This paper reports the results of a 2008 survey of Canadian consumers conducted by the McMaster eBusiness Research Centre (MeRC) on behalf of the Ontario Research Network on Electronic Commerce (ORNEC). The survey was designed to determine the nature and extent of identity theft and fraud in Canada. It also examines the concerns of Canadian consumers and their behaviour related to the prevention and detection of identity theft and fraud. The survey was conducted using an Internet panel, with 3017 valid responses.
This was the second of two consumer surveys conducted by MeRC for ORNEC. The first survey was conducted in late 2006 and collected information about a large number of historical cases of identity theft and fraud1. The survey described in this paper was conducted in early 2008 and focuses on cases that occurred in the most recent year.
According to the results of this survey, 6.5% of Canadian adults, or almost 1.7 million people, were the victim of some kind of identity fraud in the last year. These victims spent over 20 million hours and more than $150 million to resolve problems associated with these frauds.
More than half of these frauds involved nothing more than unauthorized purchases made with credit cards. Consumers rarely pay the costs of such frauds. If we eliminate credit card fraud from the incidence rate and costs quoted above, the number of victims is reduced to 700,000 but they still spend 12 million hours and more than $110 million dollars of their own money to resolve these other problems.
Most victims (57%) did not know how their personal information was accessed, but when they did know, the identity fraud was most often associated with a business transaction conducted either in person (25% of these cases) or online (15% of these cases). The proportion of online transaction fraud has increased from 5% of cases historically. Debit card skimming operations made up another 13% of the cases where the method of access was known. Recent US studies have found a significant increase in telephone scams and frauds, but our data does not reflect this increase.
While earlier studies have found that 25% of all cases of identity fraud were committed by someone known to the victim, this survey found that to be the case in only 7% of the total number of cases.
Very few of the cases of identity fraud were reported to the police (13%), credit reporting agencies (6%) or PhoneBusters – the RCMP/OPP fraud reporting agency (0.5%).
In addition to the victims of fraud reported above, another 2.7% of the sample indicated that their personal data had been accessed by unauthorized people as part of a data breach or fraud operation in the last year. This represents another 700,000 Canadian adults who are at risk for identity fraud.
One third of Canadian consumers report that their level of concern about identity fraud is higher than it was a year ago. The level of concern increases with age. Past victims of credit card fraud are less concerned than past victims of other kinds of identity frauds – and are even less concerned than those who have never been a victim. We believe that this is because credit card fraud detection and resolution processes are mature and sophisticated. As far as the consumer is concerned the problem is easily and quickly resolved at little to no personal cost. This is not the case for many other identity frauds. This result suggests that it is important to isolate credit card fraud and discuss it separately from other identity frauds.
Canadian consumers protect their personal information from physical theft in the following ways:
- 79% shred financial documents or other important documents all of the time or most of the time
- 59% use a locked mailbox all of the time or most of the time
- 57% keep sensitive information in a secure location, such as a locked box or drawer, all of the time or most of the time
- 50% have eliminated or reduced the number of identity documents that they carry with them
- 30% have either stopped receiving mailed account statements or reduced the number of mailed statements that they receive
Canadian consumers take the following measures to keep their personal information from prying eyes or unauthorized access:
- 92% never or rarely give information over the phone to people claiming to do surveys or offer promotional goods or services
- 88% make sure that no one is watching, all of the time or most of the time, when using an ABM or debit card machine
- 35% have reduced or stopped giving their credit card to waiters or gas station attendants
Safe online practices are also important to protect personal information, and Canadian consumers report the following practices:
- 75% use hard-to-break passwords all of the time or most of the time
- 59% use different passwords for different applications all of the time or most of the time
- While most consumers change their important passwords at least every 2-5 years, 30% report that they never change these passwords
Fully 20% of consumers report that they have eliminated or reduced the amount of shopping that they do online because of a concern about identity theft and fraud. Nine percent report that they have eliminated or reduced online banking activities because of similar concerns. These results show that the threat of identity theft and fraud is having a significant and detrimental effect on e-commerce in general.
Frequent and careful monitoring of accounts is the best way to detect and minimize the effects of identity frauds. Eighty-five percent of respondents have online access to at least one of their bank accounts and 96% of these consumers check their account balances online. The majority of people do this every few days or better. Other detection practices reported in the survey include:
- 49% had never requested a copy of their credit report
- 77% had never checked land registry records
Forty-one percent of respondents reported that they had received an email from a bank or other company asking them to verify or update their account information. This describes an identity theft practice known as phishing. Of those that had received such an email, 2.7% report that they responded and 1.0% report that they do not know or were not sure if they had responded. This potential response rate of 3.7% is an improvement over a rate of 4.9% found in an earlier survey.