Home | Articles & Interviews | FTC ID Theft Survey: A Summary For Consumers

FTC Identity Theft Survey — A Summary for Consumers

September 2003

On September 3, 2003, the Federal Trade Commission released the results of a survey¹ conducted to clarify certain aspects of the crime of identity theft in the United States. The results were even more disturbing than the FTC had feared.

10 million Americans — 4.6% of the adult population — became victims of identity theft in the past year alone.
27 million Americans have been victimized within the past five years.
Identity theft cost the U.S. economy nearly $53 billion last year.
The incidence of identity theft increased by nearly 41% last year.

The original report (nearly 100 pages long) can be found on the FTC website. In this document, for your convenience, we've summarized the FTC survey's key findings for consumers in an accessible Q&A format.

How serious is the crime of identity theft in the United States?

Very serious indeed — so serious, in fact, that researchers were shocked by what their survey revealed. In the past year, nearly 10 million Americans — equivalent to 4.6 percent of the entire adult population — discovered that they had been victims of identity theft. 27 million Americans have been victimized in the past five years. What's more, last year the incidence of identity theft increased by nearly 41 percent over the year before — and it shows every sign of picking up speed.

What's the impact of identity theft on the U.S. economy?

In a word, horrendous. The FTC study indicates a total loss last year of $52.6 billion, including costs borne by individual victims and losses sustained by businesses and financial institutions. This amounts to 0.5% of the U.S. Gross National Product for 2002.

What's the cost of identity theft to the individual victim?

This is a tricky question. For one thing, many victims' most meaningful losses are measured not in dollars and cents, but in wasted time, humiliation, stress, and damage to their financial security, reputation, and self-esteem.

From a strictly financial perspective, however, the FTC study found the average loss from the misuse of a victim's personal information to be about $4,800. For the most serious category of fraud related to identity theft — new accounts opened, new loans taken out, various other forms of fraud perpetrated — the ID thief's average haul was significantly higher: about $10,200 in money, goods, and services. From this we can derive a total loss to businesses, including financial institutions, of $33 billion from this type of identity theft over the last year alone.

While individuals whose information is misused bear a relatively small percentage of the overall cost of identity theft,² victims of all forms of identity theft still spent an average of about $500 dealing with their experience — which doesn't necessarily mean resolving it. Victims of the most serious category of fraud spent even more — an average of almost $1,200. The total annual cost of identity theft to individual victims is thus in the vicinity of $5 billion, with those in the most serious category bearing about $3.8 billion of that total.

Victims of identity theft also spend a substantial amount of their own time resolving problems caused by criminal misuse of their personal information. On average, it comes to about 30 hours; for victims of the most serious category of fraud, it's double that. All told, Americans spent almost 300 million hours resolving problems related to identity theft in the past year, with almost two-thirds of that time (194 million hours) lost by victims in the most serious category.

Type of Id Theft Crime Cost Segmentation

How long does it take to resolve a case of identity theft completely?

The time required to resolve a case of identity theft varies according to the severity of the crime, the victim's knowledge of the financial and law enforcement infrastructure, and the victim's persistence and skill in working with a broad range of businesses and governmental agencies. Adding to the victim's frustration, of course, is the very real possibility that if certain pieces of personal information have been compromised, the problem may never be fully resolved.

In general, the FTC study indicates that serious fraud problems stemming from identity theft require more than three months to resolve in 39 percent of the identified cases. Five percent of victims said the misuse of their identity was ongoing at the time of the survey; 21 percent indicated that they were still experiencing problems as a result of an earlier abuse.

Nevertheless, the study indicates that serious fraud problems require more than 3 months to resolve in 39% of the identified cases. Although 5% of the victims said the misuse of their identity was ongoing at the time of the survey, 21% indicated that they were still experiencing problems that were the result of an earlier misuse.

What other problems are associated with identity theft?

A total of 36 percent of all victims of identity theft reported additional problems as a result of having their personal information misused. These additional complications can be quite severe. For instance, 20 percent of identity theft victims report being harassed by a debt collector; 18 percent report being turned down for a loan; and 13 percent report various banking problems.

Victims experiencing more serious forms of identity theft — those who have new accounts opened or new loans established in their name, or suffer other forms of fraud³ using their personal identification — are far more susceptible to such problems, which can include criminal investigations and civil lawsuits. The likelihood of such problems increases with the amount of money involved. For example, cases involving more than $5,000 have a 74 percent probability of further complications. The likelihood of additional problems increases with complexity, with 76 percent of victims who have suffered four or more distinct misuses of their identity being subjected to additional personal complications.

On the other hand, the faster the crime is detected, the less severe these complications tend to be. If it's discovered within one month, the probability drops to 26 percent; if it takes more than six months, it rises to 76 percent.

Is identity theft becoming more common?

Without a doubt. The survey results show that incidents of identity theft are on the rise in the United States, and this increase has accelerated over the past two years. Overall, the number of victims of identity theft last year was 41 percent higher than the previous year's tally.

How long does it take a victim of identity theft to discover the crime?

