Identity indemnity: Insurers are launching coverage for one of the fastest-growing white-collar crimes--theft of personal information and the use of it to make fraudulent purchases. (Property/Casualty).

Mary Ann Avnet remembers waiting in line at a department store to pay for some Christmas presents when the cashier told a customer she could earn a discount by updating her store credit card. When the cashier said she could update the card on the spot, the customer agreed. The cashier then verified the customer's name, address, telephone number and Social Security number by reading them aloud-loud enough for many people in line to hear.

For those with criminal intent, the information was a treasure trove, probably enough to gain access to the unwary consumers bank account and credit accounts or to establish new credit and bank accounts in the victim's name. It is the kind of information that can be used by thieves more easily than ever, given the speed and global reach of the Internet and telecommunications, said Avnet, vice president at Chubb & Son, Warren, NJ., and marketing and customer relations manager for Chubb Personal Insurance.

Chubb is one of at least three insurance companies to offer some protection. Since late 1999, Chubb has automatically added up to $25,000 worth of reimbursements for expenses relating to identity theft to its homeowners policies. Travelers Property Casualty, Hartford, Conn., pioneered the homeowners coverage in September 1999 and added a free-standing policy in mid-2000. New York-based American International Group, as part of its AIG eBusiness Risk Solutions business, offers individuals coverage through an enhancement program with its business clients. The policy offers reimbursement of certain expenses and legal assistance related to identity theft, virus circulation and physical damage to computers that may have occurred as a result of personal Internet or wireless use.

A New Crime

Only eight years ago, identity theft/fraud was largely unknown. "When we first started getting calls in 1993-94, people were describing a problem we didn't have a name for," said Beth Givens, director of the Privacy Rights Clearinghouse, a nonprofit consumer information and advocacy program in San Diego. Givens said her group researched the problem, named it and developed a guide for victims. Because of the guide, the clearinghouse became a magnet that attracted more victims to contact it. Since 1995, identity theft has been its most common complaint, representing 25% of all calls, said Givens.

In 1998, Congress enacted the Identity Theft and Assumption Deterrence Act, which made identity theft a federal crime. Under the law, the Federal Trade Commission was mandated to set up its Identity Theft Hotline and Data Clearinghouse to receive and process complaints from victims. The system receives complaints by phone, mail or Internet. In 2000, the first frill year of existence, the system processed more than 40,000 entries, 69% of which were actual complaints; the rest were requests for information from people concerned about becoming victims. By May 2001, according to USA Today, the FTC was receiving 2,000 complaints a week. Officials from the Justice Department in July told The Washington Post that there are as many as 500,000 identity-theft cases a year in the United States, making it the fastest-growing white-collar crime. In January, the FTC reported that 42% of the consumer-fraud complaints it received in 2001 were for identity theft.

The number of cases could grow to 700,000 this year, said Robert Nighan, vice president of Travelers Bond and product manager of identity fraud expense coverage. That would still represent considerably less than 1% of the adult population of the United States, which may at least partly explain why insurers so far provide the coverage free or at minimal cost, primarily as an addition to homeowners policies.

It could be years before victims of identify theft discover that they have been victimized. Once personal information is stolen, the thief can use it to open new accounts in the stolen name and with a new mailing address. So the thief might sign up for a new credit card, rent an apartment and sign up for cable television, heat, electricity or telephone. Sometimes, the thief will declare bankruptcy in the victim's name. Thieves can use these strategies for years before victims find out, especially if they don't check credit reports annually, as advocates suggest, Givens said.

Travelers' coverage is the brainchild of Nighan, who realized the need for this type of insurance coverage after he became a victim.

"I was very lucky it was minor," he said. "I kept getting a call at home from a merchant in California about my order. I ignored it, because I didn't order anything. It was on a Visa card."

Nighan eventually called the merchant, who by that time had determined that the transaction was fraudulent. At the merchant's request, Nighan reported the fraud to the police department near the store. Fortunately for Nighan, that purchase was the only fraudulent one on his card.

"What if I had to call 50 stores?" he said. "When most people find out about a fraudulent transaction, that's only the beginning. It can just go on and on."

List of Expenses

Nighan and his staff researched the topic in government and consumer publications. The Privacy Rights Clearinghouse put Nighan in touch with some victims, and Nighan said Travelers built the product around their experiences. The contact led to coverage under six different kinds of expenses:

* Long-distance telephone calls.

* Attorneys' fees. "Sometimes there's a warrant for your arrest," said Nighan. "That's something you want to get cleaned up pretty quick. Or you may need to attend a collection proceeding."

