Indicator 1.1—Key finding: Medicare cards and driver licences—and to a lesser extent birth certificates—are more likely than other credentials to be used to facilitate identity crime. This is due to a range of factors including Australians’ ubiquitous use of these cards as evidence of identity and the security features of the credentials. This emphasises the importance of verifying the information presented on these credentials with the issuing agency.
Indicator 1.2—There is limited reliable data on the true extent of data breaches in Australia. Nevertheless, data breaches, whether accidental or deliberate, will continue to present significant opportunities for obtaining personal identifiable information that is used in identity crime.
2. Use of fraudulent identities
Indicator 2.1—Identity crime incidents are detected by a range of government agencies across a wide variety of fraud types including: welfare, passport, immigration, conveyancing, taxation and other financial frauds.
Indicator 2.2—There are an estimated 24,000 prosecutions for identity-related crimes each year in Australia, although prosecution statistics only ever measure a relatively small sub-set of the total incidents of criminal activity.
Rather than specific identity crime offences, most identity criminals are prosecuted for the crimes that are enabled by use of a false or stolen identity, such as fraud (i.e. obtaining benefit by deception). This may be because these offences attract higher penalties or are more appropriate to the overall circumstances of the conduct.
Indicator 2.3—Key findings: The number of people who experience identity crime or misuse each year appears to be rising. The proportion of Australians who report being a victim of identity crime is significantly higher than other personal and theft-related offences.
Identity crime is significantly underreported by both individual victims and organisations. Recent research indicates that half of credit card fraud victims and a third of identity theft victims did not report the incident to a formal institution, such as law enforcement or a financial organisation.
Indicator 2.4—Identity crime continues to be of serious concern to a large number of Australians, with around two-thirds of survey respondents expressing concern about becoming a victim of identity crime in the next 12 months.
Indicator 2.5—The types of information most susceptible to identity theft include financial information (credit card numbers and bank account details) and other biographic information (name, date of birth). Passwords were also identified as vulnerable in around one in five cases of identity crime and misuse. Organisations that use this information to transact with their clients need to take adequate precautions to ensure that it remains protected.
3. Consequences of identity crime
Indicator 3.1—The total direct losses and associated costs of identity crime to government agencies are difficult to estimate, but they are likely in the order of several hundred million dollars each year. Where an agency invests additional effort and resources in detecting and investigating this activity, the amount of incidents detected is likely to increase considerably.
Indicator 3.2—Identity crime costs businesses at least $140 million each year. While the number of incidents has fluctuated, the financial impact of identity crime is consistently on the rise. This underscores the need for the private sector to play an active role in detecting and preventing identity crime.
Indicator 3.3—The majority of identity victims lose relatively small amounts of money of up to $1,000, although in some cases losses can run to hundreds of thousands of dollars. A significant proportion of victims also experience demands on their time or other adverse impacts to their mental or physical health, reputations or general wellbeing.
Indicator 3.4—In addition to financial losses, many victims of identity crime experience other mental and physical health impacts. The stress and frustration of trying to regain control of one’s identity information and financial reputation can also damage family and social relationships.
4. Remediation of identity crime
Indicator 4.1—The average amount of time victims spend recovering from identity theft ranges from 10 to 18 hours. A small but significant number of victims, around one in 20, spend over 200 hours recovering their identity. These more complex cases can involve identities that are stolen and used to commit other serious criminal offences. The damage caused to the victim’s reputation can often take years to repair.
Indicator 4.2—The proportion of identity crime victims who report their experience to government agencies is relatively small (around 1 in 5). The reasons for this may be that victims are unaware of the reporting processes available to them, or that they do not consider there is value in reporting the crime to these agencies.
Indicator 4.3—There is a lack of community awareness of the potential assistance that victims’ certificates can provide to victims of identity crime. Only around one in seven victims were aware of the existence of these certificates and fewer than one in 30 victims actually applied for one, although no Commonwealth certificates have been issued in the last three years.
5. Prevention of identity crime
Indicator 5.1—There are an increasing number of identity credentials that can be verified through the DVS, including four of the five credentials that have been identified through this project as being at most risk of misuse (i.e. Medicare cards, driver licences, birth certificates and passports).
Indicator 5.2—An increasing number of government agencies are using the DVS across Australia, although coverage amongst key government credential issuing agencies is not yet universal, with only a quarter of RTAs and RBDMs currently using or planning to use the DVS by the end of 2014.
Indicator 5.3—There is strong demand for use of the DVS amongst private sector organisations, particularly those with legislative obligations to verify the identities of their customers. There is scope for significant further growth in the number of user organisations which have a reasonable necessity to verify a person’s identity in accordance with the Privacy Act 1988.
Indicator 5.4—There has been rapid growth in the number of DVS verifications over recent years, albeit from a modest baseline, which is expected to continue into the future. This reflects growth in DVS user organisations and the range of documents that are able to be verified through the service.
Indicator 5.5—Most Australians adopt at least basic online security practices; and Australia’s experience compares favourably in relative, international terms. However, surveys suggest that almost half of Australians are not confident in their ability to manage security of personal information online; only just over a third educate themselves about the most current ways to protect against identity theft; there are areas where behaviours could be improved to help protect against identity crime.