Identity Theft - Wake Up Businesses!

Almost every day, we read or hear something inbusiness suffers; it is a victim, but most people do
the news about the latest loss or theft ofnot see it that way. They see the business of the
customer or employee information. In the pastoffender because they did not protect the
few years, identity theft has grown exponentially,information enough to prevent it from being lost
due in part to the relative ease to commit such aor stolen.
crime and its low conviction rate. Accordingly,Costs of Identity TheftFederal Trade Commission
organized crime now leads the way in identityChairman Majoras testified before Congress that
theft crimes.thieves rack up $53 billion a year in identity theft.
The term Identity Theft is often used to refer toConsumers are stuck with $5 billion directly, while
several related concepts: information loss orbusinesses are saddled with the remaining $48
breach, information theft, and fraud. Personalbillion. In individual cases of identity theft, the
information can be lost or compromised with oraverage dollar amount charged ranges between
without malicious intent. Most data breaches occur$40,000 and $92,000, according to the Identity
these days due to insufficient systems security.Theft Resource Center. Laws hold victims partially
In 2005 alone, there were over 50 million recordsresponsible for fraudulent debt after 48 hours,
lost due to computer data breaches, and that isand hold them fully responsible if not reported
not including the 92 million records that onewithin 60 days.
company's employee sold to thieves.Indirect costs of identity theft to businesses
Why So Prolific?include the time employees must take to restore
Our personal data is stored in electronic and papertheir identity should they become a victim of
form in hundreds of databases, accessible byidentity theft, 200 to 600 hours on average.
many, many people. Technology designed toAdditionally, if lost information is traced back to a
make life, work, and commerce easier alsobusiness, it will be held liable. Plaintiffs in identity
makes hacking drastically easier and possible on atheft lawsuits may seek class action status and
massive scale. As well, the personal anonymity ofoften seek monetary, statutory and punitive
online transactions enables easy impersonationdamages.
while using stolen data. Recent successful theftsIn terms of information theft due to employee
of tens of millions of identities from hugefraud, small companies get hit much harder than
corporate databases may also spur or encouragelarger ones. A company with fewer than 100
similar future thefts or copycats.employees that experiences employee fraud
In the Workplacesuffers a median loss of $98,000, according to a
The number one underlying source of identitystudy from the Association of Certified Fraud
fraud is theft of records from employersExaminers. That is more than midsize businesses,
(businesses), according to a study by TransUnion.and close to the $105,500 loss typical in
A Michigan State University study confirms this:companies with more than 10,000 employees.
an estimated 70 percent of identity crimes in theActing in Good Faith
U.S. start with theft (or loss) of personal data byThe best way for businesses to minimize their
an employee. And while most businesses think ofrisks associated with loss and theft of customer
customer records as the most valuable, what areand employee information is to put safeguards in
lost or stolen with increasing frequency areplace before they suffer a breach. There are a
employee records.variety of federal and state legislation that require
Seventy percent of small businesses considerbusinesses protect non-public information about
information security a high priority, and more thantheir customers, employees and vendors.
80 percent exhibit confidence in their existingAccording to Betsy Broder, assistant director of
protective measures. However, more than half ofthe FTC's Division of Privacy and Identity
these small businesses have experienced one orProtection, businesses need to have a plan in
more security incidents in the past 12 months,writing describing how customer data is to be
making perception at odds with reality, accordingsecured and an officer on staff responsible for
to a survey by the Small Business Technologyimplementing that plan. "We are not looking for a
Institute. Additionally, 74 percent of smallperfect system, but we need to see that you
businesses do not even have an informationhave taken reasonable steps to protect your
security plan.customer's information." says Broder.
Businesses SufferOnce an information security plan is established,
When a customer is a victim of identity theft orbusinesses need to ensure their employees
data loss, the business suffers along with theunderstand what is included in the plan and their
victim. Monetary losses of goods and services areresponsibilities for safeguarding information. This is
often compounded by chargebacks. Then there isbest accomplished through employee training.
the loss of customer trust, and in turn, loss ofBusinesses can also consider identity theft
customers. According to CIO magazine, after aprotection as a voluntary benefit to help protect
breach, 20 percent of customers sever all tiestheir employees.
with the company, 40 percent say they considerAn effective information security program need
doing the same, and another 5 percent will benot be elaborate or expensive. The key is to take
hiring lawyers.action before identity theft strikes.
When data loss and identity theft occur, the