When I saw the blog postings this week that Freakonomics authors, Steven D. Leavit and Stephen J. Dubner, had penned an article on identity theft, I anxiously clicked into the Sunday NY Times Magazine to read the article (11 March 2007, link here). I had hoped that the popular statistical wizards had taken on the subject of why ID theft loss estimates vary by as much as 20-fold, from a couple billion to more than $50 billion (note 1).
Unfortunately, the article, Identity Crisis, shed no light on any of the statistical anomalies nor did it offer any help with definitions, even after using this lead sentence:
There are as many varieties of identity theft today as there are varieties of, say, mushrooms.
The lightly researched article relied on the usual Javelin and FTC numbers and reached the unsurprising conclusion that merchants are the ones that most care about credit card fraud. But the authors glossed over the fact that it's the online merchants who are burned most by card fraud, due to card-not-present chargeback rules (note 2). Real-world card swiping merchants are often made whole for fraud situations provided they followed the card association rules for checking the signature scrawled on the receipt against the 1/8 inch script scribbled on the back of the card (as if that stops much fraud).
The authors also failed to realize, or at least note, that the oft-cited Javelin finding that more than half of ID theft is from people you know, includes only the situations where the victim has knowledge of who perpetrated the fraud. In round numbers, here's what the pie looks like:
- 50% of ID theft victims don't know who stole from them
- 25% know who stole from them, but have no relationship with the crook
- 25% know who stole from them, and the crook was family, friend or co-worker
I believe that it's a bit of stretch to say that half of all identity theft is from related parties when it could be a little as 25% or as much as 75%.
Blog Comments on ID Theft
Unlike the old days when the only way to interact with an article was a letter to the editor, Leavit and Dubner maintain a blog (here) where readers can sound off on the issues. The blog entry, Who Cares About Identity Theft?, went up on March 9, two days before the full article appeared in the Sunday Times. I was surprised today (March 17) to find only 29 comments on the identity theft piece, especially since the blog has more than 55,000 readers and both the print and online NY Time's columns directed readers to the Freakonomics blog.
And no one seemed to care that the authors did little to further the debate on identity theft, chargebacks, or law enforcement priorities (note 3). In fact, it appeared that only a half-dozen of the commenters had even read the full article. So we have at least a partial answer to the "who cares" question, not the blog readers (note 4).
Notes:
1. During the past month, I've had conversations with extremely frustrated reporters from the Wall Street Journal and Wired Magazine, who were trying to figure out what the true costs of financial fraud in the U.S. really are.
2. I have to admit being biased here. As an online-only merchant, I pay large credit card fees, around 3% that cover the supposed "high-risk" nature of online commerce, even though I have zero recourse if the charge is later disputed as fraudulent.
3. The article had conflicting anecdotal evidence on law enforcement efforts to stem financial fraud, saying the FBI usually needed at least $100,000 in losses to get involved. The article implied, but did not explicitly say, that lesser amounts are not pursued aggressively by local police departments. Although it cited an officer from the Los Angeles County Sheriff Department's ID Theft Task Force, which at least sounds like significant enforcement action.
4. It's not so much consumer don't "care," but that they are no longer so interested in discussing it and/or they are less concerned now that many understand that they are well protected against financial loss.
Looking through my notes from the Mobile Payments Forum last week (post here), I came across this tidbit mentioned by several speakers: 
I don't know how I missed this yesterday. The 
