584 Part IV • The Information Management System
or by disclosure by someone who has legitimate access to
your personal information. However, the information can also
be obtained by breaking into a computer and examining files
that contain this information, by phishing(sending an e-mail
to a user falsely claiming to be a legitimate enterprise in an
attempt to scam the user into providing private information),
or even by intercepting information flowing through the
Internet or dedicated communication lines. Moreover, the
fraud that makes identity theft lucrative would not be possible
without the heavy dependence on IT by national credit card
companies and credit bureaus. Information security actions
that can be taken by an organization to prevent potential iden-
tity thieves and others from accessing computer information
are discussed in Chapter 14.
Impact of Identity Theft
Identity theft crime is a serious problem for both businesses
and individuals. The 2010 Identity Fraud Survey Report
released by Javelin Strategy & Research revealed that iden-
tity theft fraud affected 11.1 million American adults in
2009, an increase of 12 percent over 2008. The total fraud
amount from identity theft increased by 12.5 percent, to
$54 billion. The average victim spent 21 hours and $343
resolving the crime. Nearly half the victims filed police
reports, and more perpetrators were convicted than ever
before. (See the box entitled “Preventing Identity Theft.”)
Financial institutions and merchants bear most of the
dollar costs of identity theft. If your credit card is misused,
either the merchant or the credit card company absorbs the
loss. If someone borrows money in your name, the lender is
stuck with the loss. However, the dollar figures do not tell
the full story of the impact of identity theft on the victim. In
the first place, the victim must prove his or her innocence to
every business that has been victimized, and the business
might not be happy about its loss and be reluctant to admit
that it erred, so it might make it difficult to erase what it
assumes to be the victim’s debt. Furthermore, by the time
the victim finds out about the crime, the thief could have
run up a lot of bad debts that end up on the victim’s credit
record, thus destroying the victim’s reputation and credit-
worthiness. Getting these records corrected can be a long,
laborious process and might have to be repeated over and
over as the thief continues more thievery using the victim’s
identity. Although the typical victim spent only 21 hours
clearing up his or her record, there are many cases where
the victim’s life has become a nightmare without end.
There usually is no single entity that looks out for the
interests of the person whose identity has been stolen. The
lenders, banks, credit bureaus, collection agencies, and police
all are difficult to contact and may not always be helpful.
When the identity thief persists in using the stolen identity
over a long period of time, the victim faces a long and frus-
trating challenge to clear his or her credit and reputation.
There is no question that an identity thief is acting
unethically. It may appear that banks and merchants are sim-
ply ignoring the crime, but they justify their inaction on theIdentity Theft Nightmare
John Harrison’s nightmare began on July 27, 2001, when an identity thief used Harrison’s social security
number to acquire a military photo ID and began a four-month spending rampage that left more than
60 bogus accounts and close to $260,000 worth of purchases in his victim’s name. Using Harrison’s
good credit rating, the thief had been able to open new credit card, checking, and utility accounts, and
then purchase two new pickups, mobile phones, clothing, and more than $7,000 in home improve-
ments. He rented an apartment as Harrison and even bought a vacation time-share.
Police arrested and prosecuted the thief, Jerry Phillips, and he even went to prison for three years.
With an apologetic thief behind bars, Harrison thought he was lucky—but he was wrong. Despite
letters from the Justice Department confirming that he was a victim, Harrison is still being harassed by
creditors. In fact, he remains nearly $140,000 in debt.
Harrison has struggled for over four years and spent over 2,000 hours to clear his name. “I’ll
spend 10 minutes explaining that I’m a victim of identity theft,” says Harrison of his daily battles with
unremitting debt collectors. “Then they’ll say, ‘OK, can you start paying some of this debt?’ It keeps
coming and you don’t have a choice but to deal with it.”
Harrison’s personal credit also dried up as banks revoked his spending limits. And when his
15-year-old daughter needed his help to open up her first savings account, they were turned away.
“I can’t put a price tag on the humiliation I felt,” Harrison reported.
[Based on Moritz, 2003; and CBS News, 2005]