to take and to move through the recovery.
ID Theft in the Spotlight
KITTEN: ID theft is a growing concern, but ID theft is not a new crime. Why in recent years has it gotten so much attention?
CRANE: I think there are two reasons: the volume of the crime and the harm that it causes victims. Studies have shown that about four percent of the adult population or about 8-9 million people a year become victims of identity theft. That's defined broadly to include unauthorized credit card charges, but it also includes account takeover, new accounts established in the victim's name, and things like tax fraud that are in the more serious harm spectrum. You have people who discover they're victims of identity theft because of receiving collection notices or they've been denied a mortgage or a student loan, or they can't get a driver's license, or they discover they're victims of tax fraud, and they have to take several steps. It's very labor intensive to clear up their credit report, fix things with the creditors or the government agency involved, and restore their identity. Because the volume is as great as it is, and the difficulties faced by victims are substantial, attention to the crime hasn't gone away.
These days with data breaches being publicly reported, which impacts so many people, consumer awareness has heightened even more, and so more organizations are becoming involved in consumer education efforts to prevent identity theft and to help victims recover.
KITTEN: Why are financial institutions, governments and healthcare providers taking an interest in ID theft?
CRANE: Because while consumers are stuck with the consequences, it's financial institutions, the government, state, local and federal, and healthcare institutions that are in the best position to stop the fraud and help the victims recover. They're in the best position to keep the information out of the hands of thieves, to investigate and prosecute the crime, and to help the victims recover. Victims now believe they have an expectation of assistance, if not prevention, and financial institutions and other entities are responding to the demands of their customers and consumers.
The Link Between ID Theft and Fraud
KITTEN: That's a great segway into my next question, and that relates to the fraud that connects to ID theft. Most incidents of ID theft are related to some sort of financial compromise. That connection often puts banks at the heart of the ID theft recovery process. Yet consumers often say that financial institutions aren't doing enough. Where do you see banks taking an interest and playing a role?
CRANE: I think that banks understand and the research has shown that when victims are affected either by a data breach or an actual fraud, like an account takeover or a new account set up in their name, the victims become angry at the institution that compromised the data or where the thief was able to do the fraudulent transactions. So they take an action. Often times they will switch banks. Thirty percent will switch credit card companies after an account takeover, according to Javelin Research. Twenty-seven percent will switch their primary bank or credit union if they experience a new account opened in their name. I think the consumer response is significant and because banks want to keep their customers and satisfy the public and maintain public goodwill, they're involved at the core of both prevention and remediation efforts.
KITTEN: How could financial institutions and other industries, such as healthcare, that are closely linked to some of these ID theft incidents do more?
CRANE: Let me give you two examples of what they've done. In 2004, the Financial Services Roundtable helped establish the Identity Theft Assistance Center, which is now supported by 35 of the largest financial services companies, and what it does is it provides free victim assistance services to customers of the member companies. There, the financial institutions understood that they needed to play an active role in helping victims recover. Victims who are customers or who have experienced identity theft at one of the member companies actually provide recovery services to the victims of identity theft and help them clear up their credit reports and resolve issues with the various accountholders. They're not just leaving it to government, and they're not just leaving consumers on their own to resolve these matters on their own, and they're not just leaving it to the non-profit. They've actually made an investment in this Identity Theft Assistance Center, which has now helped more than 80,000 consumers since it was established in 2004.
With respect to the healthcare industry, there's a new project that was launched this year called the Protected Health Information Project, and what they're trying to do is get a handle on where the vulnerabilities are and the new electronic health records system, where there's greatest exposure to potential medical information compromise. They're trying to study it and be proactive about stopping the fraud before medical information identity theft grows to the crisis level that we've seen with financial identity theft, and I believe that the medical institutions and insurance companies will step into that space as the Identity Theft Assistance Center has done with a very familiar model if that crime continues to grow.
What more could they do, I think more companies, more financial institutions and banks could be involved either by sponsoring the non-profit organizations like the Identity Theft Resource Center or becoming members of the Financial Services Roundtable's Identity Theft Assistance Center if they're eligible for that. As I said, I think the health insurance companies and medical providers can establish something similar to the ITRC and ITAC to help victims of medical identity theft. There should be a way for these organizations to be involved in taking care of the people who have been harmed by these data compromises.
The Role of ID Theft Organizations
KITTEN: A number of these ID theft organizations which you've mentioned have sprouted up in the country over the last couple of years. What roles do these organizations, which are often not-for-profit, play when it comes to helping victims of identity theft?
CRANE: They provide direct victim assistance to victims of identity theft. The process for recovery which Congress has made more robust and more beneficial to victims over the past ten years is still very labor-intensive. It involves putting your complaints in writing, providing proof of the crime and providing proof of your identity. There are a lot of pieces that go into proving that you're the victim and not a deadbeat. These organizations provide assistance to victims to be able to take the steps that they're entitled to clear their records. They also educate the public on how to avoid identity theft when possible. They work with law enforcement to help officers understand the crime of identity theft, how to help identity theft victims, and that ID theft victims need law enforcement reports. Most recently, the Consumer Federation of America established a website where they provide a section devoted to shopping for identity theft protection services because more and more consumers are going out into the private market and paying for companies to monitor their credit reports and provide them with identity management services. There are a number of ways that they've gotten involved in preventing the crime and in helping victims after it occurs.
KITTEN: You mentioned Congress, and one of my questions related to some of the support the government is offering these organizations. Where do you see the government playing a role?
CRANE: The government can play a role both through the Federal Trade Commission's website and hotline, which provide direct victim assistance and education, but it also can fund these non-profits; and most recently, this year it established something called the Identity Theft Victim Assistance Networks project, which is funded by the Department of Justice, and they selected nine sub-recipients from around the country to receive seed money to establish or enhance their community-based coalitions to improve the community's response to victims of identity theft. You have now nine sub-recipients all across the country: Arizona, Minnesota, Wisconsin, Colorado, with their membership organizations like Legal Aid services, Coalition of Aging Groups and attorney general offices. Various types of community-based organizations are now funded to enhance their ability to serve victims of identity theft specifically. By putting seed money on the ground to improve delivery of services to ID theft victims, they hope to start a broader grass roots movement that can be a model for even more communities adopting these practices.
A Proactive Approach
KITTEN: What final thoughts would you like to share with our audience about identity theft?
CRANE: I would like to emphasize that there are many, many financial institutions that haven't taken the proactive step of supporting an organization like the Identity Theft Resource Center or becoming a member of the Identity Theft Assistance Center with the intention of helping their customers or individuals who may be victims of identity theft due to a fraud that occurred at their banks. I think this type of support makes good business sense. We know that customers become upset with financial institutions when this happens. I think the consumers have come to expect a robust response from their financial institution, and being able to say that they're members of, or they support an organization like the Identity Theft Resource Center, who's there to work with the victim day-after-day until they get their problems resolved, is a way to give back to the community and to show consumers that you care. My final thought is that in addition to your in-house customer service, I think it's incumbent upon financial institutions and healthcare organizations to go the extra mile and support these community-based organizations that provide direct, ongoing victim assistance.