* Loan application fees from when a policyholder must reapply for a loan.

* Lost wages due to time taken off from work to deal with the fraud. "Instead of burning vacation days, you can take unpaid leave and then be reimbursed by insurance," said Nighan.

* Certified mail.

* Notary costs.

Travelers originally offered identity-fraud expense coverage as an endorsement to its standard homeowners or condo/tenants policies. That is still where most of its identity-theft insurance resides. The rest is in the free-standing policies and in the coverage it began to offer Dec. 18 to owners of Travelers High Value Homeowners policies. The identity fraud expense insurance covers up to $15,000 on the homeowners policies with a $100 deductible. Owners of standard policies pay $25 a year for the coverage, while those of the high-value policies receive the coverage for free as an enhancement.

The free-standing policy--which Travelers calls the Personal Financial Protection Plan--costs $100 a year for up to $10,000 of coverage, $147 for $20,000 and $195 for $30,000.

Nighan declined to say how many customers own the coverage, but he said the fastest growth is still in the standard homeowners policies. "Feedback from the agents tells us it's a good differentiating factor," he said. "I try to keep an eye on whether there are other expenses we're not covering. It was logical to make it part of homeowners policies, because it was a simple way to do it, just another aspect of protection."

Nighan doubts that the free-standing policy will become more popular than the homeowners add-on, since Travelers has such a large book of the latter--about 2 million policies--which provides an almost limitless source of future sales. The personal policy, however, provides coverage for access device fraud (such as the $50 limit for which a credit card holder is responsible if the card is stolen and used) and theft from safe deposit boxes.

Travelers does not underwrite identity-theft coverage, and Nighan added there is no premium differentiation. Its actuaries priced the coverage by using information about the frequency and severity of claims and by establishing the coverage maximums, he said.

Travelers was not driven to invent identity-theft coverage due to any adverse claims experiences. Customers did not make identity-theft claims under homeowners or other kinds of coverages, Nighan said. "We did some customer-focus group tests, and we were very pleased about the level of education on it," he said. "People were familiar with the problem."

Not Just the Rich and Famous

Chubb found that few people took the threat of identity theft seriously or knew what agents were talking about when it began offering coverage two years ago, Avnet said. But now when an agent mentions the enhancement, "people really like it," she said. "People are now convinced it's not something that only happens to the very rich or very famous."

Chubb has not charged for its coverage, but automatically provides up to $25,000 of it with all homeowners forms. The deductible is $500.

With automatic coverage, Avnet said, Ghubb does not have any hard evidence the insurance is in demand. "We've heard from agents it's a good thing to include and from customers that it's a good idea to continually upgrade their coverages," she said. "People like the idea of broadness of coverage and companies that seem to be on the cutting edge." Ghubb also provides kidnap expense insurance in its homeowners policies.

Underwriting against identity fraud would be difficult, Avnet said. "There's no good profile of the target, not by age, wealth or position in the community," she said. "The worst part is that you don't know about it until long after it is a problem. You also have to first prove that you really are a victim and did not incur the bills.

"Also, identity theft is not a high priority for the police, though it is now prevalent enough to get their attention," she said.

AIG markets to businesses, associations and employers, who in turn make the coverage available to their customers, members or employees. Among AIG's customers are credit card companies and other financial institutions that use a customer's credit card, bank account numbers or brokerage account numbers for online transactions; Internet service providers; credit information services providers that report credit irregularities; employers managing their employees' personal information online through company systems; and associations offering personal insurance as part of member service programs.

AIG launched the coverage Oct. 8, 2001. The program, which had a credit-monitoring company as one of its first clients, went extremely well during its first three months, said Jean McDermott-Lucey, vice president of AIG's eBusiness Risk Solutions. "There was a lot of interest," she said. "We've talked to a number of clients." She said AIG's distribution partners help spread the word.

McDermott-Lucey rated the potential for the product as "tremendous," adding that identity theft is "one of the fastest-growing crimes."

The rate depends on the customer's population base, with the larger base paying a lower rate, she said." If you're a credit-monitoring company, you also have better risks," she added.

AIG will cover up to $25,000 a person. Deductibles range from nothing to as high as a client would like, but usually about $500.

"We're not offering coverage on a personal lines basis yet, but if a company wants to give employees $1,000 of coverage and offer an upsell, we can do that."

Chubb's Avnet said the fast rise in technological capability and accessibility created conditions ripe for the introduction of identity-theft insurance. "A very high percentage of the population does something online on a regular basis," she said.