The most important determinant of this crime's severity — and, specifically, of the damage inflicted on the victim — is how long it takes for the identity theft to be discovered. While many victims recognized the problem within a week, those whose personal data was used to open new credit accounts, take out new loans, or engage in other types of fraud . precisely the ones whose financial exposure was greatest — were usually not so fortunate. In fact, 24 percent of this group took 6 months or more just to discover that the crime had taken place.

Length of Time to Discover Victimization

How long will the criminal abuse a victim's personal information?

The median time period that victims' information was misused is between one week and one month. 12 percent of victims reported that their personal information was misused for 6 months; 25 percent said the abuse lasted no more than a day. Of those defrauded in more serious ways, more than 25 percent say the abuse continued for over 6 months.

Who commits the crime of identity theft?

In 26 percent of all cases, the victim knew who had misused their personal information. Of those who could identify the perpetrator, 35 percent said a family member or relative had misused their personal information; 18 percent named a friend, neighbor, or in-home employee; and 16 percent said the thief was a complete stranger whose identity they learned only after the fact. Six percent of victims said the responsible party worked at a company or financial institution with access to their personal information.

One interesting fact is that the more serious the abuse, the greater the likelihood that the victim knows the criminal's identity. Of those most seriously victimized (new accounts opened, new loans taken out, and so on), 34 percent were aware of the thief's identity, versus 18 percent of those for whom only existing accounts were abused.

In cases where the abuse involved only existing credit card accounts, someone at a financial institution or other company was cited as the source of the misused information by 33 percent of those who could identify the perpetrator. In cases involving new accounts and other fraud, 13 percent of those who knew the perpetrator's identity cited an employee of such a company, while 18 percent identified a family member or relative.

How do criminals steal personally identifying information?

51 percent of victims say they know how identity thieves obtained their personal information. One-quarter of all victims say their information was lost or stolen. Fourteen percent cite a lost or stolen wallet, checkbook, or credit card; in the most serious category of abuse, however, only 8 percent attribute their loss to such a source. Four percent of all victims cited stolen mail as the source; of the most serious cases, 7 percent were attributed to mail theft.

Thirteen percent of all victims say their information was obtained in the course of a transaction, with personal information obtained from a credit card receipt or a purchase made by phone, by mail, or over the Internet.

Whom do victims of identity theft contact about their problem?

Victims of the more serious forms of identity theft were more likely to contact the police (17 percent) and the credit bureaus (37 percent). Somewhat surprisingly, only 13 percent of victims who had existing credit card accounts misused said they contacted a credit reporting agency. Five percent of victims contacted other federal agencies, including the U.S. Postal Service and the Social Security Administration.

Older victims were less likely to report having been victimized. Of victims aged 18-24, 83 percent reported their experience, whereas only 34 percent of victims 65 and older reported the crime.

Are victims of identity theft satisfied with the credit bureaus' performance?

Of those victims who contacted more than one credit reporting agency, nearly half were satisfied with all of the agencies they spoke to; 20 percent expressed satisfaction with some of the agencies contacted, but not with others; and 31 percent were dissatisfied with all of the agencies they contacted.

Do victims use the fraud alert option with credit reporting agencies?

Less than one victim in four (22 percent) contacted at least one credit reporting agency; of those who did, 62 percent had fraud alerts added to their credit reports. Among those who did contact a credit bureau, 70 percent of those suffering the most serious forms of identity theft added a fraud alert to their files, versus 46 percent of those suffering only the misuse of an existing credit card account.

Do victims report their problem to local police? Will a police report result?

Only 26 percent of identity theft victims surveyed reported the crime to local police. Of those cases, however, 76 percent resulted in a police report.

Are victims satisfied with police handling of their cases?

Some are satisfied, others thoroughly dissatisfied. One factor worth noting: Police were far more likely to take a report if the abuse was uncovered relatively quickly. Where the crime was discovered within five months, a report was taken 83 percent of the time. Where it took six months or more, the figure drops to 47 percent.

Satisfaction with Local Law Enforcement Response

References & notes

¹ Federal Trade Commission . Identity Theft Survey Report. September 2003. Prepared by Synovate, 1650 Tyson Boulevard, Suite 110, McClean, Virginia 22102.

² Victims are generally not liable for losses based on fraudulent actions taken by identity thieves using their personal information. A variety of laws limit consumers' liability in these situations. Such laws include the Truth in Lending Act, 15 U.S.C. § 1601 et seq., implemented by Regulation Z, 12 C.F.R. § 226; see especially 15 U.S.C. § 1643; 12 C.F.R. § 226.12(b) (limits consumer liability for unauthorized credit card charges to a maximum of $50), and the Electronic Fund Transfer Act, 15 U.S.C. § 1693 et seq., implemented by Regulation E, 12 C.F.R. § 205; see especially 15 U.S.C. § 1693g; 12 C.F.R. § 205.6(b) (limits consumer liability for unauthorized electronic fund transfers depending upon the timing of consumer notice to the applicable financial institution). Consumer liability for losses associated with check fraud and loan fraud are typically limited by state statute or common law.

³ "Other Frauds" include misuse of the victim's information to misrepresent a person's identity when someone is charged with a crime by law enforcement authorities, when renting an apartment or home, when obtaining medical care or employment with the victim's information, and similar misuses.