Identity Fraud and Identity Theft

Introduction
Why is ID so important?
Is Identity Theft Serious?

Introduction

Your identity is a valuable commodity - you need it to function in everyday life. You need evidence of who you are to open bank accounts, obtain credit cards, finance, loans and mortgages, to obtain goods or services, or to claim benefits.

But you may not be the only person using your own personal details. Your identity can be stolen and used in a variety of ways.

Fraudsters can impersonate you and take out various forms of credit using your good name. They can even take over your existing bank accounts by pretending to be you.

All the fraudster needs is a few of your details. A document bearing your name and/or your address makes it even easier.

This phenomenon is commonly known as identity theft (or identity fraud) and is the fastest growing type of fraud in the UK.

Identity Theft - (also known as impersonation fraud) is the misappropriation of the identity (such as the name, date of birth, current address or previous addresses) of another person, without their knowledge or consent. These identity details are then used to obtain goods and services in that person's name.

Identity Fraud - is the use of a misappropriated identity in criminal activity, to obtain goods or services by deception. This usually involves the use of stolen or forged identity documents such as a passport or driving licence.

Identity theft and Identity Fraud are definitely not a victimless crimes. In 2007 alone, CIFAS identified and protected over 65,000 victims of identity theft.

Identity theft can be a harrowing experience for the victim. It can be months before the fraudster's actions are discovered, and in some cases it can take just as long to sort out the mess left behind.

Don't panic! There are measures you can take to reduce the likelihood of becoming a victim, and if your identity is hijacked, there is help and advice available. There are a few simple precautions you can take to help prevent your identity from being used in this way:

Protect your personal details and think before you give them away: Who precisely is asking for my details? What details are they asking for? And why do they need these details?
Dispose of your documents securely. Any document containing any of your personal details is potentially useful to a fraudster.

It is fairly straightforward to find out if your identity has been hijacked, and if you do suspect you are a victim, advice is available. Contact the organisation concerned straight away. Report the crime to the Police and get a copy of your credit file.

Why is ID so important?

A person's identity (and their ability to prove it) is central to almost all commercial activity. Organisations need to verify an identity before opening an account or issuing goods or services. They need to ensure that:

The person applying for credit is who they say they are and lives where they claim to live.
The person's name and address and other details are correct.

In the UK, there is no single document used to prove identity. At the moment, to verify an identity organisations use various pieces of information, including personal details such as your name, date of birth, address, mother’s maiden name etc. This is in addition to a mosaic of documents and records, including passports, driving licences, birth or marriage certificates, utility bills, bank statements, payslips, educational qualifications, etc

Your personal details and the various documents and records make you the individual person you are. Your unique identity features - your fingerprints, DNA and physical appearance - can't easily be adopted by someone else, but your other identity details and documents can.

So if fraudsters get access to enough information about you, they may be able to impersonate you and steal your identity. They could either open a new account or obtain new credit cards or loans using your identity, or 'take over' your own existing accounts by impersonating you and changing the address of your account.

The procedures used by organisations to check the information supplied by customers helps detect and prevent most identity fraud. However, some fraudulent applications are accepted due to the sophisticated techniques used by the fraudsters.

What could be done with my stolen identity?

Fraudsters are financial criminals. They are unlikely to use their own identity for their criminal activity. They will either create a new false identity, or, more commonly, will attempt to pose as someone else - someone with a clean identity, a good financial history and a reputation of settling their accounts on time.

There is no typical profile of an identity fraudster - it could be a one-off small time crook working alone, or a large network of criminals using the proceeds to fund organised crime.

There are various reasons why a fraudster might want to steal an identity. Generally, it is to hide their real identity for financial benefit:

To obtain various financial benefits; bank accounts, credit cards, loans and mortgages, goods or services which they have no intention of repaying.
To claim benefits they are not entitled to or to avoid paying tax.

They may also need a new identity to:

Hide a poor financial history and avoid paying existing debts.
Continue various criminal activities without attracting Police attention.
Drive despite being disqualified
Work with children
Remarry and commit bigamy.

As well as small-time crooks working alone, criminal networks commit identity fraud on a large scale by using multiple identities. It is estimated that this fraud is responsible for a criminal cashflow of around £10m per day.

This money is then used by criminals to finance bigger scams.

