Consumer Law & Policy Blog

More Evidence That Consumers Can't Provide Consumer Protection

by Jeff Sovern

Traditional consumer protection rules drew on law and economics models that assumed that consumers were rational and that when consumer markets functioned poorly, all that needed to be done was give rational consumers the ability to protect themselves. For example, the Truth in Lending Act's focus on disclosures presupposes that rational consumers would read them and use them to make appropriate decisions.  More recently, the 2003 FACTA Act amended the Fair Credit Reporting Act to allow consumers to obtain a free copy of their credit report each year from each of the big three credit bureaus.  Again, rational consumers should take advantage of that opportunity to protect themselves from identity thieves. 

But behavioral law and economics has shown that consumers are often irrational in predictable ways.  To the extent that law-makers fail to take these irrationalities into account in formulating rules, the rules will fall short of what is needed to protect consumers.  More recent laws, like 2009's Credit CARD Act and 2010's Dodd-Frank Act have used some of these insights to create rules which fit real consumers better (my co-author, Dee Pridgen, wrote about this in her paper, Sea Changes in Consumer Financial Protection: Stronger Bureau and Stronger Laws, 13 Wyoming Law Review (2013)). 

As for the specific examples I noted above, I have previously written about failures of disclosure, as have plenty of others.  But what about the right to obtain free credit reports?  It turns out that less than 20% of consumers check their credit report annually, according to the CFPB.  In other words, more than 80% of consumers are not taking an easy, free opportunity to determine if they have been victims of identity theft (I wonder how many readers of this blog post fall into that category). 

So if the vast majority of consumers do not protect themselves, the government has a choice in making rules: it can continue to depend on consumers to protect themselves, knowing that many will not and therefore will not be protected, or it can provide protections that do not depend on consumers to act.   

Identity Fraud Continues to Increase

by Jeff Sovern

Javelin Strategy & Research has issued its annual report on identity fraud (a free version is available here). Javelin reports that 12.6 million Americans--or more than 5%--were victims of identity fraud in 2012, an increase of a million from 2011.  It also states that nearly a quarter of consumers who received data breach notices in 2012 were victims of identity fraud. This last may have implications for cases, like Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011), that say that consumers who have not yet been victims of identity theft (and may never be) cannot meet the Article III requirements for standing to bring claims against the companies that have experienced security breaches.  Odds of nearly one chance in four of suffering losses sound like a real possibility of experiencing the loss (would courts deny standing to those who had been unintentionally exposed to a chemical that caused nearly a quarter of people exposed to it to suffer a serious disease?).  In any event, this is an area where courts are split; for example, Krottner v. Starbucks Corp., 628 F.3d 1139 (9^th Cir. 2010), finds that the possibility of future identity theft when a laptop containing personal information is stolen is enough for Article III standing.

Infographic on Things People Do That Increase the Risk of Identity Theft

Here. 

Identity Theft Comic

Here.  They call it an inforgraphic, but it's really a comic, though not comical.  From DirectLendingSolutions.com.

How Common is Identity Theft?

by Jeff Sovern

Very common.  In 2010, according to one study, seven percent of American households were victimized by identity thieves, costing them a total of about $13.3 billion, or, for those who experienced losses of at least one dollar caused by the misuse of personal information, an average loss of $13,160. See Lynn Langton, Identity Theft Reported by Households, 2005-2010 1, 5 (2011).  Another study reported that identity fraud increased by 13% in 2011, harming more than 11.6 million adults.  See Javelin Strategy & Research, “Identity Fraud Survey Report,” (2012)   More consumers complain to the Federal Trade Commission about identity theft than any other consumer problem, something that has been true for each of the last dozen years.  And how many people in the US commit identity theft?  Well, this American Banker headline offers a hint: The 10,000 Identity Fraud Rings in U.S. Defy Stereotypes.

Surely it is past time to revisit the Fair Credit Reporting Act, and the FACTA amendments of 2003, and reconsider what can be done to reduce the incidence of identity theft. Some suggestions can be found here.

 

The Recorder: Theft of Lawyers' Identities Leads to Debt Collection Scams, Problems for Lawyers and Consumers

Here.  An excerpt:

A common scheme involves debt collection. Someone using the name of a lawyer will call or send letters to victims warning them to pay up or face criminal charges. There may or may not be a real debt. But some recipients will pay without questioning. Others get angry and track down the "attorney's" name on the bar's website. That's often the first time a lawyer learns someone has swiped his or her identity.

* * *

But the bar has no authority over non-lawyers. And warnings to scam artists usually just lead to the suspect disappearing for awhile only to pop up later with a new name and scheme, said [senior trial counsel in the California State Bar's office of intake] Horton-Billard.

