Key finding: There are an increasing number of identity credentials that can be verified through the Document Verification Service (DVS), as well as a growing demand for the service amongst government and private sector organisations. Many of the methodologies criminals use to commit identity crime are widely available from open sources. Some of these methodologies seek to exploit vulnerabilities in Australia’s identity infrastructure that have been known for more than 15 years. One methodology known as “tombstone fraud” involves the theft and use of an identity belonging to a deceased person. In many cases this could be prevented through checks against death records whenever an application for an identity credential is lodged. Work is currently underway to improve national systems to make these checks more widely available.
Key finding: As use of the DVS increases and counterfeit credentials become more easily detected, criminals are more likely to seek legitimately issued documents with fraudulent details.
The expansion of DVS use among government agencies and private sector organisations, which have a reasonable need to use the service in accordance with the Privacy Act 1988, will improve the ability to detect counterfeit identity credentials. As these counterfeit credentials become harder to use, there will be stronger incentives for criminals to seek legitimately issued documents with fraudulent details, both through methods such as the theft or takeover of real identities, or through compromising the processes of credential issuing agencies. To help prevent this from occurring on a widespread basis, the agencies that issue these credentials will need to strengthen their identity verification processes. Given the interdependencies of Australia’s identity infrastructure, this will require a consistent, whole-of-government approach.
The economic impacts of identity crime
Key finding: The estimated economic impact of identity crime in Australia is likely to exceed $1.6 billion per year. In light of the limited data available and the underreporting of identity crime, by both individuals and organisations, this is likely to be a conservative estimate. Based on an analysis of the data received during the pilot, the estimated direct lossesfrom identity crime in Australia likely exceed $1.5 billion per year, with the direct cost of investigating and prosecuting these cases estimated at $75 million annually. These estimates include the direct financial losses suffered by individuals, government agencies and private sector organisations, as well as the estimated criminal justice system costs of investigating and prosecuting these cases (including the AFP, CDPP, state police and courts). These estimates are towards the conservative end of previous attempts to calculate the total cost of identity crime to Australia, which range from $800 million to $4 billion.
Key finding: Aside from underreporting, the single biggest limitation on efforts to measure identity crime is the lack of standardisation between organisations over definitions and how incidents are recorded.
In response to the requests for data and information about identity crime, a number of agencies indicated that they either do not collect, or could not provide data that would be useful for the pilot measurement indicators. For example, only two out of nine police agencies; two out of eight registries of births, deaths and marriages; and three out of eight consumer affairs departments could provide relevant data within the time and resources available.
At the Australian Government level, similar deficiencies in data availability were identified. Nevertheless, Australian Government agencies responsible for delivering key government services, such as the Department of Human Services and the Australian Taxation Office, collected and were able to provide valuable data for the purpose of measuring identity crime. Moreover, Australian Government agencies that issue identity credentials, such as the Australian Passport Office within the Department of Foreign Affairs and Trade, and the Department of Immigration and Border Protection, also provided detailed data and information.
Finally, the Australian Federal Police also provided valuable information about identity crime, including advice about recent operational matters arising from the work undertaken with the New South Wales Police Force as part of the joint Identity Security Strike Team.
To build a reliable evidence base, it will be necessary for a range of Australian, state and territory government agencies to invest time and resources into developing the capacity of current databases and recording practices to more accurately capture identity crimes.
The way forward
In addition to this report on key findings of the measurement framework pilot, a companion report on recommendations for improving the measurement of identity crime has been developed for further government consideration. This report provides further detail on the challenges to be addressed in improving data quality and availability and a potential approach to improving the monitoring and measurement of identity crime in Australia on an ongoing basis.
This will be important to help improve the national evidence base to inform future policy and operational responses to identity crime. Importantly, this includes efforts to raise awareness of the evolving nature and extent of identity crime—one of Australia’s most prevalent crime types—and of the steps that individuals, businesses and governments can take to reduce the impacts of identity crime on the Australian community.
Identity crime is a generic term that describes a range of activities/offences where a perpetrator uses an identity (some combination of personal information) that is fabricated, manipulated, stolen or assumed from another person in order to facilitate the commission of a crime(s).
Identity crime is rarely an end in itself, but an important element in a wide range of criminal activities. These include: credit card, superannuation and other financial frauds against individuals; welfare, tax and other fraud against government agencies; money laundering and terrorist financing; gaining unauthorised access to sensitive information or facilities; and concealing other activities such as drug trafficking and procuring child exploitation material. It has also been used to facilitate the commission of terrorist acts.
The diverse nature of identity crime reflects the critical role of identity information—being able to verify that a person is who they claim to be—in a great many transactions and services that take place across government, the private sector and the broader community every day. It is not surprising then that recent surveys indicate that identity crime is amongst the most prevalent crime types in Australia; and is a concern for a majority of Australians.
Identity crime generates significant profits for offenders and causes considerable financial losses to the Australian Government, private industry and individuals (AFP 2014). Internationally, identity-related crime is regarded as a serious and increasing criminal risk to governments and the wider community (OECD 2006; 3). In its most recent Organised Crime Threat Assessment, the Australian Crime Commission rated identity crime as one of the key enablers of serious and organised criminal activity (ACC 2013; 13). Organised crime costs Australians an estimated $15 billion each year (ACC 2013; 13). The ACC also assessed that the risks associated with identity crime were likely to increase in the future (ACC 2013; 21).
The pervasive impacts of identity crime are widely acknowledged by governments, business and the broader community. Despite this, a lack of comprehensive, reliable data makes it difficult to quantify the full extent of this crime, or to assess its costs and consequences for victims. As a result, the true extent of identity crime in Australia is likely to be both underreported and underestimated.
The development of a National Identity Crime Measurement Framework has been identified as a priority activity to support implementation of the National Identity Security Strategy (NISS), which the Council of Australian Governments agreed to in 2012.
As part of the NISS work plan, the Australian Attorney-General’s Department (AGD) is coordinating a project to assess the feasibility of establishing an ongoing program for monitoring and analysing data on identity crime. However, as a national initiative, it would not be feasible without support and input from a range of government agencies across all states and territories and the Australian Government.
By improving the available information and evidence on identity crime, the primary aims of this Measurement Framework are to:
measure the extent of identity crime and misuse in Australia
assess the effectiveness of policy and operational responses to identity crime and related