Key finding: The price of fraudulent identity credentials suggests they are relatively cheap and easy to obtain. This is reflected in the variety of ways that these credentials are used to commit identity fraud. Information on data breaches (many of which go unreported) also suggests that the personal information needed to create fraudulent identity documents is also available to those willing to seek it out. In the main, criminals will use one of two approaches to obtaining a fraudulent identity: either creating a fictitious identity; or stealing all, or parts of, personal information from another person (living or deceased). To get the personal information required to establish a fraudulent identity, some criminals will illegally access databases held by government agencies or private sector organisations and steal personal information, or obtain this information through traditional means such as stealing it from mailboxes. In other cases, personal information will be accidentally made publicly available. Research into data breaches shows that there is an average of one every week in Australia, with around 19,000 records lost or stolen per incident, at an average cost of $138 per record, costing the agency or organisation involved an average of $2.16m per incident (Ponemon Institute 2012).
Another approach is to purchase a fraudulent identity credential, such as a driver licence or Medicare card, on the ‘black market’. Information provided by the Australian Federal Police indicated that the price of fraudulent identity credentials ranges from around $80 (Medicare cards), to around $350 (driver licences), and $1,500 (for an Australian passport to be altered by a professional document forger) up to $20,000-$30,000 (for a legitimately issued passport with fraudulent details). Although some fraudulent credentials are relatively cheap to acquire, the ability to use them to facilitate criminal activity largely depends on their quality and the intrinsic security features (i.e. counterfeited documents compared to legitimately-issued documents with fraudulent details). The cost attributed to fraudulent Medicare cards ($80) and driver licences ($350) was for counterfeit documents that were not the most recent versions that contain state-of-the-art security features.
Identity crimes and the criminal justice system
Key finding: State and territory police detect up to an estimated 30,000 identity crimes each year, with around 24,000 offences proven guilty in a court of law. As identity crimes are often recorded under other related offences such as fraud, the actual number of identity crimes is likely much higher. Data was collected to quantify the number of identity crime offences at each stage of the criminal justice process, from alleged victims, to identity crimes detected by police to the number that are prosecuted before the courts (see Figure 1).
Figure 1: Identity crime in Australia
Due to the way identity crime statistics are collected in the criminal justice system, combined with the clandestine nature of these offences, and the fact that false or stolen identities are used to facilitate many other criminal activities besides fraud, it is highly likely that these numbers represent only a proportion of the true number of identity crimes committed in Australia each year.
Impacts on victims
Key finding: The majority of identity victims lose relatively small amounts of money (up to $1,000), although in some cases losses can run to hundreds of thousands of dollars. A significant proportion of victims also experience demands on their time or other adverse impacts to their mental or physical health, reputations or general wellbeing.
The consequences of identity crime for individuals can be serious, including financial loss, reputational damage as well as emotional and psychological harm.
While most victims of identity crime lose relatively small amounts of money, in some cases individuals have lost hundreds of thousands of dollars. The AIC Survey found that victims reported an average out-of-pocket loss of $4,101 per incident, with losses ranging between $1 and $310,000. However, as an indication of more typical cases, half of these victims lost less than $250 and three quarters lost $1,000 or less (Smith & Hutchings 2014).
The AIC Survey found that, on average, victims of identity crime will spend at least 18 hours dealing with the consequences of the incident, with victims of a total ‘identity hijack’ spending more than 200 hours (Smith & Hutchings 2014).
While financial losses suffered by victims can sometimes be recovered or reimbursed by financial institutions, the non-monetary impacts of identity crime can be equally if not even more significant to deal with. Victims of identity theft or misuse can suffer considerable psychological trauma and damage to their reputation, something that can be very difficult to repair.
The AIC Survey found that 15 percent of respondents experienced mental or physical health impacts that led them to seek counselling or other medical treatment; while six percent reported being wrongly accused of a crime (Smith & Hutchings 2014).
Key finding: Only a small proportion of victims of identity crime report the incident to relevant organisations. Court-issued victims’ certificates appear significantly underutilised as a mechanism to assist victims in recovering from the consequences of identity crime.
In some cases, victims may be eligible to apply for court-issued victims’ certificates to assist in dealing with the consequences of identity theft, such as restoring credit ratings and recovering financial losses. However, the AIC Survey found that only around one in 10 victims of identity crime knew of the existence of these certificates, with fewer than one in 20 victims actually applying for one (Smith & Hutchings 2014). This suggests there is a general lack of awareness of these certificates in the community, that their availability is limited and/or that victims see them as being of limited value in recovering from the consequences of identity crime.
The identity crime victim support service provided by the not-for-profit organisation iDcare, is also another avenue victims can use to obtain assistance recovering from identity crime. However, this service was not operational during the pilot exercise and so could not provide data to inform the measurement framework.