A significant proportion of identity fraud is therefore closely linked with other crimes, such as human trafficking, illegal immigration, drug running, terrorism and money-laundering.

How is identity fraud linked to money laundering?

Criminals need to launder, or 'clean' the proceeds of their crimes - they want to get 'dirty' money into the financial system. A criminal's funds need to look as if they originate from a legitimate source, and the criminal needs to operate without being caught or arousing suspicion.

Criminals therefore need financial products, services or accounts. They are unlikely to use their own identity, as this would leave a trail back to them. This is why, under Money Laundering Regulations, financial services firms must check to ensure they 'know their customer' before opening an account or providing a service.

Is Identity Theft Serious?

Identity fraud is still a comparatively rare type of crime, but it is a crime that can be very worrying for the victims.

CIFAS figures show cases of identity and impersonation fraud reported as follows:

Year	Cases Recorded
2007	77,500
2006	80,000
2005	66,000
2004	56,000
2003	46,000
2002	34,000
2001	24,000
2000	16,000
1999	9,000

Victims

Identity theft is definitely not a victimless crime. In 2007, CIFAS identified and protected 65,000 victims of identity theft.

As the scale and type of identity fraud varies, so does the impact on those whose identity has been stolen. In one-off cases, perhaps involving one fraudulent application or transaction, the damage to the victim may be minimal.

At the other extreme, persistent and skilled fraudsters who comprehensively steal an identity can cause a great deal of distress to victims. It can take between 3 and 48 hours of work for a typical victim to sort out their life and clear their name. In cases where a 'total hijack' has occurred, perhaps involving 20-30 different organisations, it may take the victim over 200 hours and cost up to £8,000 before things are back to normal. They may suffer considerable (albeit temporary) damage to their credit status, which may then affect their ability to obtain finance or insurance - even a mortgage may be temporarily compromised.

However, in the eyes of the law, the financial institutions/lending organisations are considered the only victims, because they are the ones who have been defrauded. As a result, the damage inflicted on the reputation of the victims and the time they spend mending the trail of destruction cannot easily be redressed. Any such compensation needs to be fought for through the civil courts. This is likely to continue to be the case until legislation is introduced specifically to outlaw identity theft, as in the USA.

Costs

There are difficulties in accurately measuring the impact and extent of fraud in the UK in general, as only detected fraud is recorded. However, the figures available show that:

Identity fraud cost the economy £1.5 billion in 2005 (Cabinet Office figures, 2006).
The Department for Work & Pensions estimated that benefit fraud involving false and stolen identities cost approximately £50m in 2001-2.
Identity fraud accounts for a criminal cashflow of £10m per day.
There are 80 million active National Insurance numbers in the UK, with a population of 60 million.
Plastic card fraud losses totalled £420 million in 2002 - identity fraud accounted for 5% (or £20.6 million) of this figure.
There are proven links between identity fraud and organised crime. Identity fraud is not exclusive to one particular type of criminal activity and cuts across most criminal sectors, including: illegal immigration, drug trafficking, money laundering, vehicle theft and fraud against the public and private sectors.

It is worth noting that, whereas statistics may distinguish between fraud against the public and private sectors, fraudsters typically do not discriminate between the two - they merely target the weakest link. The same stolen identity can be used in applications for loans and credit cards, and for multiple benefit claims, tax evasion etc.
Also, how can the cost of a terrorist or a convicted sex offender operating under an assumed identity be measured?

Why is Identity Fraud at such high levels?

The number of identity fraud cases in recent years can be attributed to a variety of factors:

