Cornell University Johnson at Cornell University

Intellectual Capital

Big freeze: Consumers not protected from ID theft

Professor Eric M. Eisenstein Professor Eric M. Eisenstein

Roadblocks to a cheap, effective method of protecting consumers against identity theft have been erected by credit bureaus, which may be more interested in protecting profits instead of consumers, according to a new study by Eric M. Eisenstein, assistant professor of marketing. "Identity Theft: An Exploratory Study with Implications for Marketers," will be published in an upcoming issue of the Journal of Business Research.

"There is a fundamental conflict between the interests of credit bureaus and the interests of consumers and society," says Eisenstein. "This is because credit bureaus make more money by selling their monitoring services, which do not prevent identity theft, than they would by selling other products, which would better protect consumers against identity theft."

The study claims the best protection against identity theft is to create a "security freeze." The "freeze" acts to lock down a consumer's credit bureau file, so that it cannot be viewed or shared, making it almost impossible to open a new line of credit. This prevents new account fraud, whereby a criminal uses personal information to open new accounts and relationships in the victim's name. In order to open a legitimate account, the consumer must temporarily "thaw" their bureau file. Yearly losses from new account ID theft are estimated to range from $17 to $35 billion for retailers and lenders each year, with additional billions of losses for consumers in wasted time and out-of-pocket expenses.

Eisenstein concludes that, in order to protect their profits, the three main credit bureaus, Experian, Transunion, and Equifax, make security freezes more expensive and difficult to obtain. "They are earning hundreds of millions of dollars per year on their monitoring product," Eisenstein says. "At Equifax alone, they have over 1 million customers paying an average of $85 per year. That's a lot of money.

"The monitoring system is like a burglar alarm; it notifies you there's an intruder, but only after that intruder has entered your home," Eisenstein says. "The security freeze is much more effective. Freezes result in a nonlinear reduction in identity theft that is similar to 'herd immunity.' Thus, excellent protection can be obtained by protecting a small fraction of all people."

While freezes are effective, they can be difficult to acquire and use. Each state has separate laws to safeguard consumers, so the price and process can vary. The credit bureaus have lobbied to keep freezes expensive and hard to initiate, and they have made them cumbersome and slow to thaw. For most states, each credit bureau requests a separate certified letter with copies of identity information along with a fee, so freezing accounts for a husband and wife can cost as much as $60 plus postage, assuming all the requirements are met. The bureaus set up hoops to jump through to thaw accounts as well, asking for certified letters and often taking a long time to process. "The existing procedures are much too difficult," Eisenstein says. "From society's point of view, consumers should be able to freeze or thaw online or over the phone, using a PIN of their choice, and the thaw should take effect within 15 minutes or less."

The implications of identity theft for marketing are severe. New account identity theft already deters some consumers from shopping online. If identity theft were to substantially increase, there could be a serious backlash against critical marketing activities, including the usage of CRM databases and the ability to provide instant credit, or onerous reporting requirements regarding use of consumer information. Eisenstein comments, "The interests of marketers are aligned with the public good – we should want to see a federal law passed that enables all consumers to cheaply and easily obtain a security freeze at all three bureaus, cheaply and rapidly thaw their files, and the entire process should be streamlined and simple."

Comments (0)

Post a new comment: