Overwhelmed by a flood of bad ID theft news, consumers in search of a raft say the government isn’t doing enough to protect them.
In one of the most extensive studies yet on consumer attitudes about identity theft, Gartner Inc. found that about half those polled either weren’t aware they were entitled to a free credit report or considered them “not effective” in fighting ID theft. The survey, released Thursday, also found that one-third of consumers are "very concerned" about being victims of identity theft, and nearly half are altering their online activities as a result.
Gartner researcher Avivah Litan, who led the study, said the survey results also suggested that more than 1 million consumers have been tricked into divulging their personal information to senders of so-called phishing e-mails, with financial losses totaling nearly $1 billion.
Gartner conducted the survey of 5,000 U.S. adults in May, during the thick of a series of announcements revealing massive theft and loss of consumer data by major U.S. firms such as ChoicePoint, LexisNexis and Bank of America. The survey has a margin of error of plus or minus 3 percentage points.
Identity anxiety is also hampering e-commerce growth, the study found. Forty-two percent of respondents said worries about phishing, data losses, and spyware are affecting their online shopping habits. These findings parallel those of another study released last week by the Cyber Security Industry Alliance.
"Consumers are really getting scared, and they don't think their government is protecting them," said Litan, who authored a similar study one year ago. This year's study was conducted before the announcement of recent data loss incidents affecting millions of consumers by CitiCorp and MasterCard. "I think it would be even worse now," she said.
The study was released a day after yet another identity theft measure was to be introduced in Congress. Sens. Arlen Specter, R-Pa., and Patrick Leahy, D-Vt., planned to introduce legislation Wednesday that would make it a crime for companies to fail to disclose the theft or loss of consumers' personal data.
Joanne Crane, who heads the Federal Trade Commission's identity theft group, said she understands why consumer concerns are heightened now, with all the recent news surrounding data leaks. In all, some 50 million consumer records were put at risk by the reported incidents. But Crane said she believes similar leaks had been happening for years The recent news is really the result of compliance with a state law in California requiring disclosure of data losses, she said.
"Business record theft, as we call it, has always been the 800-pound gorilla in the middle of the room that no one was ... able to talk about," Crane said. "But I don't think consumers need to feel more at risk now then they were before."
Phishing still on the rise
But the risks are rising, Litan's study found, with phishing attempts growing at a steep rate. Extrapolating from the survey data, Litan estimated that almost 73 million of the 148 million U.S. adults now online have received at least one phishing e-mail, up 28 percent in the past year. About two-thirds of those who said they'd received such e-mail said they'd been "phished" in the prior month.
The attacks continue because they work, Litan said.
Using those surveyed as a sample, Litan estimated that 1.2 million Internet users believe they have divulged their personal information to criminals, who eventually managed to steal $929 million from those consumers' accounts in the past 12 months. And those figures are probably low, Litan said.
"Financial losses and numbers of victims this year are likely to be higher than the numbers reported here, which are based on what consumers think they know about the attacks," the report says. About 87 percent of the money was refunded to consumers by banks, making phishing a costly problem for financial institutions.
The phishing problem creates other headaches for companies, too, the study found. More than 80 percent of consumers say they are reluctant to trust e-mail communications from any company as a result of the confusion caused by phishing.
The research also examined spyware, revealing that 46 percent of all consumers say they've spotted some kind of malicious software on their desktop.
Free reports 'basically a farce'
Among the report's most interesting findings: only 14 percent of consumers who were aware of their right to a congressionally-mandated free credit report said the reports were very effective in the fight against ID theft.
Many consumer rights in the battle against ID theft stem from the 2003 Fair and Accurate Transaction Act, which granted consumers the right to one free annual peek at their credit report. It's the most obvious new consumer right contained in the law. In November, the three major U.S. credit bureaus, Experian, Equifax and Trans Union, launched AnnualCreditReport.com, the only Web site offering the federally-mandated free reports. Access to the reports was phased in across the country; those on the East Coast still can't get theirs until Sept. 1.
Litan's research found that 37 percent of all U.S. adults hadn't even heard of their right to a free report. Of those who had, 23 percent said the free report had little or no effect in their personal effort to prevent ID theft.
These consumers are simply being perceptive, Litan argued.
"The free credit report thing is basically a farce. It only tells you very specific information about your situation at a point in time," Litan said. Consumers on the West Coast who downloaded their free report last November aren't eligible for another year, and have had to watch the long string of data thefts with no recourse but to pay for another peek at their reports. "Everyone assumes consumers are dumb," Litan said. "They're not. They know these measures are ineffective."
Crane said the Federal Trade Commission is currently preparing a marketing campaign around free credit reports to increase consumer awareness. She also said awareness is probably hampered by the fact that New York, Boston, and other major East Coast cities still don't have access.
'Not really a prevention tool'
Equifax spokesman David Rubinger said free credit reports were never advertised as a panacea for the identity theft problem.
"This is bearing out what Equifax has always said — free credit reports are not going to stop ID theft. They are just one tool," he said. "The good news is there are products in private sector that can protect consumers.”
All three credit bureaus sell credit monitoring services for about $10 a month that allow daily credit report checkups.
A spokeswoman for Experian said the company couldn't comment on Litan's study. Trans Union did not return requests for comment.
Norma Garcia, a spokeswoman for Consumers Union, said the three credit bureaus may have confused consumers by offering paid services with similar names to the free report Web site. FreeCreditReport.com, for example, is actually an advertisement for a paid subscription service sold by Experian.
"The bureaus have done a good job of capturing consumers wandering around trying to find their free credit report," she said. "But they ... haven't done a good job of educating consumers about free credit reports."
Keri Smith, a consumer advocate with the Public Interest Research Group, said she thought the free reports were a good tool for consumers, an important first step in understanding what credit reports are and how they work. She recommended that consumers stagger their requests for free credit reports throughout the year, picking up one every four months, rather than getting all three bureau's reports at once. This would allow consumers to take a more frequent look for signs of ID theft. Consumers in some states can get three additional reports thanks to state provisions which also call for free annual credit reports.
"But the point of credit reports is not to prevent ID theft," she said.
Mari Frank, a lawyer who frequently represents ID theft victims, said she wasn't surprised that free credit reports ranked low in consumers' minds.
"They are not really a prevention tool," she said. "It just allows you to see and question whether something is either in error or fraudulent (after the fact). It's not going to prevent ID theft."
Joel Winston, an FTC lawyer who helps oversee the free credit report provision, agreed that the reports are not a panacea, but he thought the "program is working pretty well."
"It's just one more tool consumers can use to keep an eye on things," he said. But there are several other provisions of the Fair and Accurate Transaction (FACT) Act which are still being deployed to help consumers, such as improved fraud alerts and streamlined processes for cleaning up credit reports with erroneous entries.
The General Accountability Office, Congress' investigative arm, is currently conducting a study of the effectiveness of FACT Act anti-ID theft provisions.
But additional ID theft regulations are no guarantee for consumers, who are overwhelmed by news of data leaks, confused about their rights and feeling stranded by the government.
Beth Givens, executive director of the Privacy Right Clearinghouse, said she wasn't surprised by the consumer frustration expressed in Litan's study. She wasn't optimistic that more protection from the government would arrive any time soon. She blamed the state of the ID theft crisis on federal regulators, saying they were not enforcing rules and laws that already exist — giving companies the idea that they could get away with careless treatment of consumer data.
"The regulatory agencies have fallen flat on their faces," Givens said. "They are so industry-oriented they have lost site of who they are really supposed to be protecting."
Bob Sullivan is author of Your Evil Twin: Behind the Identity Theft Epidemic.