Top 10 Consumer-Fraud Complaints of 2001

Identity theft topped the list of consumer-fraud complaints of 2001,
according to the Federal Trade Commission. Identity theft accounted for
42% of the 204,000 complaints entered into the FTC's Consumer Sentinel
database last year.

Rank  Consumer-Fraud Complaint           %

 1    Identity Theft                   42%
 2    Internet Auctions                10%
 3    Internet Services and             7%
      Computer Complaints
 4    Shop-at-Home and Catalog Offers   6%
 5    Advance-Fee Loans and             5%
      Credit Protection
 6    Prizes/Sweepstakes/Gifts          4%
 7    Business Opportunities and        4%
      Work-at-Home Plans
 8    Foreign Money Offers              4%
 9    Magazines and Buyers Clubs        3%
10    Telephone Pay-Per-Call/           2%
      Information Services

Source: Federal Trade Commission

Relationships Between Identity-Theft Victims and Suspects

In 2000, 19.5% of all victims who provided relationship information to
the Federal Trade Commission Identity Theft Hotline and Data
Clearinghouse had a personal relationship with the suspect.

Relationship                      %

Family Member                   9.6
Roommate/Co-Habitant            2.1
Neighbor                        1.4
Workplace Co-Worker/Employer/   1.6
Employee
Otherwise Known                 4.8

Total                          19.5

Source: Federal Trade Commission
How Thieves Use Identity Information

Credit-card fraud was experienced by 43% of 94,000 identity-theft
victims profiled by the Federal Trade Commission. (*)

Credit-card fraud                 43%
Purchase of phone or utility
 service                          20%
Loans and bank fraud              20%
Employment                         8%
Government documents or benefits   7%

(*)Victims may experience more than one form of identity theft

Source: Federal Trade Commission

Note: Table made from pie chart

RELATED ARTICLE: Minimizing the Chances of ID Theft

You can never prevent identity theft, but there are steps you can take to reduce your chances of it, said Beth Givens, director of the Privacy Rights Clearinghouse, San Diego.

One of the best things to do is to obtain a credit report annually from all three credit-reporting companies: Equifax, Experian (formerly TRW) and Trans Union. For mailing addresses and phone numbers, go to www.usdoj.gov/criminal/fraud/text/idtheft.html on the Internet.

Checking credit reports allows individuals to discover activity in their names that they might not otherwise see for years. Each credit bureau may have slightly different information, so it is worth checking all three annually, and then one of the three six months later, said Givens. "The earlier you catch a problem, the less hassle for you," she said. A credit report costs $8, but residents of some states can get one free copy every year.

Givens also recommended these precautions:

* Shred all documents that would otherwise be thrown out in the trash. Would-be identity thieves can look through garbage to find Social Security numbers, account numbers, phone numbers and other key personal information.

* Don't leave outgoing mail in your mailbox. Take it to a mailbox or post office.

* To safeguard incoming mail, purchase a locking mailbox.

* At work, be an activist for responsible handling of personal information. "More and more identity theft is occurring in companies where there's a dishonest employee stealing Social Security numbers," said Givens." The increase in workplace theft is happening because dumpster diving is becoming less lucrative."

The Federal Trade Commission also offers some suggestions:

* Adopt a "need-to-know" approach for personal data. A person claiming to be from your bank calling to update information is an impostor; the bank already has the information. Also, refrain from printing your Social Security or phone number on personal checks.

* Have mail held in the post office or have a trusted friend or family member collect and hold it while you are traveling.

* Avoid giving personal information over the phone in a public place when others can hear.

* Retain monthly statements and checks for at least a year in case you need to dispute a particular check or transaction, especially if they purport to bear your signatures.

The Privacy Rights Clearinghouse advises to be "especially protective" of your Social Security number, When they were first issued in 1936, the federal government assured a skeptical public that use of the numbers would be limited to Social Security programs. Today, however, they are the most frequently used record-keeping numbers in the United States, the clearinghouse reported. Mary Ann Avnet, a vice president at Chubb & Son, said a soccer club wanted a father's Social Security number on his child's registration form. The club admitted to the father it really didn't need the number, but that a field on their computer required it. He filled in the number with all 9s, and it worked, she said.

Social Security numbers are required for tax forms employment records, and most banking, stock and property transactions. Government agencies now also use them, but they are required to give you a Privacy Act notice that describes what they will do with the number and what happens if you refuse to provide it.

