2007 Headlines
Big Freeze: Consumers not Protected from ID Theft
Cornell Study says Safety Hampered by Profit Motive
November 26, 2007 - Ithaca, NY - Roadblocks to a cheap, effective method of protecting consumers against identity theft have been erected by credit bureaus who may be more interested in protecting profits instead of consumers, according to a new study from Cornell University's Johnson School of Management.
"Identity Theft: An Exploratory Study with Implications for Marketers," will be published in an upcoming issue of the Journal of Business Research.
"There is a fundamental conflict between the interests of credit bureaus and the interests of consumers and society," said the study's author, Eric M. Eisenstein, assistant professor of marketing. "This is because credit bureaus make more money by selling their monitoring services, which do not prevent identity theft, than they would by selling other products, which would better protect consumers against identity theft."
The study claims the best protection to prevent identity theft is to create a "security freeze." The "freeze" acts to lock down a consumer's credit bureau file, so that it cannot be viewed or shared, making it almost impossible to open a new line of credit. This prevents new account fraud, a practice where a criminal uses personal information to open new accounts and relationships in the victim's name. In order to open a legitimate account, the consumer must temporarily "thaw" their bureau file. Yearly losses from new account ID theft are estimated to range from $17 to $35 billion for retailers and lenders each year, with additional billions of losses for consumers in wasted time and out-of-pocket expenses.
Eisenstein concludes the three main credit bureaus, Experian, Transunion and Equifax, make security freezes more expensive and difficult to obtain to protect their profits. "They are earning hundreds of millions of dollars per year on their monitoring product," Eisenstein said. "At Equifax alone, they have over 1 million customers paying an average of $85 per year. That's a lot of money."
"The monitoring system is like a burglar alarm, it notifies you there's an intruder, but only after that intruder has entered your home," Eisenstein said. "The security freeze is much more effective. Freezes result in a nonlinear reduction in identity theft that is similar to 'herd immunity.' Thus, excellent protection can be obtained by protecting a small fraction of all people."
While freezes are effective, they can be difficult to obtain and use. Each state has separate laws to safeguard consumers, so the price and process can vary. The bureaus have lobbied to keep freezes expensive, hard to initiate, and they have made them annoying and slow to thaw. For most states, each credit bureau requests a separate certified letter with copies of identity information along with a fee, so freezing accounts for a husband and wife can cost as much as $60 plus postage, assuming all the requirements are met. The bureaus set up hoops to jump through to thaw accounts as well, asking for certified letters and often taking a long time to process. "The existing procedures are much too difficult," Eisenstein said. "From society's point of view, consumers should be able to freeze or thaw online or over the phone, using a PIN of their choice, and the thaw should take effect within 15 minutes or less."
The implications of identity theft for marketing are severe. New account identity theft already deters some consumers from shopping online. If identity theft substantially increased, there could be a serious backlash against critical marketing activities, including the usage of CRM databases, the ability to provide instant credit, or onerous reporting requirements regarding usage of consumer information. Eisenstein comments, "The interests of marketers are aligned with the public good-we should want to see a federal law passed that enables all consumers to cheaply and easily obtain a security freeze at all three bureaus, cheaply and rapidly thaw their file, and the entire process should be streamlined and simple."