Identity Theft

In the past five years, over thirty-three million people have had their identity stolen. And according to USA Today, the average victim loses over $92,000 and six hundred work hours due to identity theft. These facts don’t even take into account the emotional turmoil many victims endure.

Realize that your most valuable possession is not your house, your car, your business, or your art collection. Your most valuable possession is what makes you—your identity. What would happen if someone stole it?

While many people believe that identity theft is nothing more than someone stealing your credit cards and racking up charges, the fact is that identity theft has many forms and can do much more damage than simply ruin your credit. As an identity theft victim, you could end up in serious trouble with the IRS or even in jail.

The people I have spoken to who have been victims of identity theft tell me that life is miserable for a while. You need to go to an all cash basis as you’re trying to get your records straight. You can’t use credit cards, if the thief stole your DMV record you may not be allowed a driver’s license, and you may find out you owe a lot of money to the IRS due to someone else working under your social security number and not paying taxes on the income.

Why does identity theft happen? In a word, money.

Criminals will get people’s identities, sell those identities to people who will apply for credit cards in those names. The people who illegally get the credit cards will use that card, and when it runs out, they just toss the card and go on to the next one.

The current research shows that these thieves can purchase someone’s identity anywhere from around $16 to about $70. Then, in theory, the novice thieves are going to get $700 worth of transactions from that identity until they have to move on to the next one. The professional identity thieves can get hundreds of thousands of dollars before someone gets wise to them.

Now, from a business standpoint, you have some responsibility for stopping identity theft. On June 1, 2005, the FTC’s rule on the proper storage and disposal of certain “consumer information” went into effect. This rule was issued by the FTC as part of its jurisdiction under the Fair And Accurate Credit Transactions Act or FACTA.

The law requires that any business that maintains or otherwise possesses consumer information, or any compilation of consumer information derived from consumer reports for a business purpose must properly store and dispose of such information or compilation. The new rule is supposed to cut down on the incidences of identity theft by restricting the ability of thieves to go “dumpster diving” for valuable consumer information contained in discarded business records.

Why should your business care about complying with the FACTA rules? Well, FACTA rules apply to any business that directly or indirectly has or uses consumer information, regardless of the business’ size or number of employees. Because FACTA can apply to every business, every business should want to keep its records safe and dispose of them properly. Just to add an extra incentive to ensure compliance, FACTA provides for a range of civil liabilities and penalties for noncompliance.

For example, a business that fails to comply with the FACTA rules can be liable for actual damages in a civil lawsuit brought by anyone whose identity is stolen as a result. And, for those businesses that love the thought of being a defendant in a class action lawsuit, FACTA allows class action lawsuits to be filed too. Another compliance regulation to consider is the Payment Card Industry Data Security Standards or PCI DSS. Anyone who accepts payment cards must follow PCI DSS. So compliance is just another reason why you need to be sure your IT system is secure.

Action Item: Take inventory of all personal data stored on your network. Do you keep names, addresses, birthdates, social security numbers, credit card numbers, bank information, medical records, personal history, or any other sensitive data?