Social Security numbers are commonly used for employee files, medical records, health insurance accounts, credit and banking accounts, and university identification cards. They are also frequently used in a variety of computer databases that give access to information you may want to keep private, but allow easy linking of databases, according to the clearinghouse. It said there is no law to prevent businesses from asking for the number.

Givens recommends being assertive about not providing the number and being as stingy as possible in providing it. Even a doctor's office may not have a right to it. She said she has been in touch with a Maryland man who refused to give it, was denied service, and he plans to sue the doctor on grounds that the doctor is obligated to serve him through a contract with his insurance company.

Another tip from Givens: When you apply for a loan or bank account, find out how they will handle the information, asking specifically whether they will shred the paperwork or keep it in locked cabinets and whether they will restrict access to computer files.

The Reality of Being a Victim

Victims of identity theft must spend a lot of time fixing things. The self-employed are particularly hard hit and vulnerable, and they might be interested in insurance coverage, said Beth Givens, director of the Privacy Rights Clearinghouse, a nonprofit consumer information and advocacy program in San Diego.

Another candidate might be a single parent. "When you're a victim, you often have to take time off from work, essentially live near a telephone, call and call and call until you get through, and then often get bounced around," Givens said. "They'll send you an affidavit, and after you fill it out you'll have to have it notarized, and then you'll have to stand in line to send it back by certified mail. Sometimes you have to fax documents. You might have to hire an attorney. Unfortunately, it's not easy to get fraudulent accounts off a credit report."

Victims must become very good at record-keeping, she said. They may have to write to the credit bureaus many times. "In some cases, it becomes a frill-time job in itself, so if you're self-employed, it can eat into your income. If you're salaried, you will probably have to work evenings and weekends or take vacation time."

The Federal Trade Commission is working to reduce the time and stress associated with clearing up the problems of identity theft. On Feb. 5, it posted an ID Theft Affidavit on its Web site, www.consumer/gov/idtheft. Some 29 entities, including the three major credit-rating bureaus, have agreed to accept the affidavit as a standard form, eliminating the need for victims to fill out different forms for each business or organization they must contact. Among those accepting the affidavit are Bank of America, Chase Manhattan, GE Capital and the Privacy Rights Clearinghouse.

Although identity theft is growing rapidly, Givens was unsure about the industry's prospects for selling insurance to cover it and was unaware insurance is available. She said she would consider obtaining the insurance as an add-on to her homeowners policy, but she thought $100 to $195 was a lot of money for the stand-alone coverage, especially for lower-income people. In many cases, the out-of-pocket expenses are not great; the real cost tends to be the expenditure of time, she said.

The most serious identity theft faced by the average American involves crimes committed by someone using another person's name, Givens said. "You're not likely to know you have a criminal record until you're stopped for a motor vehicle infraction like speeding," she said. "When you're stopped, it's common practice for officers to check your criminal record. They could arrest you on the spot, take you to jail and keep you, even for several nights. That's the worst-case scenario."

Once an identity-theft victim's name is associated with a crime, it's very difficult to wipe the criminal record off the slate, she said. "If they don't have the real name of the criminal, your name is the best they have, and they want to maintain a record of the crime in case they find the real perpetrator. You can be an alias for shoplifting or arson or whatever the crime is." If law enforcement insists on maintaining the record, an identity-theft victim should insist it use John Doe as the name in the records, she added. In California, such victims can register with the attorney general's office; an officer doing a criminal check in the future would then see a notation that the person is a victim of identity theft.

"That record will last your whole lifetime," Givens said. "You'll be at risk of being arrested your entire life." Especially if the insurance is not underwritten, it can be especially useful for victims of identity theft if it will pay for an attorney, she said.

Credit grantors are not as careful as they should be about granting credit, Givens said. And it is increasingly easy for impostors to obtain identification numbers.

"Unfortunately, a criminal can do a lot of damage with a Social Security number and a name," she said, "If they also find a date of birth and a mother's maiden name, they look very credible to credit grantors." Victims often say that only their names and Social Security numbers were linked, but that credit grantors did not properly check other information provided by the impostors, she added.

"If financial institutions use a Social Security number, they should add a personal identification number," said Givens. "If they would more carefully check credit applications, we would stop almost all identity theft in its tracks, especially when there's an address change."

Givens also recommended that the three major credit bureaus work harder to help prevent identity theft.

"If the account activity they see falls outside the person's use profile, they should notify that person," she said. "Say a person had two credit cards for six years, and in two weeks, there are applications for several more. They should contact that person." She added that Colorado recently passed a law requiring this kind of notification.