Thursday, March 17, 2005

Accomplices to Identity Theft

An MSN Money article says, “Blame lenders, not thieves, for identify theft.” That’s hyperbole, of course, since obviously the thieves are the real criminals. But overeager lenders also deserve castigation. As the article documents, lenders often employ sloppy verification procedures, ignore fraud alerts on credit reports, and refuse to cooperate with police investigating cases of identity theft.

As a victim of identity theft myself, I’ve experienced these practices first hand. Over the last year and a half, several credit accounts have been fraudulently opened in my name. In every case, the accounts were opened with online lenders using verifiably incorrect information, such as bogus telephone numbers and out-of-date home addresses. Looking up my name in the phone directory would have been sufficient to detect the fraud. In the most recent case, someone purchased a Cadillac Escalade (a $39,000 vehicle) using a credit account opened in my name, despite my having placed a fraud security alert on my credit report.

You can find lots of advice on protecting yourself against identify theft, but in my opinion, most of it is pointless. Bad lending practices mean that your identity can be stolen with as little as your name and a made-up phone number. And if you think your Social Security number is safe, you’re fooling yourself, because it’s on virtually every form you fill out. The only way to protect yourself is simply to check your credit record frequently and be alert to signs that your identify has already been stolen.

But what should be done to reign in the lenders? They already bear most of the cost, because they have to absorb the losses from loans that don’t get repaid and products that don’t get paid for (except when identity theft victims foolishly pay off debts they didn’t incur instead of protesting the charges). They continue to use loose lending practices because the gains exceed the losses. But those practices also impose external costs on the victims in whose names they issue credit. At a minimum, the victims experience the inconvenience of protesting charges; in some cases, they are denied credit at crucial moments.
“The industry is highly competitive, and credit issuers are still making more money signing up new customers than they are losing from fraudulent accounts,” said Beth Givens, executive director of the Privacy Rights Clearinghouse. “Of course, victims of identity theft are the collateral damage of this diabolical business model.”
So here’s the question I pose to my readers: should lenders be made liable for damages to identity theft victims, or punished in some other way when they facilitate identity theft, in order to give them an incentive to adopt more scrupulous lending practices?


JB said...

I'd like to see some kind of punishment of unscrupulous lenders.

However, it'd probably be far more efficient to require credit-bureau's to allow complete access to one's credit record continuously. And a process by which one can easily dispute any false charges (the credit-bureaus can't drag their feet). Shift burdens, so that the lender has to prove that the alleged borrower actually received the benefit before they can place negative information on a borrower's record.

That'd probably get lender's attention pretty quick.

Steve said...
This comment has been removed by a blog administrator.
Steve said...

Surely existing tort law provides adequate incentive for lenders to improve their checking procedures?

Away from the main topic of the article, I was interested to read that there is such a serious problem with identity theft in the US. In the UK, cases are very rare, as far as I am aware. I wonder why this is. One clear difference is the amount of real competition amongst lenders. There is very little here, I would guess that this is because the industry is so regulated, which creates large barriers to entry. One consequence of this lack of competition is that consumer credit is very expensive: e.g. store cards commonly charge interest rates of 30% even though the sterling repo rate is under 5%.

Glen Whitman said...

"Surely existing tort law provides adequate incentive for lenders to improve their checking procedures?"

Does it? I've never heard of someone suing a lender for accidentally making a loan to an identity thief in the plaintiff's name. Nor have I heard of any class actions for facilitation of identity theft. But that doesn't mean they haven't occurred.

AMcGuinn said...

The costs of identity theft to the victim seem to fall into two categories. The first is the hassle of dealing with requests for repayment of loans he never took out. These costs, in as much as they are not trivial, should rightly fall on the lender. For example, lenders should not be able to take any kind of action against a debtor without reasonable evidence that they have the right individual.

The second class of cost is the credit record issue. It is probably most efficient for lenders to make judgements of creditworthiness, at least initially, on whatever information they have to hand, even if it is very unreliable. The downside is that it is not fair if they designate you as uncreditworthy based on who lived at your address before you, or the transaction history of people using your name. The regulatory approach has to choose or compromise between fairness and efficiency.

Anonymous said...

wow, first it's your telephone bill (from xxx-cars was it, i forget) wreaking havoc on your credit but now an escalade? i haven't had this problem yet so it's shocking to hear about it happen to someone more than once; and with such a large purchase.

Glen Whitman said...

AMcGuinn -- While efficiency/fairness trade-offs do occur, I'm not sure there's really one in this case. In general, it's more efficient for lenders to be able to categorize debtors by their true risk level. Identity theft mucks up the informational content of credit reports, so that some worthy risks don't get funded while some unworthy risks do. This sets the stage for an adverse selection problem, as higher interest rates (to compensate for the risk posed by identify thieves) tend to squeeze out the more careful loan-seekers while not scaring off the riskier and sometimes fraudulent ones.

Anonymous said...

I'd say lenders should be punished under the same set of circumstances usually used in civil cases: when it's demonstrably (partially) their fault. In other words, if a lender fails to take proper precautions to ensure someone taking out a loan is who they claim they are, then yes, they should suffer. If, on the other hand, a skilled thief deceives them despite their best efforts, they should face no more than the loss of their money.