Shostack + Friends Blog Archive


Identity theft numbers: Javelin vs. FTC

So there was a bunch of press last week from a company (Javelin) claiming that ID theft was falling. Consumer Affairs has a long article contrasting Javelin and FTC numbers, well summarized by the claim that “FTC Findings Undercut Industry Claims that Identity Theft Is Declining.”

I think that there’s an interesting possibility which isn’t getting enough analysis, and that is that the probability of knowing how you were impersonated is conditional on knowing the impersonator.

Let’s start with some numbers:

  • 26% of victims can name the perpetrator
  • Of those 26%, 40% know the perpetrator (that is, just over 10% of id theft is known to have been performed by someone who the victim knows)

There are a number of statements that are consistent with the data:

  1. The 26% of victims who can name the perpetrator are randomly selected from the set of all ID theft victims (or)
  2. There is a correlation between “knowing the perpetrator” and “being able to name them.”

Intuitively, there’s some logic to the latter. If cousin Alice goes to jail, she’s going to be the subject of family gossip. Now, if (1) is true, then for all ID theft victims, 40% should know the perpetrator. If (2) is true, then perhaps 11% of ID theft is committed by someone who the victim knows, and 90% of that is detected. Perhaps it’s 90% of ID theft is committed by someone who the victim knows, and that’s only detected 27% of the time. Intuitively, I find the first possibility easier to accept: that in most local ID fraud, either because of the police making an effort to tell the victim about it, or because someone goes to jail, or because bill collectors end up providing information (such as an address or phone #) that helps the victim identify the perpetrator, the victim discovers that it was locally done.

It might well be possible to test these hypotheses.

(Consumer affairs link via Pogo Was Right. Photo by DJ Wudi)

One comment on "Identity theft numbers: Javelin vs. FTC"

  • These numbers gave me some trouble too. Just from anecdotal evidence and my own experience, almost everyone I’ve talked to personally or professionally who has had their ID stolen in some way knows that person or is at least acquainted with the person. Even the ones who don’t almost always know where it happened and can narrow the field of potential thieves to a a handful of people.

Comments are closed.