(hat tip: Arundhati Satkalmi)

Credit Card Applications, Identify Theft, and Opt-Outs

by Jeff Sovern

When we talked in class this semester about how many credit card issuers send out "pre-screened" credit card applications, I mentioned how identity thieves famously "dumpster dive" for them after the consumer has thrown them away, fill them out, and send them in, using the identity thief's address.  I pointed out that the Fair Credit Reporting Act requires the credit card issuers to allow consumers to opt out of the applications (15 U.S.C. § 1681b(e)), thus reducing the likelihood that an identity thief will steal their identity, but that some people simply tear the applications up, preventing the thieves from using them.  Not so fast, my students replied.  They pointed me to this story about how a consumer tore an application up, then taped it back together, and sent it in using a different address.  Chase sent him the credit card anyway.  Bob Sullivan has more. 

So the opt-out seems like the better choice.  Another problem that can be solved with a rule. The problem is that, as I've noted before, few consumers take advantage of opt-outs.  While I'm not aware of any publicly-available statistics about how many have opted out of pre-screened solicitations (something the CFPB may want to look into), I doubt many have.  If I'm right about that, I hope the CFPB or Congress can come up with a more effective way to protect consumers from the continuing identity theft epidemic than opt-outs few use.

Grimmelmann Paper on Hoofnagle and Moringiello on ID Theft & Data Security

James Grimmelmann of New York Law School has written Known and Unknown, Property and Contract: Comments on Hoofnagle and Moringiello, 5 Brooklyn Journal of Corporate, Financial, and Commercial Law 85 (2011).  Here's the abstract:

In addition to gerund-noun-noun titles and a concern with the misaligned incentives of businesses that handle consumers' financial data, Chris Hoofnagle's Internalizing Identity Theft and Juliet Moringiello's Warranting Data Security share something else: hidden themes. Hoofnagle's paper is officially about an empirical study of identity theft, but behind the scenes it's also an exploration of where we draw the line between public information shared freely and secret information used to authenticate individuals. Moringiello's paper is officially a proposal for a new warranty of secure handling of payment information, but under the surface, it invites us to think about the relationship between property and contract in the payment system. Parts I and II, respectively, of this brief essay will explore these hidden themes in Hoofnagle's and Moringiello's articles. I hope the exercise will tell us something interesting about these two papers, and also about the problems of privacy and security in the payment system. A brief conclusion will add a personal note to the mix.

Hoofnagle Paper on Identity Theft

Chris Jay Hoofnagle University of California, Berkeley has written Internalizing Identity Theft, UCLA Journal of Law and Technology (2010). Here's the abstract:

Why has identity theft remained so prevalent, in light of the development of ever more sophisticated fraud detection tools? Identity theft remains at 2003 levels – 9.9 million Americans fell victim to the crime in 2009.

One faction explains the identity theft as a problem of a lack of control over personal information. Another argues conversely that identity theft may be caused by a lack of access to personal information by credit grantors. This article presents data from a small sample of identity theft victims to explore a different dimension of the crime, one that suggests alternative interventions.

Drawing upon victim and impostor data now accessible because of updates to the Fair Credit Reporting Act, the data show that identity theft impostors supply obviously erroneous information on applications that is accepted as valid by credit grantors. Thus, the problem does not necessarily lie in control nor in more availability of personal information, but rather in the risk tolerances of credit grantors. An analysis of incentives in credit granting elucidates the problem: identity theft remains so prevalent because it is less costly to tolerate fraud. Adopting more aggressive and expensive anti-fraud measures is extremely costly and jeopardizes customer acquisition efforts.

These business decisions leave individuals and merchants with some of the externalities of identity theft. Victims sometimes spend their own money, and more often, valuable personal time dealing with identity theft externalities. This article concludes by reviewing several approaches to internalizing these costs. Popular approaches specify prescriptive rules to address particularly problematic practices in credit granting, such as using the Social Security number as a password for authentication. These approaches may lead to compliance-oriented approaches and reification. Several commentators have suggested negligence actions as a cure to identity theft, but uncertainty surrounding the duty of care would probably leave many consumers unremunerated. A strict liability regime is suggested because credit grantors are the least cost avoiders in the identity theft context, and because consumers cannot control the credit granting process nor insure against identity theft losses efficiently.

Roberds and Schreft on the Economics Behind Data Security, Privacy, and Identity Theft

William Roberds and Stacey L. Schreft, both of the Fed, have written Data Security, Privacy, and Identity Theft: The Economics Behind the Policy Debates, 23 Economic Perspectives (2009).  Here is the (very short) abstract:

In this article, we explore the concept of efficient confidentiality, using some ideas from economic theory.