Organised crime traditionally targets the UK.
It is estimated that the police investigate less than 1% of identity fraud cases. The cases that are investigated consume a lot of police time and resources. The criminal activity often crosses Police Authority boundaries and just one case can involve the investigation of hundreds of bank accounts, and the tracing of the same number of victims.
Until recently there has been insufficient deterrent to criminals. Sentences in the UK have tended to be relatively light, although with the growth in identity theft and with the implementation of The Fraud Act 2006, there are indications that this is beginning to change. It remains difficult to retrieve the funds obtained by the fraudster or to extract compensation from them, however.
Fraudsters have, in the past, exploited loopholes in the issue of 'identity documents' such as passports, driving licences and birth certificates. They have therefore managed to obtain official documents to prove a false identity. For example
    - Approximately 2,500 fraudulent applications for driving licences were detected by the Driver and Vehicle Licensing Agency (DVLA) in the 12 month period to March 2007.
    - In 2005 more than 4,830 driving tests were stopped due to doubts over the identity of the person sitting the test.
    - 16,500 fraudulent applications for passports were received by the Identity and Passport Service (IPS) in the 12 months to September 2006.
There is currently restricted access to Public Records in the UK by financial and other organisations. Access to the registers of births, deaths and marriages would be of enormous value in verifying identities and preventing identity frauds. A change to the law through a clause in the Police and Justice Act 2006 will mean - when it is implemented - that death registration data will be released to the private sector on a regular basis details of the recently deceased for fraud prevention purposes.
Criminals learn from one another, and when a crime is successful, others soon catch on.

Tackling the problem

Given the extent of the problem, it is not surprising that the UK authorities are keen to crack down on identity fraudsters.

During 2002 the Government consulted on the introduction of ID cards, and it appears that they intend to proceed with them in a few years time. Other countries have found that these cards offer a more secure form of identification than many of those available today.

It is likely that the introduction of an ID card would involve a central ID database. Financial services companies could use this database to verify the status of an ID card, and in so doing identify any forgeries.

In the meantime, the issue of the documents currently used as 'identity documents', such as passports and driving licences, has been tightened. The DVLA and IPS now have dedicated teams working together to identify fraudulent applications for passports and licences. The Department for Work and Pensions now has a Benefit Fraud Investigation Service employing 5,000 staff.

In the private sector, a huge investment in fraud prevention is under way. CIFAS and its Members have made major investments in staff training so that front-line staff are fully trained to spot false identity documents.

Thorough checks are made on applications for financial products - for example, proof of name and address are often routinely requested, and companies carry out system checks too. It is common for a lender to ask to see a photo identity such as a passport or driving licence plus a recent utility, council tax bill or HM Revenue & Customs tax code notification. But the checks don't stop there. The electoral roll is checked too, and any payment history on existing accounts on a credit reference agency can be taken as supporting evidence of the individual's address. Fraud databases like CIFAS are also checked to ensure that repeat offenders are identified.

CIFAS has also lobbied for the release of deaths records. The direct mail industry produces about 10 billion items of mail a year, and it has been estimated that 22 million of those are addressed to dead people. Access to deceased data would eliminate the problems of mailings to dead people, and would alert lenders if they received an application for credit from someone who was recorded as deceased. A change to the law through a clause in the Police and Justice Act 2006 will mean - when it is implemented - that death registration data will be released to the private sector on a regular basis details of the recently deceased for fraud prevention purposes.

Elsewhere

The UK is not alone in experiencing the phenomenon of identity fraud.

The USA has the biggest problem but was the most advanced nation in tackling it. US lenders report losses of $1billion a year due to identity fraud - but US authorities can't accurately work out the total cost of identity fraud because of its complexity.

In the US every citizen has a Social Security Number, which in practice is used as an identity card. However, this also means that an identity can be thoroughly compromised, and in some cases victims have had to declare themselves legally dead to resolve the situation, a phenomena known as 'pseudocide'.

To tackle the problem, identity theft was made a criminal offence in the US, and offenders can be prosecuted accordingly:

The Identity Theft & Assumption Deterrence Act 1998 was introduced to criminalise identity theft, to ensure that individuals (in addition to the financial institutions) are recognised as victims, and to allow for compensation for these victims. The Act allows up to 15 years imprisonment and fines up to $250,000.
The Act also encouraged better education of the US public regarding the theft of identity.

In the EU, the links between identity fraud and issues such as asylum, immigration and drug trafficking have led to it being high on the agenda. Individual countries have taken different approaches to the problem:

Four EU countries have compulsory ID card schemes (Germany, Belgium, Greece, and Spain). Spanish authorities plan to replace their existing identity cards with electronic versions.
Eight EU countries have voluntary ID card schemes (Austria, Finland, France, Italy, Luxembourg, Netherlands, Portugal & Sweden) and three (UK, Denmark, Ireland) do not have a card, though Denmark has a national ID number scheme. Some countries with voluntary card schemes (Sweden and Italy) make it compulsory to register on a 'population database'.
In Holland, forging or altering identity documents carries a 5-year sentence.